ITPM using ISACA CobiT® as a QMS Procedure and Project Management Tool

ITPM has found ISACA CobiT® to be a valuable tool for discovering a client’s organizational capability to successfully implement and sustain IT programs and projects.

We used the CobiT® framework as a checklist to score a client’s CJIS project to integrate information systems. This enabled us and the client to quickly identify areas most critical to program and project success, and to prioritize those requiring improvement. The assessment also provided additional benefits to enterprise IT governance and project management.

In response to this success we added the CobiT governance checklist scored assessment as a required procedure for all engagements as part of our ISO9001/TickIT registered Quality Management System.

Sheriff Hennessey Honors ITPM

San Francisco Sheriff Michael Hennessey honored Al Corker of ITPM at a ceremony marking the first year in production of its JMS/CJIS project.  Also honored were New World Systems, the City’s Department of Technology, and the Sheriff’s Department’s project team.

The San Francisco Sheriff’s Department Jail Management System (New World Systems) went into production in December 2009. The new system processed ~25,000 bookings during its first year in production and has greatly reduced human error.  Since going live the Sheriff’s Department has realized significant efficiency in booking, classification, movement, housing and release. JMS information is shared with other criminal justice agencies and the Court’s mainframe calendaring application via Oracle SOA middleware.  The Department of Technology developed and maintains the SOA integration components.

“Our new jail management system represents a sea change in jail operations and a major step forward for criminal justice IT in San Francisco,” said Sheriff Hennessey. 

Al Corker (L) President, IT Project Methods receives Certificate of Merit from Sheriff Hennessey

ISO 9001:2008 & TickIT 5.5 Certification

IT Project Methods achieved ISO 9001:2008 and TickIT 5.5 registration of its Quality Management System.

Our business drivers for this key investment are:

1. More clients get a better product, at a lower cost through institution of product delivery processes.
2. Third-party surveillance and re-registration audit discipline helps prevent harmful process/quality drift.
3. Adoption mitigates many problems often experienced with delivering inconsistent services during periods of business expansion and contraction.

Please tell us —

What aspect of quality and process in IT projects is most important to you?

How do you verify vendor adherence to quality processes?  Do you add quality processes to your contractual language?

Advantages of a Project Management Office (PMO)

In the midst of the current worldwide economic chaos, there is a growing awareness of how dependent most businesses are on their information systems. Public and private industry has undergone radical changes, often in the form of reorganizations and layoffs. Vital information maintained in corporate systems may be at risk as the people who knew how to support and access systems leave the workplace. Building organizations with a standards based approach to IT preserves investments and puts remediated projects on a solid footing.

Too often, immature organizations have taken a “search for the silver bullet” approach, imagining there is a killer application or single technique or method to quickly solve all current problems. This is rarely, if ever, successful.

Consulting firms enter such engagements with mixed feelings. In such cases, it’s important to remember that this is no time to make it up as you go, but a perfect opportunity to introduce the use of standards and guidelines, as well as the concept of centralized and professional management.

One of the “buzzwords” used to express a general need is the “Project Management Office” or “PMO.” In many cases, a PMO initiative is simply a thinly disguised short-term fix intended to counter complaints of leadership or management problems, without actually focusing on the root cause of the problems. Unfortunately, because of this short-sighted approach, these key positions are often staffed with the very people who caused the problems in the first place. In this scenario, IT workers trudge from one failure to the next, within their own enterprise.

For a PMO to be successful, it must be supported by executive management who will engage in creating an environment that supports successful projects. Mature organizations approach the PMO implementation as an opportunity to centralize management controls, coordination and support for the entire corporate portfolio of programs and projects, and to better align all project activities with corporate strategic goals. Many times, the “PMO” is shorthand for all the understaffed or missing management skills for a large program or portfolio. In either case, using accepted industry standards and best practices as a basis for delivering goods and services provides the means to support sustainable processes. A well-executed PMO may also provide a valuable incubator for developing project management capacity through mentoring assignments. Implementing a quality management system (QMS) in support of the PMO’s activities increases its value tremendously, and further provides assurance of successful projects and their deliverables.

Many companies just don’t have the internal expertise or training to set up a PMO. In this case, outside assistance can provide the services to help protect a corporate investment.  A consultant can provide leadership and mentoring that will help the client institutionalize the elements needed for a successful ongoing PMO. For the value of lessons learned on a program or project to be sustained in an organization, senior management must be committed to the bigger goal of institutional change. In the worst case, you will have an improved program or project, which is n. ot a bad outcome in a time when ARRA reporting goals will soon challenge the uninitiated.

