MPS.BR - Brazilian Software Process Improvement. Assessment Guide

Transcription

1 MPS.BR - Brazilian Software Process Improvement Assessment Guide This Guide describes the MA-MPS Assessment Method and Process, based on the International Standard ISO/IEC EFFECTIVE TERM: The Assessment Guide: 2013 will take effect on September 1, Thus, as of the aforementioned date, only assessments performed in accordance with the MA-MPS Assessment Method and Process defined in this version of the Assessment Guide will be valid. August 2013 Copyright SOFTEX This edition s rights are reserved by SOFTEX Unlimited distribution of this document is subject to copyrights ISBN

2 Contents 1 Preface Introduction Purpose Terms and definitions Overview of the assessment process Description of the assessment process Subprocess 1: Contract the assessment Subprocess 2: Prepare the assessment s performance Subprocess 3: Perform initial assessment Subprocess 4: Conducting the final assessment Subprocess 5: Document assessment results Assessment Institution (AI) MR-MPS-SW assistant assessor requirements MR-MPS-SV assistant assessor requirements MR-MPS-SW initial lead assessor requirements MR-MPS-SV initial lead assessor requirements MR-MPS-SW Intermediary lead assessor requirements MR-MPS-SV Intermediary lead assessor requirements MR-MPS-SW experienced lead assessor requirements MR-MPS-SV experienced lead assessor requirements Transition Period for MR-MPS-SW assessors to be accredited as MR-MPS- SV assessors Lead Assessor s Observation Lead assessor s observation procedure Lead assessor observation coverage Procedure to request lead assessor level changes Roles and responsibilities Assessment sponsor Assessment Institution (AI) Coordinator Lead assessor AI assistant assessor Volunteer assistant assessor Assessment team MPS.BR-Assessment Guide:2013 2/115

3 9.7 Implementing Institution (II) Organizing Institution of Corporate Groups (OICG) Auditor Lead assessor observer SOFTEX MPS.BR-Assessment Guide:2013 3/115

4 1 Preface MPS.BR 1 is a long-term mobilizing program, created in December 2003, coordinated by the Association for the Promotion of Excellence in Brazilian Software (SOFTEX), duly supported by the Department of Science and Technology (MCT), Study and Project Funding Agency (FINEP), Brazilian Support Service for Micro and Small Enterprises (SEBRAE), and the Inter-American Development Bank (IADB). The purpose of the MPR.BR Program (acronym) is to Enhance the Brazilian Service and Software Process, based on two medium- and long-term goals: a) technical goal, covering the creation and development of the MPS model, seeking expected results such as: (i) MPS model guides; (ii) Implementing Institutions (II) accredited to render consulting services regarding the implementation of the MR- MPS-SW and MR-MPS-SV reference models; (iii) Assessment Institutions (AI) accredited to render assessment services based on the MA-MPS Assessment Method; (iv) Acquisition Consultants (AC) certified to render consulting services regarding the acquisition of software and related services; b) market goal, covering the dissemination and adoption of the MPS-SW and MPS- SV models across all Brazilian regions, within a proper period of time, at a reasonable cost, both in small and medium enterprises (main focus) and in major public/private organizations, seeking expected results such as: (i) creation and enhancement of the MN-MPS business model; (ii) courses, tests, and workshops; (iii) organizations that implemented the MPS model; (iv) organizations with published MPS assessments (valid for three years). The MPR.BR Program stands on two supporting pillars to develop its activities: the Accreditation and Control Forum (FCC) and the Technical Model Team (ETM). Based on these structures, the MPS.BR obtains participation from representatives of universities, public institutions, research centers, and private organizations, which contribute with their visions to add quality to the enterprise. The FCC is responsible for: (i) issuing a report subsidizing SOFTEX s decision regarding the accreditation of Implementing Institutions (II) and Assessment Institutions (AI); (ii) monitoring the results of Implementing Institutions (II) and Assessment Institutions (AI), issuing a report to propose its disqualification to SOFTEX in case the MPS model credibility is compromised. The ETM is responsible for supporting SOFTEX in technical aspects related to the Reference Models (MR-MPS) and Assessment Method (MA-MPS), to: (i) create and continuously improve the MR-MPS-SW, MR-MPS-SV and its specific guides; (ii) qualify personnel via courses, tests and workshops. Furthermore, the ETM is responsible for creating and developing the General Software Guide and General Service Guide, which are part of the following set of documents of the MPS model: MPS General Software Guide:2012 [SOFTEX, 2013a]; 1 MPS.BR, MR-MPS-SW, MR-MPS-SV, MA-MPS and MN-MPS are registered trademarks of SOFTEX. The MPS.BR acronym is associated to the MPS.BR Brazilian Software Enhancement Improvement Program; the MPS-SW acronym is associated to the MPS software Software Process Improvement model; and the MPS-SV acronym is associated to the MPS Services Service Process Improvement model. MPS.BR-Assessment Guide:2013 4/115

