An Internal Audit team is a Quasi-Judicial body, Yes they may not necessarily be able to prosecute the Non-compliant, But they are the eyes / ears of the governance team or the Executive leadership. With the right structure and authority the audit team can play a significant role in enabling desired outcomes for the organizations.

Typically, Judiciary has the responsibility of upholding the constitution and laws of the Country, Interpreting them, and resolving conflicts. Their services are usually requested in advisory capacity to define new policies, review of program execution effectiveness or Investigate suspected frauds.

On similar lines in an Organization the Internal Audit team,plays a Quasi-Judicial role

They are accountable for …

a) Upholding the Quality Management Systems & defined processes

b) Evaluate plans & execution activities.

c) Identify & highlight gaps in processes & execution and provide inputs to address them

d) Identify in-efficiencies in processes and contribute to Lean them

e) Facilitate and oversee process improvements.

d) Highlight Risks and advice on disposition

Thus an Internal Audit Team, play a significant role in enabling Operational excellence  and desired outcomes for the organizations.

From:  Quality Audits for Improved performance – by Dennis R. Arter

With the advent of Agile & LEAN Thinking, i have earlier lamented about the Value CMMI added to organizations. It was my opinion that unless there is complete overhaul they would soon be history See CMMI has outlived its purpose

Thankfully, I was wrong, With CMMI 2.0 The Model itself has undergone significant improvements. Its own Capability & Maturity has substantially leapfrogged.

The Practice Areas (earlier process areas) are now grouped under Capability Areas, which fall under four broad categories of Doing, Managing, Enabling and Improving

Also CMMI 2.0 integrates the Development / Services / Acquisition into a common Model, (+ Relevant PCMM aspects) with option to select relevant Practice Areas based on Organization Context

There is an additional focus now on Org. maturity through the Introduction of Capability Areas, “Managing Business Resilience” and “Sustaining Habit and Persistence” which encompasses practice areas such as Governance, Implementation Infrastructure and “Risk and Opportunity Management”

The Practice area definitions also have an Intent & value statement, which provide clarity to the stakeholders to tailor the model based on org. context.

We earlier had a the concept of Capability Level & Maturity Level and Staged and continuous representation, which had its share of confusion. This seems to have been resolved, we do not anymore have Process areas associated with levels.

Every Practice Area has Practices starting at Level 1. They have practices defined which follow an increasing level of maturity from Level 1 to 5. This also significantly improves the Assessment process and Organizations can self assess their current performance level based on the extent to which each of the practices are institutionalized.

More of it later, as i get an opportunity to deep dive into it. But for now its suffice to say, that CMMI is still very much in the game

(Do visit the CMMI Institute website for more information & Resources)

Results… are the outcome of a process.

What we want are good results from a controlled process because they will be consistent & repeatable.
Bad results from an uncontrolled process simply mean that we’re not doing our job.
Good results from an uncontrolled process…only mean we’re lucky.
A bad result from a controlled process just says that we’re stupid:

We expect different results from doing the same things over and over again.

when an Organization is assessed for ISO 9001 Quality Management System,  Auditors are looking for evidences for the below …

An Organization should be aware of what it stands for. It’s vision Mission, Values their boundaries & Operating Environment thus they need to know the Context in which they want to operate

They should have a good Leadership team, who value quality focus & are willing to invest efforts & time in helping the organization realize it’s goals & vision

The organization should have strategic Plans and Actions to sustain & grow. they should be capable of exploiting the Opportunities that exist in the market. They should be aware of the Risks in their context and have Plans to mitigate them

Organizations should have the required resources & competent informed workforce at there disposal to be able to Support their operations. The operating processes & procedures should be well documented & used.

Organization should Operate / Execute as per the plans and deliver products & Services to meet Customer commitments.

Organizations should Evaluate Performance against stated goals & plans. Analyze deviations & take corrective & preventive actions.

Organizations should focus on Continuous Improvement of their operations, processes, execution efficiency & competencies.

With these in place you will have a good Quality Management System that would be in compliance with ISO 9001 Requirements 

Robert Stoddard has provided an excellent resource to help plan process performance models See here  Reproduced Below is an extract one of the key slides.

• Statistical, probabilistic or simulation in nature
• Predict interim and/or final project outcomes
• Use controllable factors tied to sub-processes to conduct the prediction
• Model the variation of factors and understand the predicted range or variation of the outcomes
• Enable “what-if” analysis for project planning, dynamic re-planning and problem resolution during project execution
• Connect “upstream” activity with “downstream” activity
• Enable projects to achieve mid-course corrections to ensure project success

Let me explain,  Anything new that gets created, is to serve a certain purpose. To address a problem or exploit an opportunity that exists. (of-course excluding Art). On Similar lines, in the mid 80’s the US DOD, was facing a problem. Their software projects were mostly delayed & had Quality issues. the problem was compounded because of the size of the projects & multiple Sub-contracted deliverable s. They approached Carnegie Mellon and took help from Academia to address this.

CMM was first envisioned to solve this. By assessing the software vendors on their capabilities & Maturity of Practices. the US DOD was given assurance of meeting a minimum threshold of performance & predictability.

It has been nearly 3 decades hence, Technologies, tools, programming paradigms have all evolved. Program management practices have improved significantly. Methodologies such as Agile, extreme programming, Test Driven development supported by Code Analysis tools, Continuous Integration & Deployment are the strengths of today’s most successful companies.  Looking back at the original purpose and current realities, the Value provided by CMMI Certification has significantly diluted.

Adaptability, Flexibility & Fast innovations are primary drivers in current environment of constant flux. If CMMI has to retain its value proposition, it will need to Re-purpose itself to Assess & certify organizations as capable & Mature enough to meet these new attributes. CMMI Certified Organizations has to meet current needs & future directions. 

Set of Interrelated / interacting activities that help transform Needs or Problems into Products & Solutions is a Process.
A process that is capable of Meeting or exceeding desired outcome is considered as effective. A process that consumes less resources than anticipated to meet the desired outcome is considered efficient.

If there is a Gap in the desired outcome vs actual results, the Effectiveness reduces. Similarly, if the consumed resources exceeds plans the efficiency decreases. below is a visual representation of this relationships to help understand better.

While the core intent is to be able to get to the intersection of planned vs. desired. There has to a be a conscious focus to improve the processes to have a positive impact on both efficiency & Effectiveness.