Lack of financial regulation invites financial crises

While individual greed played a role in shaping the current financial crisis, the lack of regulatory oversight and accountability provided opportunity for financial products without any risk assessment. Evidence suggests that product life cycle modeling could have increased understanding of risks posed. It is now clear that these products were not adequately understood but were sold to consumers anyway!

Today, the majority of consumer products carry required warranties and warnings. Why should financial products responsible for supporting our individual and national wealth, national security and the stability of global financial markets be allowed to operate in a free-wheeling environment?

Better regulation supports risk reduction

Business process analysis has long been a key tool in providing better understanding of complex and critical events in the value chain. Modeling has been used widely to identify improvements in the key areas of product lifecycle management and monitoring regulatory compliance. Regulation can mandate more informed decisions and minimize risk.

No SOX, no service

The Sarbanes-Oxley legislation – a direct response to evidence of a lack of effective regulation of financial records keeping surfaced by the Enron and WorldCom scandals – was the driver behind the SAS 70 Type II audit requirements.  PricewaterhouseCoopers, in their first Sarbanes-Oxley white paper, quoted the SEC’s basic statement describing adequate compliance:

“We believe that the purpose of internal controls and procedures for financial reporting is to ensure that companies have processes designed to provide reasonable assurance that: the company’s transactions are properly authorized, the company’s assets are safeguarded against unauthorized or improper use, and the company’s transactions are properly recorded and reported to permit the preparation of the registrant’s financial statements in conformity with generally accepted accounting principles.”

Transparency supports better accountability

A more careful analysis of processes that produced these risky financial products would have increased transparency to both to issuers and investors. This would have better communicated risks to legislators and the public and surfaced the need for controls to protect worldwide markets.

Accurate assessment and public disclosure of risk in financial products demands much better regulation and enforcement. Do you believe that the call for new regulation by Sarkozy and Merkel will result in better future operations of financial markets?

Project Tools: JUSTIS – A Program Management Example

In the “Tightening Budgets Put Emphasis on the PMO” post, we asked for examples of how others are using tools and techniques to manage their portfolios of projects. We’ve received several email requests to put up an example from our own work, and thought that we would share some information on one of our projects to illustrate one approach and invite discussion. Please feel free to ask questions, or comment in any way.Our Project Example: The JUSTIS Program

IT Project Methods, Inc. has been program consultant for the last five years on the JUSTIS program of criminal justice projects.

JUSTIS is a portfolio of related and inter-dependent projects whose primary goal is to retire an outdated criminal justice mainframe information system, while leveraging the already considerable investments of member agencies in individual client/server case management applications.

Designed as a “Federated” enterprise system, JUSTIS allows each agency to retain local administration and control of its application and database, but with the infrastructure physically located in a central secure data center providing reduced support costs and improved maintenance and physical security.  By using Oracle SOA components to connect and integrate line-of-business systems, the task of adding new systems and new services is simplified.  Integration of these previously stand alone automation applications will facilitate one time entry of data for improved workflow and greatly improve capability to respond more rapidly to requests for information. 

 The JUSTIS program consists of the following individual projects:

• JUSTIS Infrastructure and Server projects
  • Server Consolidation Project
• Sheriff’s Department Jail Management System and Records Management System
  • Sheriff’s Department In-Custody and Post-Release Programs Case Management
  • Sheriff’s Department CLETS Connection
• District Attorney’s Case Management System
• Public Defender’s Case Management System
• Adult Probation Department’s Case Management System
  • Courts’ collection of victim restitution, fines and fees
• Police Department’s Records Management System
• Juvenile Probation Case Management System
• Courts Case Management System (information sharing only)
• Department on the Status of Women Portal Project
• Mayor’s Office of Criminal Justice Portal Project
• JUSTIS Hub (ORACLE^TM SOA components)
  • Core functions (BPEL^TM)
  • Information exchange between Case Management Systems and Mainframe
  • Analytics and Reports Portals
  • Data Warehouse
• Mainframe Criminal Justice System Retirement Project
• Department of Emergency Management (911) RMS interface (information sharing only)

Our tool is INNOTAS^TM

As part of our work with San Francisco JUSTIS’ management to enforce an overall IT governance structure and provide a central Project Management Office (PMO) function, we chose INNOTAS^TM, a San Francisco-based provider of a new Software As A Service (SAAS) application for Project Portfolio Management.  This turned out to be the most reasonably priced offering that was also highly placed in the Gartner “Magic Quadrant” for PMO applications.

