UNIVERSITY OF TORONTO

Toronto, Ontario

September 7 - 8, 2017

New wine in old bottles

Agile software development and ISO 9001

Rick Hill

1. Software development methodologies

2. Is Waterfall baked into ISO 9001?

3. Can Agile fit into a QMS?

4. Waterfall & Agile: different words for the same things

5. Lining up ISO and Agile

6. Agile: higher quality than Waterfall?

7. Auditing software development: pointers

UNIVERSITY OF TORONTO

Toronto, Ontario

September 7 - 8, 2017

AGENDA

Software development methodologies

Agile

TDD

Scrum

XP

DevOps

4

Is Waterfall baked into ISO 9001?

Is Waterfall baked into ISO 9001?

5

NOTE Design and development reviews, verification and

validation have distinct purposes. They can be

conducted separately or in any combination, as is suitable for the

products and services of the organization.

Can Agile fit into a QMS?• The Agile Manifesto values:

– Individuals and interactions over processes and tools

– Working software over comprehensive documentation

– Customer collaboration over contract negotiation

– Responding to change over following a plan• “That is, while there is value in the items on the right, we value the

items on the left more.”

• Agile is not “cowboy coding”!

– It follows a process

– It uses tools

– It is planned

– It is documented

6

A rose by any other name …

Waterfall

• Product manager

• Requirements documents

• Effort in no. days

• Core team meetings

• Project manager

• Conventional schedule

• Exit criteria

• Loadbuild schedule

• Progress reports

• Lessons learned

Agile

• Product / solution owner

• Product backlog with epics & stories

• Effort in no. story points

• Scrum meetings

• Scrum master

• Time-boxed sprints

• Definition of Done

• Continuous integration

• Burn up / burn down charts

• Retrospectives

• ISO 9001:2008 • ISO 9001:2015

8

• Cross-functional, self-organizing team• VoC via product / solution owner

• Review, verification, validation and user documentation planned as stories

• Implementation of continuous integration• Sprint planning

• Tools to capture and manage backlog

Lining up ISO 9001 and Agile practices

• ISO 9001:2008 • ISO 9001:2015

9

• Product backlog – epics and stories• Lessons learned from previous sprint and project

retrospectives

Lining up ISO 9001 and Agile practices

• ISO 9001:2008 • ISO 9001:2015

10

• Definition of Done• Continuous testing

Lining up ISO 9001 and Agile practices

• ISO 9001:2008 • ISO 9001:2015

11

• Definition of Done• Continuous integration and testing

• Scrum meetings• Sprint retrospectives

Lining up ISO 9001 and Agile practices

• ISO 9001:2008 • ISO 9001:2015

12

• VOC• Burn up charts• Scrum meetings

Lining up ISO 9001 and Agile practices

Agile: higher quality than Waterfall?

Waterfall

• Requirements locked in up front changes painful

• Rough & ready estimation of coding effort

• Traceability (if any) often just via Word, Excel etc.

• Code first, then UT, then IT

• Typically weekly team meetings

Agile

• Requirements changes expected via VOC, iterative development

• More accurate estimation of effort via story points

• Traceability typically built into supporting tools

• Continuous integration & test

• Daily scrum meetings with focus on impediments

Auditing software development: pointers

• The key output is the delivered product

• Review covers design documents, test plans (including design’s, verification’s and validation’s) and the code itself

• Verification should include unit, integration, sanity, feature, regression, stress, abnormal conditions, and documentation testing

• Validation may include customer review of GUI mockups, “shake & break” (in-house or customer), alpha and beta testing, FOA (First Office Application), customer lab trials

• Scope of change control includes not only formal design changes but also bug fixes and patches (propagated forwards and backwards as needed)

14

Questions?

UNIVERSITY OF TORONTO

Toronto, Ontario

September 7 - 8, 2017