When are your requirements ready?

A very common failing in all sorts of projects is being stuck with what are in fact quite inadequate requirements.

The fact is, most organisations are pretty bad at explaining exactly what it is they want a project to accomplish. There are lots of good reasons for this - the situation at the start of a project is often fluid or unclear, there are too many options to be precise, it's hard to define a truly innovative idea in detail until you have tried it out, conditions and priorities change as the project proceeds, better ideas surface, and so on.

But that's not the same as simply being bad at requirements. The above issues relate mainly to the content of requirements, which is very hard to nail down definitively; what I am talking about here is their quality - a different issue. Badly defined requirements area major cause of problems for projects and businesses alike, causing the routine delivery of the wrong thing and lots of unhappy stakeholders. Fortunately there are ways of ensuring that the requirements - such as they are - are at least defined well enough for the project to proceed reasonably comfortably.

The issue I have in mind is the requirements review process - how requirements get signed off. There are lots of things you can do to make this fairly robust, but one technique I have seldom seem defined clearly enough is that of asking the requirements' principle users to confirm that they are fit for purpose.

There are three key groups of people who have an interest in how well requirements are stated:
- the analysts who will have to translate the requirements into a functional solution.
- the (user and operational) acceptance testers who will have to check that the requirements have been met.
- the operations personnel who will have to convert the requirements into SLAs and OLAs.

These people are not generally very interested in the requirements contents. But give them poorly quality requirements - too vague, imprecise, unanalysed, inconsistent, with key areas missing, and so on - and they simply won't be able to do their job. Which means that the solution the project delivers is all but bound to leave everyone with a nasty taste in their mouths.

All I am advocating here is that requirements be signed off by these groups. As far as I am aware, although many organisations ask their analysts to approve requirements, most don't ask testers or operations staff, and this may be a major cause for project failure. It's not hard to arrange, and it should certainly be welcomed by the groups in question. If, on the other hand, you cannot get their approval, maybe you should be looking to the users to define what they want a little more clearly - and so avoid storing up trouble for the future.

Of course, there's also a case for weak requirements. Well, not exactly weak, but at least requirements that recognise that they may not be the last word. Organisations and businesses change. So do markets and so does good practise and the opportunity the requirement was originally designed to address. So if you're embarking on an 18-month project to deliver x, it's probably not too smart to try to nail down your definition of x too soon. But that is not to say that you should not try to meet the above test from the start - it's just that your project should also make a strong allowance for change. That could mean a large tolerance, but it should also mean setting the right expectations from the start. For example, the business and users should expect to have to re-validate their initial requirements at regular intervals, you might want to prioritise items that are pretty safe from future fluctuations (e.g., stable regulatory requirements or generic interface components), design for flexibility (loose coupling, modularity, etc.) and so on.

This is the case for agile, of course - but of that more than enough has already been said by anyone and everyone, including me!

Moving to Agile - Critical business factors

Some years ago I implemented DSDM (then the preferred flavour of Agile) at Churchill Insurance. As far as the core processes were concerned, there was no great difficulty (admittedly we threw everything at it), but the business was a problem for two key reasons: empowerment and availability.

The nub of the empowerment issue was asking the business to allow their own representatives on the project enough authority to approve of what was going on on the spot (e.g., prototypes, changes, reprioritisations, etc.), without constantly referring to senor management. In short, they could not let go of the strings. As anyone who has worked in IT projects for any length of time will know, there is a ludicrous irony in this, because quite a lot of the problem with delivering successful IT projects of any kind is the business’s ambivalent attitude the ownership. In all too many companies, the business want to be in control of the project (i.e., able to make make-or-break calls about it) without taking responsibility for its delivery. The implicit question is always, do you prefer delivery to control?, and all too often the effective answer is ‘control’. This is as much a problem for Agile as it ever was for waterfall projects.

The second problem was getting the required effort from the business representatives to the project. These individuals were necessarily very experienced and valuable people (who else would you empower?) but that was precisely what made them hard to replace in their day jobs. So we needed them to spend about three days a week on the project, but they still needed five (usually very long) days for their BAU work. No surprise, then, that project work soon started the back seat to day job, the quality and speed of decision-making plummeted and the project started to look pretty wonky.

