As organizations grow, the IT processes that support them need to mature. I like to use the Capability Maturity Model Integration (CMMI) scale when thinking about IT processes. The CMMI scale was invented by Carnegie Mellon University in 1987 and has five levels of maturity:
- Level 1 – Ad hoc – Processes are done uniquely on every execution. Need a printer? Call your friend in IT and ask if they can get you one. Need access to a database? Call the same person. Each fulfillment of those requests is done uniquely by the person you reached out to. Processes at this level are not documented and cannot be reported against.
- Level 2 – Repeatable – This level of maturity is often enforced by projects that need to be implemented and a process is invented for that specific project. Need to roll out a massive productivity suite upgrade to the entire organization? You might want to have some process so that you can ensure it’s done at least somewhat efficiently.
- Level 3 – Defined – There is a defined process that works. It may not be the best process (and some people may not follow it for this very reason) but you know how the process is supposed to be done.
- Level 4 – Managed – The process has defined metrics that can be reported against. Here is the sweet spot where you can determine where the process’ inefficiencies are and work proactively to make improvements.
- Level 5 – Optimized – Processes are streamlined and touch points between multiple process are identified and integrated. This is the magical point where repeating incidents spawn problems that initiate changes to push out releases and it’s all tracked in a service-based CMDB. This is ITILtopia.
The strange thing is that Level 1 maturity is fine for small organizations that don’t have compliance regulation requirements. In fact, putting in lots of process overhead for organizations of less than 100 employees is truthfully a waste of time and money. The problem arises when companies experience a lot of growth. What worked when the company was less than 100 employees won’t scale when the company starts pushing the > 1000 threshold.
The DBA might not mind a request every once in a while to grant access to a reporting server, but if they start getting requests every day (or multiple times a day) for that same task, they will start complaining that they are being “randomized” and that they can’t do their job. What’s worse is that the company is paying some pretty big bucks to this professional to do very technical work. Paying them to do what is essentially account management is not the best use of the company’s resources.
When this stage happens is when companies realize that they need to up their process management game. Or, it happens when they come under a compliance regulation and get audited. If a company is truly at a Level 1 maturity and needs to get to Level 3 to meet ISO 27000 process documentation requirements, a lot of heavy lifting will be involved.
One of the best ways I’ve found get a quick handle on how process are being executed is to assemble a large group of people who are engaged in a process in a conference room (assuming the country isn’t in a global pandemic) with a large whiteboard, and diagram the process using a stack of sticky notes and dry erase pens. For this exercise, don’t worry about swim lanes or fancy BPMN notation. Just capture the process initiators (how do requests come in) and the current steps that will eventually get to the process end-points. Talk to the group and capture every step in the process. For every step, create a sticky note that defines who executes the step and what is done in that step and draw a line to the next step/decision. If you have a decision point that has multiple possible outcomes, use multiple square sticky notes turned 45 degrees (diamond shaped) to indicate the different outcomes.
The reason to assemble in a large conference room with a big white board is because, until you have captured as much detail as possible, you will need to be ready to erase the connecting lines and rearrange the sticky notes on the fly. A lot. I mean, really, a lot.
I’ve used this method quite a few times and even showed the method to my wife who has also used it a few times. It is fast, efficient, and surprisingly fun. It might even expose some processes that were previously unknown to others in the room. When performing this exercise, don’t point fingers or try to expose inefficiencies, just capture what’s currently being done. Everything that’s being done.
Take a picture of the whiteboard and then clean it up in your favorite flowchart app. This captures the existing process and will get you to a (minimal) Level 3 maturity. The next big project will consist of optimizing, more fully documenting, and determining why some individuals aren’t following it.