We're a small company. Do we need metrics for GP2.8 (Monitor and Control the Process) for every Process Area?

Dear Appraiser,

I have a doubt about what artifacts might constitute good evidence for GP2.8. The model calls for measurements. But it is often the case for small organizations not to have the need or manpower to create, collect and maintain these measurements. Also, in small organizations (around 30 people, as is the case with this one), the performance of processes can be analyzed through direct observation of those responsible for the process. A measure on each PA sounds a little bit like overkill.

I know PMC relates to GP2.8. Does it mean that regular status meeting to discuss the status of the process will suffice for the practice?


Your question often comes up with small organizations seeking to adopt CMMI. As it happens, small is my speciality.

While GP2.8 tells us to “Monitor and Control the Process” it doesn’t give us any requirements beyond that. While the informative material discusses metrics as an example, you’re correct in that it is permissible to adopt alternative methods. Remember, Goals are Required, Practices are Expected, and everything else is just information.

Two questions to consider:

1. Is there a plan to manage and maintain the process itself, as well as perform it on a project?

2. How much information does your organization need to ensure that plan is on track?

If you have a plan, then monitoring it means reviewing the milestones, deliverables, work products, and schedule to be sure the plan is on track. Must you have metrics for that? For a small organization I would argue that it may be overkill when you can just have a simple once-a-month status meeting to cover it. Are there outputs from that meeting? Minutes, defects, corrective actions, assignments? If so, you could point to those items as evidence that GP2.8 is being performed.

If you conduct PPQA audits on your projects what are you gathering? If you’re gathering data about process performance are the people responsbile for the process looking at it? If so, you could point to this data for GP2.8 also.

Do you conduct Configuration Audits (hint . . . you could combine this with PPQA and save a step)? If so, you have outputs from that for all processes don’t you? The work products for every process are part of executing that process. Isn’t that performing GP2.8 also?

Do you have an SEPG or process steering group? Do they meet to review the status of the process and how well it is performing? If so, you could point to this as some evidence that GP2.8 is being performed also.

A document or metric is often the way organization’s react to GP2.8, but it’s only the most obvious answer. You can get a lot more creative and combine processes to get a “two’fer” so you don’t have to add another document or metric. Give the questions some thought and you'll have your answer.

http://www.broadswordsolutions.com/