ISO/IEC 15504

ISO/IEC 15504 contains a reference model. The reference model defines a process dimension and a capability dimension.

The process dimension in the reference model is not the subject of part 2 of ISO/IEC 15504, but part 2 refers to external process lifecycle standards including ISO/IEC 12207 and ISO/IEC 15288.[4] The standard defines means to verify conformity of reference models.[5]

The process dimension defines processes divided into the five process categories of:

• customer-supplier
• engineering
• supporting
• management
• organization

With new parts being published, the process categories will expand, particularly for IT service process categories and enterprise process categories.

For each process, ISO/IEC 15504 defines a capability level on the following scale:[2]

The capability of processes is measured using process attributes. The international standard defines nine process attributes:

• 1.1 Process performance
• 2.1 Performance management
• 2.2 Work product management
• 3.1 Process definition
• 3.2 Process deployment
• 4.1 Process measurement
• 4.2 Process control
• 5.1 Process innovation
• 5.2 Process optimization

Each process attribute consists of one or more generic practices, which are further elaborated into practice indicators to aid assessment performance.

Each process attribute is assessed on a four-point (N-P-L-F) rating scale:

• Not achieved (0–15%)
• Partially achieved (>15–50%)
• Largely achieved (>50–85%)
• Fully achieved (>85–100%).

The rating is based upon evidence collected against the practice indicators, which demonstrate fulfillment of the process attribute.[6]

ISO/IEC 15504 provides a guide for performing an assessment.[7]

This includes:

• the assessment process
• the model for the assessment
• any tools used in the assessment

Performing assessments is the subject of parts 2 and 3 of ISO/IEC 15504.[8] Part 2 is the normative part and part 3 gives a guidance to fulfill the requirements in part 2.

One of the requirements is to use a conformant assessment method for the assessment process. The actual method is not specified in the standard although the standard places requirements on the method, method developers and assessors using the method.[9] The standard provides general guidance to assessors and this must be supplemented by undergoing formal training and detailed guidance during initial assessments.

The assessment process can be generalized as the following steps:

• initiate an assessment (assessment sponsor)
• select assessor and assessment team
• plan the assessment, including processes and organizational unit to be assessed (lead assessor and assessment team)
• pre-assessment briefing
• data collection
• data validation
• process rating
• reporting the assessment result

An assessor can collect data on a process by various means, including interviews with persons performing the process, collecting documents and quality records, and collecting statistical process data. The assessor validates this data to ensure it is accurate and completely covers the assessment scope. The assessor assesses this data (using his expert judgment) against a process's base practices and the capability dimension's generic practices in the process rating step. Process rating requires some exercising of expert judgment on the part of the assessor and this is the reason that there are requirements on assessor qualifications and competency. The process rating is then presented as a preliminary finding to the sponsor (and preferably also to the persons assessed) to ensure that they agree that the assessment is accurate. In a few cases, there may be feedback requiring further assessment before a final process rating is made.[10]

The process assessment model (PAM) is the detailed model used for an actual assessment. This is an elaboration of the process reference model (PRM) provided by the process lifecycle standards.[11]

The process assessment model (PAM) in part 5 is based on the process reference model (PRM) for software: ISO/IEC 12207.[12]

The process assessment model in part 6 is based on the process reference model for systems: ISO/IEC 15288.[13]

The standard allows other models to be used instead, if they meet ISO/IEC 15504's criteria, which include a defined community of interest and meeting the requirements for content (i.e. process purpose, process outcomes and assessment indicators).

There exist several assessment tools. The simplest comprise paper-based tools. In general, they are laid out to incorporate the assessment model indicators, including the base practice indicators and generic practice indicators. Assessors write down the assessment results and notes supporting the assessment judgment.

There are a limited number of computer based tools that present the indicators and allow users to enter the assessment judgment and notes in formatted screens, as well as automate the collated assessment result (i.e. the process attribute ratings) and creating reports.

For a successful assessment, the assessor must have a suitable level of the relevant skills and experience.

These skills include:

• personal qualities such as communication skills.
• relevant education and training and experience.
• specific skills for particular categories, e.g. management skills for the management category.
• ISO/IEC 15504 related training and experience in process capability assessments.

The competency of assessors is the subject of part 3 of ISO/IEC 15504.

In summary, the ISO/IEC 15504 specific training and experience for assessors comprise:

• completion of a 5-day lead assessor training course
• performing at least one assessment successfully under supervision of a competent lead assessor
• performing at least one assessment successfully as a lead assessor under the supervision of a competent lead assessor. The competent lead assessor defines when the assessment is successfully performed. There exist schemes for certifying assessors and guiding lead assessors in making this judgement.[9]

ISO/IEC 15504 can be used in two contexts:

• Process improvement, and
• Capability determination (= evaluation of supplier's process capability).

ISO/IEC 15504 can be used to perform process improvement within a technology organization.[14] Process improvement is always difficult, and initiatives often fail, so it is important to understand the initial baseline level (process capability level), and to assess the situation after an improvement project. ISO 15504 provides a standard for assessing the organization's capacity to deliver at each of these stages.

In particular, the reference framework of ISO/IEC 15504 provides a structure for defining objectives, which facilitates specific programs to achieve these objectives.

Process improvement is the subject of part 4 of ISO/IEC 15504. It specifies requirements for improvement programmes and provides guidance on planning and executing improvements, including a description of an eight step improvement programme. Following this improvement programme is not mandatory and several alternative improvement programmes exist.[10]

An organization considering outsourcing software development needs to have a good understanding of the capability of potential suppliers to deliver.

ISO/IEC 15504 (Part 4) can also be used to inform supplier selection decisions. The ISO/IEC 15504 framework provides a framework for assessing proposed suppliers, as assessed either by the organization itself, or by an independent assessor.[15]

The organization can determine a target capability for suppliers, based on the organization's needs, and then assess suppliers against a set of target process profiles that specify this target capability. Part 4 of the ISO/IEC 15504 specifies the high level requirements and an initiative has been started to create an extended part of the standard covering target process profiles. Target process profiles are particularly important in contexts where the organization (for example, a government department) is required to accept the cheapest qualifying vendor. This also enables suppliers to identify gaps between their current capability and the level required by a potential customer, and to undertake improvement to achieve the contract requirements (i.e. become qualified). Work on extending the value of capability determination includes a method called Practical Process Profiles - which uses risk as the determining factor in setting target process profiles.[10] Combining risk and processes promotes improvement with active risk reduction, hence reducing the likelihood of problems occurring.