With INNOTAS’ flexible views stakeholders can easily look at program or project information from any web browser by department or cost center, and create reports and dashboards for status updates to stakeholders. INNOTAS also supports individual time and expense reporting, as well as project resource (asset) tracking. Reports can be easily exported to Excel for further manipulation. The instance also provides the online central document repository for the Program, allowing any authorized member to view, retrieve, print or email any document or other artifact to which they have access.

With the addition of their “Portfolios” functionality in June of 2007, INNOTAS’ flexibility and power were greatly enhanced.  With this new feature, we are now able to “slice and dice” cost, scope and schedule data using virtually “infinite” hierarchies of groupings.

If you’d like to know more we would be pleased to share what we know so far with you.

So, that’s our approach for this Program. How are you managing your portfolios or programs, and what tools have you found to be most effective?  We look forward to hearing from you.

Iteration Plans for COTS Projects

The commodity-off-the-shelf (COTS) project shares a lot of process with the custom system development project. This is common sense since every COTS product is the result of a vendor’s custom development project, and both types of project share a common goal.  The advantage to the organization implementing COTS systems is a greatly simplified project.

The COTS implementation includes many of the same activities that comprise various parts of a custom project.  The methods for completing COTS projects therefore use many of the same methods used for delivering custom systems.  These methods generally address certain design elements or functions of the application that can not, or should not, be pre-configured in the base product by the vendor, as they will vary according to a particular customer’s requirements.  In most commercially successful COTS products, the vendor will provide methods to simplify modification or customization of the base application to suit the individual customer’s needs.  The customer typically discovers needs and implementation options as the project proceeds.  This is usually done in a series of successive, repetitive passes or iterations.

It is beneficial to implement the specific processes to be used for the COTS project from a fully fleshed out and cohesive SDLC customized for that project.  A careful evaluation of the project and the customer is needed to gauge the appropriate level of investment in adherence to process.  Many professional IT organizations attempt to invoke a prescriptive set of SDLC methods, but for many projects a review of SDLC compliance needs on a project-by-project basis usually saves time and money. How have you addressed the iteration planning challenge?  What have you found that works for you? For more detailed information please contact IT Project Methods.

Tightening budgets put emphasis on the PMO

The pundits are warning us that government agencies are about to get pummeled again with budget woes.  That means many departments are facing cancellations of plans to add badly needed IT managers and staff.  Budget requests are going to be pushed back and only essential services for critical projects will get funding. We expect to see more focus on addressing very specific challenges within the project lifecycle.  Very lean funding cycles typically place a renewed emphasis on IT governance and project prioritization methods.  Senior managers always enter the budget preparation period thinking about how they can make adjustments to the over-all IT game-plan.  The first thing they may conclude is that the long overdue establishment of the PMO (Project/Program Management Office) would have been a darn good idea but more often that resource is not on-line.  What steps are next?

There are a number of well defined processes (typically found in a PMO governance suite) that can be invoked in a brand new PMO or in an operating committee setting that can address the governance issues.  At the top level of this problem food chain there are a number of policy issues dealing with developing consensus about which projects are the first among firsts and where the dollars need to go.  These problems are often referred to as ill-structured problems and are amongst the most complex management challenges.  Actions that deal with this group of challenges must enjoy broad consensus in order to avoid becoming unraveled.   The required consensus can only be generated from work done inside the process used to analyze the problems and identify the options.  A good grasp of methods that support public good and keep private need in check also helps.

Which tools and techniques does your organization use to establish project priorities?  How well do decisions keep their footing?  Is the process stable where you work or do you jump from one project to another on a long list of top priority projects?  Are cuts leveled out on a percentage basis across your IT projects? 

Defending the IT budget

If we are living in the age of technology, why do very few IT practitioners seem to be able to adequately construct, explain and defend their numbers when it is budget time?  

Operations budgets seem to remain reasonably predictable but are still subject to year-over-year variation in investment requirements. Development budgets are more difficult to construct, manage and defend. There is a readily-available standard body of knowledge covering project cost estimation and scheduling, but in many cases it would seem that – where drafting the annual budget request is concerned-these tools are forgotten or ignored.  When it comes to budgeting, there is usually built – in institutional tension between budget groups and IT groups that must be overcome if both sides are to be satisfied.

Transparency is the stated goal on both sides but it seems to be rare. How do you address the challenges of winning your budget? Are final budget decisions made behind closed doors and do you always come up short? Is detailed documentation a requirement, and is providing it seen as an asset or liability? What is the effect on budgeting of important projects that are “king makers” for powerful managers; and what happens when these projects compete for budget? Does prioritization hold up under pressure?

The Juggling Earthworm