agile chm j-marselje v5.2
TRANSCRIPT
Agile Change Management
Johan Marselje
Global ITSM Process Expert for Change Management
Amsterdam – 2 July 2015
www.ing.com
ITSM at ING Take your #talent to the next level
Do not put content
on the brand
signature area
Do not put content
on the brand
signature area
Orange
RGB= 255,102,000 Light blue
RGB= 180,195,225
Dark blue
RGB= 000,000,102
Grey
RGB= 150,150,150
ING colour balance
Guideline
www.ing-presentations.intranet Topics
• Intro
• History and forming of ING best practices
• Understanding the Risk & Compliancy demands
• Combining both worlds into a single flow
• Wrap up
1
Do not put content
on the brand
signature area
Do not put content
on the brand
signature area
Orange
RGB= 255,102,000 Light blue
RGB= 180,195,225
Dark blue
RGB= 000,000,102
Grey
RGB= 150,150,150
ING colour balance
Guideline
www.ing-presentations.intranet Introduction Johan Marselje
Global ITSM Process Expert for Change Management
• Medical/Scientific photographer, software specialist printing industry, IT trainer, ITSM specialist
• 2009 joined ING Central Process Authority as ITIL process & metrics expert, developer & trainer, HPSC & HPSM specialist and ServiceNow engineer
• 2014 joined ING GS as ITSM expert for Change Management
As ITSM Expert primarily responsible for ING world-wide process development, optimization and support
Four kids, two cats, four guitars and a double (contra) bass
2
Do not put content
on the brand
signature area
Do not put content
on the brand
signature area
Orange
RGB= 255,102,000 Light blue
RGB= 180,195,225
Dark blue
RGB= 000,000,102
Grey
RGB= 150,150,150
ING colour balance
Guideline
www.ing-presentations.intranet Three flows to get to one Agile Change flow
Understanding
Risk & Compliancy
demands
Combining
both worlds
into a single flow
History,
The forming of
ING best practices
3
Do not put content
on the brand
signature area
Do not put content
on the brand
signature area
Orange
RGB= 255,102,000 Light blue
RGB= 180,195,225
Dark blue
RGB= 000,000,102
Grey
RGB= 150,150,150
ING colour balance
Guideline
www.ing-presentations.intranet The need for an Agile Change Process…
While ING moves towards an Agile organization…
We (ITIL experts) struggle to come up with a proper solution
• Can we simplify the Change Process and Governance ?
• What’s the minimum Change registration, while remaining compliant ?
• Can Agile/Scrum cooperate with ITIL Change activities / deliverables ?
4
History, the forming
of ING best practices
Can we simplify the Change Process and Governance ?
ITSM at ING Take your #talent to the next level
Do not put content
on the brand
signature area
Do not put content
on the brand
signature area
Orange
RGB= 255,102,000 Light blue
RGB= 180,195,225
Dark blue
RGB= 000,000,102
Grey
RGB= 150,150,150
ING colour balance
Guideline
www.ing-presentations.intranet Change Process domain (Silo) oriented
Before 2009 every single ING domain used its own tool for registration of ITIL
process related information.
• No alignment between different domains, parties and/or processes
• No single process “language” or understanding
• No overall governance
• Etc…
6
Do not put content
on the brand
signature area
Do not put content
on the brand
signature area
Orange
RGB= 255,102,000 Light blue
RGB= 180,195,225
Dark blue
RGB= 000,000,102
Grey
RGB= 150,150,150
ING colour balance
Guideline
www.ing-presentations.intranet Change Process Belgium & Netherlands
2009 – A single ITSM tool was introduced at ING NL & BE, for ITIL process related
activity registration
On top of the ITSM tool a dedicated vendor Best Practice fixed layer
Delivered us:
• One governance model
• One process model and set of Standards, Rules & Guidelines (SRGs)
• One Change Calendar & Process Reporting environment
It also delivered us…
7
Do not put content
on the brand
signature area
Do not put content
on the brand
signature area
Orange
RGB= 255,102,000 Light blue
RGB= 180,195,225
Dark blue
RGB= 000,000,102
Grey
RGB= 150,150,150
ING colour balance
Guideline
www.ing-presentations.intranet …a very time consuming way of working
The full Best Practice Change Process however, has a lot of decision moments: from Change
Acceptance via the Project CAB, Technical CAB to the final decision of the Deployment CAB
8
Do not put content
on the brand
signature area
Do not put content
on the brand
signature area
Orange
RGB= 255,102,000 Light blue
RGB= 180,195,225
Dark blue
RGB= 000,000,102
Grey
RGB= 150,150,150
ING colour balance
Guideline
www.ing-presentations.intranet More rules, more complexity, more control?
The original development process was managed by the CMMi control framework on
top of Prince2 In order to create more control, ING combined CMMi with ITIL
9
TCAB*
Build & Test
DCAB*
PCAB*
Initiation Start up Execution Project closure
Requirements
Scope High level design
Timelines Design
Build Test
Implement
Scope Risk & Impact
Plan
Release to Production
Closure
CM
Mi IT
IL
RfC
SO/SA PID
Acceptance
Criteria &
Tollgate 1
Acceptance
Criteria &
Tollgate 2
Acceptance
Criteria &
Tollgate 3
Project Board
Business Domain ITSM Control Board
UAT
To
llgate
3
Project Board Project Board
To
llgate
2
To
llgate
1
Do not put content
on the brand
signature area
Do not put content
on the brand
signature area
Orange
RGB= 255,102,000 Light blue
RGB= 180,195,225
Dark blue
RGB= 000,000,102
Grey
RGB= 150,150,150
ING colour balance
Guideline
www.ing-presentations.intranet Complex…?
The complexity of the Best Practice Change Process model in ITSM tool, combined with a highly complex IT infrastructure…
…results in typical effects:
• Deployment risk assessment challenges (complexity…)
• Perception of a certain level of bureaucracy. Long time lines to realize changes due to the many and different CAB groups
• Potential risk of insufficient registration of the change
10
Understanding the
Risk & Compliancy demands
What’s the minimum Change registration, while remaining compliant?
ITSM at ING Take your #talent to the next level
Do not put content
on the brand
signature area
Do not put content
on the brand
signature area
Orange
RGB= 255,102,000 Light blue
RGB= 180,195,225
Dark blue
RGB= 000,000,102
Grey
RGB= 150,150,150
ING colour balance
Guideline
www.ing-presentations.intranet Then ING decided to move to Agility…
…a number of challenges arose:
• “We don’t need the ITIL processes any more…”
• “We can use any tool that fits our needs…”
• “We don’t need to plan or document what we do…”
12
How do we meet compliancy demands ?
Do not put content
on the brand
signature area
Do not put content
on the brand
signature area
Orange
RGB= 255,102,000 Light blue
RGB= 180,195,225
Dark blue
RGB= 000,000,102
Grey
RGB= 150,150,150
ING colour balance
Guideline
www.ing-presentations.intranet While trying to LEAN the Change Process…
After 3 really interesting POC experiments we came up with a very LEAN Change Process flow, to enable
“Implementation Control”
To realize such a process flow, a number of assumptions, technical measure and specific solutions are necessary
13
But somehow this was leaving me worried…
Do not put content
on the brand
signature area
Do not put content
on the brand
signature area
Orange
RGB= 255,102,000 Light blue
RGB= 180,195,225
Dark blue
RGB= 000,000,102
Grey
RGB= 150,150,150
ING colour balance
Guideline
www.ing-presentations.intranet …how to prove compliancy?
Moving towards “Implementation Control”, it became unclear how we would be able to manage the compliancy
How, from process perspective, do we have to deal with the existing controls and required evidence for our regulators?
Can we challenge the validity of a number of existing compliancy requirements for the “new” process?
Or can we solve this via another way?
14
Do not put content
on the brand
signature area
Do not put content
on the brand
signature area
Orange
RGB= 255,102,000 Light blue
RGB= 180,195,225
Dark blue
RGB= 000,000,102
Grey
RGB= 150,150,150
ING colour balance
Guideline
www.ing-presentations.intranet Compliance model used by regulators
AFM, DNB, ECB all use the same reference model: COBIT*
The use of controls is enforced to all financial institutions to prove compliancy
15
* Control Objectives for Information and related Technology (COBIT) by ISACA.
Do not put content
on the brand
signature area
Do not put content
on the brand
signature area
Orange
RGB= 255,102,000 Light blue
RGB= 180,195,225
Dark blue
RGB= 000,000,102
Grey
RGB= 150,150,150
ING colour balance
Guideline
www.ing-presentations.intranet COBIT has recognized change risks
A lot of actions need to be realised when making a change in functionality in production…
…which fitted perfectly into the original Best Practice Change flow…
16
Do not put content
on the brand
signature area
Do not put content
on the brand
signature area
Orange
RGB= 255,102,000 Light blue
RGB= 180,195,225
Dark blue
RGB= 000,000,102
Grey
RGB= 150,150,150
ING colour balance
Guideline
www.ing-presentations.intranet ING has defined Change risk controls
The COBIT risks and SOx requirements are “translated” into and Key controls to enable us, while changing, to prove that we are in control…
…But where and how do these controls fit in?
Do we need to change our way of Agile/Scrum working?
17
OCD Ctrl41 FC02 - Registration of assets in Central Repository
1. Common info
2. CI Type details / attributes
3. Relations (e.g. Stack, Value Chain/Business Process
4. Adherence to the process and Data Quality
5. The Asset Owner defined and accepted the role
6. The custodian has accepted the role AndAsset Owner or Custodian approved the content as shown
OCD Ctrl CM01.2 Non Functional requirements
OCD Ctrl CM01.3 Change
Implementation
OCD Ctrl FC02.1 CMDB Check
OCD Ctrl CM01.1 Change Validation
Do not put content
on the brand
signature area
Do not put content
on the brand
signature area
Orange
RGB= 255,102,000 Light blue
RGB= 180,195,225
Dark blue
RGB= 000,000,102
Grey
RGB= 150,150,150
ING colour balance
Guideline
www.ing-presentations.intranet At ING we traded CMMi/Prince2 for Agile/Scrum
Of course, in a Agile/Scrum environment we are still
obliged to the COBIT compliancy rules
And…, can we prove that we actually are in control…?