So although the business was keen on an Agile approach, they could not participate effectively. It was a long struggle – only partially successful – to deal with this problem.

What are the Key Success Factors for a new CIO?

I've been following the above discussion on LinkedIn here. Some interesting stuff, so I thought I'd summarise what I have read so far.

The whole thing seemed to me to break into three parts: the first 90 days, creating the day job, and justifying the 'C' in CIO. Here goes...

The first 90 days

• Find how you can save the company money immediately.
• Ask everyone who reports to you for 10 ideas to save the company money.
• Find out how you can make the company money.
• Understand the business – goals, strategy.
• Identify your key customers and stakeholders, and set up KPIs and CSFs forthem.
• Tap existing desire for change.
• Poll IT and business for quick wins.
• Establish your credibility.
• Sell IT actively to executive & stakeholders.
• Evangelize how information makes business competitive.
• Lead how organization thinks about performance.
• Build shared view & alliances with peers.
• Know your department.
• Operations, development, governance, architecture, support.
• Define KPIs & results-based reporting.
• Learn the business
• Always have a backup plan for whatever the IT department does.

Creating the day job

• Build a strong team.
• Talent, performance, delivery, R&R.
• Stakeholder-facing responsibilities.
• Self-managing, self-starting.
• Integrate IT and business.
  
  • Business ownership of projects.
  • Shared/interlocking governance.
  • Budget/investment interlocks.
  • Portfolio management, etc.
• Make sure IT do the basics right first time.
• Emphasise speed of decision-making & delivery.
• Get to grips with your basic technologies.
• Bring development and operations closer.
• Do change management simply but well.
• Routinise governance, architecture, infrastructure and operations.
• Build active innovation and self-improvement into IT.
  • Lesson learnt, empowerment, etc.
  • Track stakeholder satisfaction.
• Develop backup plans for whatever IT does.

Justifying the 'C' in CIO

• Create a credible organisational plan that embeds the dynamism of your first 90 days in IT.
• Be a business executive – not a techie.
• Define a credible but radical vision that creates a quantum jump in IT’s competence and performance.
• • Goal: To move IT from technical enabler to business leader.
  • Create an IT strategy that solves real business problems.
  • Subordinate all tactics to this strategy.
• Manage the politics.
• Foster innovation and change.

BPM, SOA and the relationship between business and IT

I am struck by the fact that discussions about the perennially fraught relationship between business and IT always seems to omit reference to the very different natures of business and IT. IT reality has always worked more or less at right-angles to business reality - an engineering discipline in the midst of business. The links between are generally limited to very high levels at which the relationship is mediated by very general language that does not really require either side to have any insight into the other (i.e., requirements), and at very low levels that actually have little influence over the relationship as a whole (i.e., day-to-day system users).

While this remains the case, there is no practical need for this relationship to get any better, and each side will continue to prioritise their owns engineering/business perspective over the other side’s concerns. And while IT technology always reverts to a strictly engineering mode of thought and the business side lacks a genuine ‘engineering’ element of its own, it is very unlikely that this impasse will be overcome. We can all agree that ‘something should be done’ and even agree what it is, but however important this is, it will never be urgent, and certainly not capable of being built into both sides’ day-to-day ‘common sense’.

However, my own impression is that there are developments in the pipeline that will overcome this. On the one hand, the emergence of service-oriented architectures in IT is forcing IT people to define what they do (even for themselves) in terms even the business can understand. On the other, the (rather slower) emergence of formal business process management is creating a kind of ‘business engineering’ that obliges businesses to thing of their own activity in quasi-technical terms that even an IT person can recognise. Between them, SOA and BPM are creating the language, the conceptual framework, and the technical toolkit business and IT need to create that ultimate goal, a unified business/IT worldview.

Not that this is either all that is wrong or likely to offer a complete solution. All the same, I doubt that there will be any solution until business and IT alike learn to think of themselves in such terms. This does not mean that IT people need to understand business or vice versa, but it does mean that they need to think of themselves in mutually compatible terms. Which is what, I think, a combination of SOA and BPM will achieve – without either side intending it.