5 MPS General Service Guide:2012 [SOFTEX, 2012a]; Assessment Guide:2013 [SOFTEX, 2013a]; Software Acquisition Guide:2012 [SOFTEX, 2013b]; Implementation Guide Part 1: MR-MPS:2011 Level G Implementation Rationale [SOFTEX, 2013c]; Implementation Guide Part 2: MR-MPS:2011 Level F Implementation Rationale [SOFTEX, 2013d]; Implementation Guide Part 3: MR-MPS:2011 Level E Implementation Rationale [SOFTEX, 2013e]; Implementation Guide Part 4: MR-MPS:2011 Level D Implementation Rationale [SOFTEX, 2013f]; Implementation Guide Part 5: MR-MPS:2011 Level C Implementation Rationale [SOFTEX, 2013g]; Implementation Guide Part 6: MR-MPS:2011 Level B Implementation Rationale [SOFTEX, 2013h]; Implementation Guide Part 7: MR-MPS:2011 Level A Implementation Rationale [SOFTEX, 2013i]; Implementation Guide Part 8: MR-MPS:2011 Implementation (Levels G to A) in organizations that acquired the software [SOFTEX, 2013j]; Implementation Guide Part 9: MR-MPS:2011 Implementation (Levels G to A) in organizations of the Software Factory type [SOFTEX, 2013k]; Implementation Guide Part 10: MR-MPS:2011 Implementation (Levels G to A) in organizations of the Testing Factory type [SOFTEX, 2013l]; Implementation Guide Part 11: MR-MPS-SW:2012 Implementation and Assessment (Levels G to A) along with CMMI-DEV v1.3 [SOFTEX, 2012b]; Implementation Guide Part 12: Compliance Assessment of the MR-MPS- SW:2012 in relation to NBR ISO/IEC : Software Engineering - Life cycle profiles for micro-organizations (VSEs) - Part 4-1: Profile specifications: Generic Profile Group [SOFTEX, 2012c]; Implementation Guide Part 13: Mapping and equivalence system between MR-MPS-SW:2012 and MoProSoft:2005 [SOFTEX, 2012d]. This Assessment Guide describes the MA-MPS Assessment Method and Process, based on the International Standard ISO/IEC : [ISO/IEC, 2003][ISO/IEC, 2003]. The 2009 version of the Assessment Guide incorporated results of assessment experiences performed from September 2005 to September 2008, as well as the suggestions obtained after consulting the entire community of MPS.BR assessors, implementers and Organizing Institutions of Corporate Groups (OICG). 2 Equivalent to the Brazilian standard NBR ISO/IEC Information technology - Process assessment Part 2: Performing an assessment process MPS.BR-Assessment Guide:2013 5/115

