Internal Audit Indonesia's

Juli 14, 2010

Capability Maturity Model (CMM)

Filed under: Artikel seputar Internal Audit — internalauditindonesia @ 12:00 am

The Capability Maturity Model (CMM) is a framework that describes an improvement path from an ad-hoc, immature process to a mature, disciplined process focused on continuous improvement. The CMM defines the state of a process using a common language that is based on the Carnegie Mellon Software Engineering Institute Capability Maturity Model. The CMM consists of a continuum of five process maturity levels, enabling process owners to rate the state, or maturity, of a given process as Initial, Repeatable, Defined, Managed or Optimizing. It applies to any process within an organization and, when applied effectively, improves the ability of organizations to meet goals for cost, schedule, functionality and quality and is a useful tool when communicating with stakeholders. This model establishes a yardstick against which to determine and pursue improved performance.

When applying the CMM, the process must meet all criteria to rate at a given level within the model. You are either at a stage of maturity within the CMM or you are not. There are no plus’ or minus’ when applying the CMM. Management must apply the criteria based upon the facts provided by the current state analysis to rate the maturity of the process. Reasonable interpretation will be needed at times, requiring the process owner and the evaluator to use professional judgment.

The CMM is not intended to be prescriptive. It does not tell an organization “how” to improve. However, its application can provide insights on change management strategy. Management can also evaluate where on the CMM the company needs to be with respect to each process. Cost and time reductions will often be prime considerations in this assessment.

When determining what improvements are needed to reach the next level of maturity, evaluators should consider the importance of the process being addressed. As the importance of a process increases, its desired capability increases. This does not mean that all processes must eventually operate at the Managed or Optimized state. No business has the resources to accomplish that goal. Also, evaluators should consider if the process is simple, has low volumes, involves exercise of professional judgment or has significant conformance requirements.

The five stages of maturity depicted in the CMM are further described below. Evaluators should customize these criteria to fit the facts, circumstances and culture within the organization.

I. Initial Stage

The process is ad-hoc and occasionally even chaotic, where control is not a priority. A process at this level is not clearly defined and success depends on individual effort. While processes at the Initial Stage frequently produce outputs that work, those outputs may be over budget or the process often misses scheduled deadlines. The process is like a “black box” because there is very little transparency into it; therefore, the only way to monitor performance is through rough output measures.

A. Representative Characteristics

  • Environment is not stable, lacks sound management practices and is undermined by ineffective planning and reaction-driven activities.
  • During a crisis, planned procedures may even be abandoned and success is dependent on having an exceptional manager and an effective team.
  • When process personnel leave, their stabilizing influence leaves with them.
  • The process is often unpredictable because it is constantly changed or modified, even as work progresses.
  • Performance is dependent on the capabilities of individuals and varies with their innate skills, knowledge and motivations.
  • Performance can be predicted only by an individual rather than organizational capability.

B. Process Maturity Evaluation Criteria

  • None. The process is ad-hoc with no defined, repeatable structure.

C. Maturity Focus for Next Level – Repeatable Stage

  • Develop a disciplined process.

II. Repeatable Stage

The Repeatable Stage marks the shift from technical knowledge and skills to organizational and managerial issues. This is what process maturity is about. In this stage, customer requirements are understood and basic policies and activities are in place to repeat key functions across segments of the enterprise. Documented processes provide the foundation for consistent processes that can be institutionalized across the enterprise with training and verification. Policies are established for managing the process and procedures are established for implementing those policies. Output measures are tracked and monitored, creating an environment that is stable and disciplined. Reliance on people continues where controls documentation still requires improvement. The focus at this stage is on improving processes before tackling organizational issues, which are addressed in the Defined Stage.

A. Representative Characteristics

  • Process managers:
    • Set realistic objectives, policies and plans for the process.
    • Enforce policies and train and direct people to practice and document the procedures.
    • Track cost, time, and performance primarily with output measures.
    • Identify problems when they arise.
  • People work more effectively by:
    • Incorporating “lessons learned” from the best staff into documented processes.
    • Building the skills to perform those processes.
    • Continually improving by learning from people performing the job.
    • Sharing successful practices that lead to more repetition across the organization.

B. Process Maturity Evaluation Criteria

  • Basic policies – A basic policy structure is established to articulate (1) process purpose and objectives and (2) roles, responsibilities and accountabilities for executing and monitoring the process.
  • Quality assurance – Activities are established to “inspect” quality to ensure that quality objectives are met as the process is improved.
  • Basic controls and management oversight – Basic internal controls are in place along with appropriate oversight activities by management.
  • Basic tracking of cost, time and quality outputs – Basic cost, quality and time output measures are in place.
  • Activity planning – Specific process activities to achieve the stated objectives and requirements are designed and documented.
  • Understanding of customer requirements – The objectives and requirements of the process are clearly understood.

C. Maturity Focus for Next Level – Defined Stage

  • Develop a standard and consistent process.

III. Defined Stage

At the Defined Stage, the process is well documented and the Six Components of Infrastructure are integrated into a standard process for the enterprise. This process includes: inputs; standards and procedures for performing the work; verification mechanisms (such as internal audit or peer reviews); and outputs and completion criteria. Policies, process, and standards are defined and institutionalized, creating a “chain of certification.” A major challenge many organizations face is designing a process that empowers the individuals doing the work without being overly rigid. Also, managers proactively anticipate risks that may arise and prepare for them.

