The application of ISO 9001 to agile software development

1
The application of ISO 9001 to agile software
development

• Geir Kjetil Hanssen, NTNU/SINTEF
• Tor Stålhane, NTNU

2
Agile development - 1
3
Agile development - 2

• ISO 9001 is document driven. The Scrum process
  can generate the following set of documents
• At the start of the project Process adaptation
• Before each iteration New and changed
  requirements the product backlog
• After each iteration
• Evaluation of conformity to requirements
• Review of process conformity
• Problems and their causes

4
ISO 9001 requirements - 1

• The supplier must have a quality assurance
  management process to ensure an explicit
  development process and process conformance
• Product quality is the responsibility of the
  companys management
• The supplier must have one or more documented
  development processes. The process must produce
  documents that can be
• Reviewed for acceptance by the customer
• Used as proof of conformance

5
ISO 9001 requirements - 2

• All reports of non-conformance both for product
  and for process shall be reported and must lead
  to corrective actions

6
What have we done

• To identify the problem areas for ISO 9001 vs
  Agile development, we combined the results from
  two processes. We went through
• All available literature
• All items of ISO 90001 and identified possible
  relevant agile practices

7
The problem areas

• Problems pertaining to ISOI 9001 and agile
  development stems from the fact that
• Agile development focus on making code not
  documents
• ISO 9001 uses documents to establish confidence
  in
• Process conformance
• Product quality

8
The challenge - 1

• The main challenge in ISO 9001 certifying an
  agile development process is to balance two
  opposing goals
• ISO 9001s need for documentation of all process
  steps
• Agile developments reluctance of excessive
  document production, taking resources and focus
  away from code development

9
The challenge - 2

• Agile development is flexible if a project
  requires that a certain document should be
  produced this requirement it can be included in
  the project
• BUT
• Agile development will stop being agile when it
  is required to develop a large amount of documents

10
ISO 9001 vs. Agile development

• For 31 sections no change was necessary.
• For 15 sections there was some disagreement
  between ISO 9001 and agile development.
• For 4 sections there was a total disagreement
  between ISO 9001 and agile development.

11
What should be done - 1

• Agile development needs to document more. In
  particular, we will need documents from
• The initial planning activities
• Definition of measurable quality objectives, e.g.
  ala Evo
• All activities for use as proof of conformance
• High level and low level design
• Reviews of each iteration

12
What should be done - 2

• ISO 9001 must be more flexible in that the
  standard
• Needs to change its interpretation of document
  inspection
• Expand its definition of what is appropriate
  documentation, e.g. for proof of conformance

13
Example agile development is OK

• ISO 9001 4.2.1d ...include documents needed
  by the organization to ensure the effective
  planning , operation and control of its process.
• Agile development always starts by defining how
  the methodology shall be used in a project

14
Example more documents

• ISO 9001 5.4.1 ...The quality objectives
  shall be measurable and consistent with the
  quality policy.
• Enhancement of agile development all agile
  methods should use a measurement regime
  comparable to the one used in the agile
  development method Evo

15
Example changed definition

• ISO 9001 7.7.2 The organization shall review
  the requirements related to the product. The
  review shall be conducted prior to the
  organizations commitment to supply a
  product...
• We believe that it is impossible to get a
  complete overview of all details up front
  instead the most important aspects should be
  documented.
• In our opinion, ISO 9001 should be changed
  accordingly

16
Example expanded definition

• ISO 9001 7.3.1a ...the organization shall
  determine the design and development changes.
• The challenge to agile development is proof of
  conformance have we really done this?
• Documents that should be accepted as evidence of
  conformance are e.g. pictures of the whiteboard
  showing requirements planned or work completed

17
Conclusions

• Agile development will be more and more important
  in a world that is changing faster and faster
• ISO 9001 certification will be more and more
  important to build confidence as more and more
  customers will lack IT competence
• It is unwise of one of these two ideas to ignore
  the other