And can we do that without losing Agility?
18
Agile Change Management Combining both worlds into a single flow
Can Agile/Scrum cooperate with ITIL Change activities / deliverables ?
ITSM at ING Take your #talent to the next level
Do not put content
on the brand
signature area
Do not put content
on the brand
signature area
Orange
RGB= 255,102,000 Light blue
RGB= 180,195,225
Dark blue
RGB= 000,000,102
Grey
RGB= 150,150,150
ING colour balance
Guideline
www.ing-presentations.intranet The original ITIL v3 Change Management Process…
20
ITIL Change Management Process
COBIT has adopted ITIL as formal
and standardized ITSM Process
Framework, and therefore we have
to comply to ITIL for Change
Management
The ITIL Change Management
Process defines typical steps
including typical activities in the
Change flow that remain the same
for all changes…
…how can we combine ITIL
with Agile/Scrum ?
Do not put content
on the brand
signature area
Do not put content
on the brand
signature area
Orange
RGB= 255,102,000 Light blue
RGB= 180,195,225
Dark blue
RGB= 000,000,102
Grey
RGB= 150,150,150
ING colour balance
Guideline
www.ing-presentations.intranet Yes… ITIL can be combined with Agile/Scrum
21
Scrum Product backlog management
Do not put content
on the brand
signature area
Do not put content
on the brand
signature area
Orange
RGB= 255,102,000 Light blue
RGB= 180,195,225
Dark blue
RGB= 000,000,102
Grey
RGB= 150,150,150
ING colour balance
Guideline
www.ing-presentations.intranet A change flow to Build & Test a user story
22
Scrum Sprint backlog management
Do not put content
on the brand
signature area
Do not put content
on the brand
signature area
Orange
RGB= 255,102,000 Light blue
RGB= 180,195,225
Dark blue
RGB= 000,000,102
Grey
RGB= 150,150,150
ING colour balance
Guideline
www.ing-presentations.intranet Can we prove we are fully compliant?
23
Yes, we can be compliant to COBIT and thus to regulatory demands
Do not put content
on the brand
signature area
Do not put content
on the brand
signature area
Orange
RGB= 255,102,000 Light blue
RGB= 180,195,225
Dark blue
RGB= 000,000,102
Grey
RGB= 150,150,150
ING colour balance
Guideline
www.ing-presentations.intranet Managing the COBIT controls
The existing COBIT controls can be plotted to the Agile/Scrum “Change Process”
Scrum activities and materials become a natural part of the total Change flow, enabling us to prove we actually are in control
24
However, while merging the ITIL Change Process flow with the Agile/Scrum activities, we uncovered a potential compliancy weak spot…
Do not put content
on the brand
signature area
Do not put content
on the brand
signature area
Orange
RGB= 255,102,000 Light blue
RGB= 180,195,225
Dark blue
RGB= 000,000,102
Grey
RGB= 150,150,150
ING colour balance
Guideline
www.ing-presentations.intranet …we introduced the deployment procedure
The ITIL Change deployment procedure fits perfectly to our needs:
A compact & LEAN Change flow, serving all necessary compliancy steps
Adding the Change deployment procedure to the Agile/Scrum method, completes regulatory required control evidence
25
Do not put content
on the brand
signature area
Do not put content
on the brand
signature area
Orange
RGB= 255,102,000 Light blue
RGB= 180,195,225
Dark blue
RGB= 000,000,102
Grey
RGB= 150,150,150
ING colour balance
Guideline
www.ing-presentations.intranet Finally Agile/Scrum & Change deployment combined
Typical ITIL activities can be mapped to original Agile/Scrum activities and roles…
Allowing the teams to use their own Scrum tools for working through their backlog…
while using the ITSM tool for deployment of changes to the production environment
Enabling us to prove compliancy
26
Wrap up
ITSM at ING Take your #talent to the next level
Do not put content
on the brand
signature area
Do not put content
on the brand
signature area
Orange
RGB= 255,102,000 Light blue
RGB= 180,195,225
Dark blue
RGB= 000,000,102
Grey
RGB= 150,150,150
ING colour balance
Guideline
www.ing-presentations.intranet Complex…?
Perception of a certain level of bureaucracy (complexity…)
Long time lines to realize changes due to the many/different CAB groups
Potential risk of insufficient registration of the change
28
Do not put content
on the brand
signature area
Do not put content
on the brand
signature area
Orange
RGB= 255,102,000 Light blue
RGB= 180,195,225
Dark blue
RGB= 000,000,102
Grey
RGB= 150,150,150
ING colour balance
Guideline
www.ing-presentations.intranet Wrap up
29
As ING moves towards an Agile organization… we (ITIL experts) came up with an ING solution !
We were able to simplify the Change Process and Governance
We defined the minimum Change registration, while remaining compliant
Agile/Scrum and ITIL Change Management can be fully integrated
Questions?
ITSM at ING Take your #talent to the next level
Thank you!
ITSM at ING Take your #talent to the next level