A. Representative Characteristics

  • “Documentation and standardization” means:
    • The tasks of the process are documented well enough to be understood by process participants.
    • There is a common enterprise-wide understanding of the activities, roles and responsibilities in the process.
    • Organization-wide training is designed to ensure that staff and managers have the requisite knowledge and skills to execute the process.
  • “Integration” means:
    • Policies, process activities, skill sets, reports, methodologies and technology are integrated into a coherent whole.
    • The outputs of one task flow smoothly into the inputs of the next task.
    • When mismatches between tasks occur, they are identified and addressed timely rather than “overcome” when encountered while executing the process.

B. Process Maturity Evaluation Criteria

  • Verification mechanisms – To ensure the process is performing as intended, internal audit or independent peer group teams conduct period audits.
  • Cross-functional coordination – If the process cuts across functional boundaries, a cross-functional team is created to execute and monitor the process.
  • Integration technology and data – The process design integrates systems and data as enablers to the other elements of infrastructure.
  • Integration of competencies, reports and methods – The process design integrates key elements of infrastructure, i.e., people and organization, management reports and methodologies.
  • Process training – Formal training supports and reinforces the policies and activities defining the process.
  • Organization process definition – The process is clearly defined so that everyone who has a role in building, executing and monitoring the process can understand its purpose and design.
  • Organization process focus – The entity is committed to establishing in word and deed a “process discipline,” enterprise-wide, with respect to the specific process.

C. Maturity Focus for Next Level

  • Create a predictable process.

IV. Managed Stage

The Managed Stage is characterized by “metrics, measures, and monitoring” where risk is managed quantitatively enterprise-wide creating a “chain of accountability.” The process is both stable and measured but an exceptional circumstance may occur. Both the process and its outputs are quantitatively understood and controlled. Detailed metrics of process cost, quality and time are collected, including process measures and output measures. The objective is process control, meaning the organization should control waste and sporadic spikes. Waste arises whenever there is reworking of process tasks or outputs. When waste arises from the way a process is designed, it is “chronic.” Inevitably there is chronic waste in any process, which requires reworking to prevent things from getting worse. Sporadic spikes arise from special causes of variation that require “fire fighting” activities.

A. Representative Characteristics

  • Productivity and quality are measured for important activities:
    • Measurement is quantitative, meaning that variability in process performance is narrowed to fall within acceptable bounds.
    • Quantitative goals are set for both outputs (output measures) and activities (process measures).
    • For established processes, meaningful variations in process performance can be distinguished from random variation (noise).
    • An enterprise-wide database is used to collect and analyze process performance data.
  • Management’s ability to predict outcomes grows steadily more precise as the variability in the process grows smaller.
  • The process operates within measurable limits, meaning:
    • Process Owner can predict trends in process and output quality within the bounds of these limits.
    • When limits are exceeded, corrective actions are taken.
    • Process outputs are predictably of high quality.
  • Risks involved in new process procedures, applications and innovations are identified and carefully managed.

B. Process Maturity Evaluation Criteria

  • Process quality management – Formal quality management techniques are applied to eliminate non-essentials and simplify and focus process activities and tasks, with the objective of making the process “best-in-class” with respect to lowering costs, compressing time, increasing quality and reducing risk to an acceptable level.
  • Quantitative process management – Appropriate process measures are put in place to augment the output measures and facilitate management of the process.

C. Maturity Focus for Next Level

  • Work on continuously improving the process.

V. Optimizing Stage

As process activities are executed, the process is continuously improved by quantitative feedback and from implementing innovative approaches. At the Optimizing Stage, there is a strong focus on continuous process improvement for controls enterprise-wide:

  • Identifies and corrects weaknesses timely to strengthen the process.
  • Seeks to prevent the re-occurrence of defects by analyzing them to determine their root causes and identifies effective ways to fix them.
  • Analyzes the process to prevent known types of defects from occurring.
  • Uses data on process performance to analyze costs and benefits of new process procedures, applications and innovations.
  • Identifies and deploys innovations throughout the organization that exploit best practices.
  • Shares “lessons learned” routinely.

A. Representative Characteristics

The organization strives to continuously improve the range of its process capability. Often continuous improvement is a mindset for the entire entity. Improvements occur both by incremental advancements in the existing process and by innovations using new ideas, technologies, and methods. Common causes of variation are addressed to reduce chronic waste and sporadic spikes.

Disciplined change is a way of life, as inefficiencies and defect-prone activities are identified, eliminated, simplified, focused, and automated. At this stage, improvements are continually attempted in a controlled manner to improve productivity and quality. Process owners are able to estimate and then track quantitatively the impact and effectiveness of change.

B. Process Maturity Evaluation Criteria

  • Process change management – Process owners are continuously looking for ways to improve process performance either incrementally or through innovative breakthroughs; formal change management techniques are applied to implement changes.
  • Technology change management – As process requirements and activities change over time, there is tight control over changes in systems and data to ensure that all changes are authorized and consistent with the process owner’s tactics for process optimization.
  • Defect prevention – Process owners continuously focus on “building in” rather than “inspecting” quality through elimination, simplification and focus techniques.

C. Maturity Focus for Next Level

None. Maintenance is the key at this stage to drive continuous improvement.

Tinggalkan sebuah Komentar »

Belum ada komentar.

RSS feed for comments on this post. TrackBack URI

Tinggalkan Balasan

Isikan data di bawah atau klik salah satu ikon untuk log in:

Logo WordPress.com

You are commenting using your WordPress.com account. Logout / Ubah )

Gambar Twitter

You are commenting using your Twitter account. Logout / Ubah )

Foto Facebook

You are commenting using your Facebook account. Logout / Ubah )

Foto Google+

You are commenting using your Google+ account. Logout / Ubah )

Connecting to %s

Blog di WordPress.com.

%d blogger menyukai ini: