1

The application of ISO 9001 to agile software development

Geir Kjetil Hanssen, NTNU/SINTEF

Tor Stålhane, NTNU

2

Agile development - 1

3

Agile development - 2

ISO 9001 is document driven. The Scrum process can generate the following set of documents:

• At the start of the project: Process adaptation• Before each iteration: New and changed

requirements – the product backlog• After each iteration:

– Evaluation of conformity to requirements– Review of process conformity– Problems and their causes

4

ISO 9001 requirements - 1

• The supplier must have a quality assurance management process to ensure an explicit development process and process conformance

• Product quality is the responsibility of the company’s management

• The supplier must have one or more documented development processes. The process must produce documents that can be – Reviewed for acceptance by the customer– Used as proof of conformance

5

ISO 9001 requirements - 2

• All reports of non-conformance both for product and for process shall be reported and must lead to corrective actions

6

What have we done

To identify the problem areas for ISO 9001 vs Agile development, we combined the results from two processes. We went through:

• All available literature

• All items of ISO 90001 and identified possible relevant agile practices

7

The problem areas

Problems pertaining to ISOI 9001 and agile development stems from the fact that:

• Agile development focus on making code – not documents

• ISO 9001 uses documents to establish confidence in– Process conformance– Product quality

8

The challenge - 1

The main challenge in ISO 9001 certifying an agile development process is to balance two opposing goals:

• ISO 9001’s need for documentation of all process steps

• Agile development’s reluctance of excessive document production, taking resources and focus away from code development

9

The challenge - 2

Agile development is flexible – if a project requires that a certain document should be produced this requirement it can be included in the project

BUT

Agile development will stop being agile when it is required to develop a large amount of documents

10

ISO 9001 vs. Agile development

• For 31 sections no change was necessary.

• For 15 sections there was some disagreement between ISO 9001 and agile development.

• For 4 sections there was a total disagreement between ISO 9001 and agile development.

11

What should be done - 1

Agile development needs to document more. In particular, we will need documents from:

• The initial planning activities• Definition of measurable quality objectives, e.g.

ala Evo• All activities for use as proof of conformance• High level and low level design• Reviews of each iteration

12

What should be done - 2

ISO 9001 must be more flexible in that the standard

• Needs to change its interpretation of “document inspection”

• Expand its definition of what is appropriate documentation, e.g. for proof of conformance

13

Example – agile development is OK

ISO 9001 – 4.2.1d: “...include documents needed by the organization to ensure the effective planning , operation and control of its process.”

Agile development always starts by defining how the methodology shall be used in a project

14

Example – more documents

ISO 9001 – 5.4.1: “...The quality objectives shall be measurable and consistent with the quality policy.”

Enhancement of agile development: all agile methods should use a measurement regime comparable to the one used in the agile development method Evo

15

Example – changed definition

ISO 9001 – 7.7.2: “The organization shall review the requirements related to the product. The review shall be conducted prior to the organization’s commitment to supply a product...”

We believe that it is impossible to get a complete overview of all details up front; instead the most important aspects should be documented.

In our opinion, ISO 9001 should be changed accordingly

16

Example – expanded definition

ISO 9001 – 7.3.1a: “...the organization shall determine the design and development changes.”

The challenge to agile development is proof of conformance – have we really done this?

Documents that should be accepted as evidence of conformance are e.g. pictures of the whiteboard showing requirements planned or work completed

17

Conclusions

Agile development will be more and more important in a world that is changing faster and faster

ISO 9001 certification will be more and more important to build confidence as more and more customers will lack IT competence

It is unwise of one of these two ideas to ignore the other