6 The 2011 version of the Assessment Guide incorporated results of assessment experiences performed by December 2010, as well as some transitional provisions previously published as FAQs. The following considerations were included: MPS assessment supplementing a CMMI assessment; MPS-CMMI joint assessment; Request for assessment abroad; Statement of 100% of compliance with implementation; Excessively large organizational units; Requirement of a company representative in the assessment team; Sponsor unable to participate in the initial and final assessments; Unexpected events with assessment team members prior to the initial assessment, during the initial assessment, between the initial and final assessments, and during the final assessment; Assessments in companies that have already received MPS assessment; Changes in MPS Level after the initial assessment; Separation of organizational units after the initial assessment; II signature in the initial assessment report; Responsibilities of the II and OICG with the assessed company during the adjustment period; Assessment of evidence during the final assessment, when there is no company representative in the assessment team; Publication of assessment results on the SOFTEX website; CMMI Lead Assessor who wishes to become a MPS assessor; Training in statistical process control and assignment to experienced lead assessor. The following considerations were reworded: Assessment Institution contracting, in which the time restriction was changed to 2 years; MPS Assessment proposals, in which the reference value no longer includes the SOFTEX contribution; Table 4: duration, assessment team members, and minimum number of assessors; Selection of projects to be assessed; Removal of expected processes and results to meet new Guides (parts 8, 9 and 10 of the Assessment Guide); Initial assessment; Assessment team training; MPS.BR-Assessment Guide:2013 6/115

7 Decision to include new projects. The following tasks were changed: planning the Initial assessment; analyzing initial assessment data; auditing the initial assessment; auditing the final assessment; and tasks related to the Evaluation of the assessment process. The task File assessment documentation at SOFTEX was added. In addition, changes were also applied to assistant assessor requirements, regarding the order and content of tasks performed upon conclusion of the assessment, as well as the responsibilities of the lead assessor, Implementing Institutions, Organizing Institutions of Groups of Companies, and SOFTEX. The following items were better explained: Composition of the group of observers; Attributions of the Auditor Group; Procedures in case the audit report is not approved and the on-site audit is performed. Attachment B was removed and the former Attachment C was amended and renamed to Attachment B, containing the introduction and alterations of documents. The 2012 version of the Assessment Guide incorporated results of experiences acquired from assessments performed until December The following considerations were included: Assessment supplementing a CMMI assessment; Proposal; Request for assessment abroad; Assessment notification to SOFTEX; Assistant assessors under training; Assignment of the assessment auditor; Statement of 100% of compliance with implementation; Selection of projects to be assessed; Excessively large organizational units; Initial assessment; Roles performed in the company by the Implementing Institution; Performance of the final assessment; Characterization of results assigned as REQUIRED during the initial assessment; Permanence as MPS assessor not associated to the AI. The following tasks were changed: analyzing initial assessment data; sending initial assessment documentation to the auditor; auditing the initial assessment; AI coordinator s evaluation of the assessment; OICG coordinator s evaluation of the assessment; II evaluation of the assessment; sending final assessment documentation to the auditor; and auditing the final assessment. MPS.BR-Assessment Guide:2013 7/115

8 In addition, changes were made to the section referring to the Assessment Institution, in the requirements for assistant assessor and lead assessor, and to the section referring to assessment audits. This 2013 version of the Assessment Guide incorporated results experiences acquired from assessments performed until April 2013, within MPS-SW and MPS-SV assessments, upon due consultation to all Assessment Institutions. The following changes were made: Subprocess 2 was divided into two new subprocesses: Preparation of the assessment and Performance of the initial assessment; Duration of Assessment Institution accreditations; Assessment Institution re-accreditation conditions; Assessor re-accreditation conditions. The following considerations were included: MR-MPS-SV Assessments; Duration and size of the assessment team; Assessment team members; Selection of projects/activities to be assessed; Removal and addition of processes in the assessment scope; Indirect indicators; Initial and final assessment training; Roles performed in the company by the Implementing Institution; Project Selection Worksheet; Process Selection Worksheet for Performance Assessment; Final assessment; Assessment document filing period in AI; Document names; Characterization of results in the final assessment assigned as Required in the initial assessment; AP1.1 Characterization 2 Introduction Recent changes in business environments have prompted companies to adjust organizational structures and production processes, replacing the traditional approach based on functional areas with client-centered process networks. Competitiveness is increasingly conditioned to the establishment of connections within these networks, forging key bonds in the production chains. For software companies, achieving competitiveness based on quality implies improving the quality MPS.BR-Assessment Guide:2013 8/115

9 of software products and related services, as well as production processes and software distribution. Therefore, similarly to the reality of other sectors, quality is a critical success factor for the IT service and software industry. In order to promote a competitive software segment, both nationally and internationally, the sectors executives must focus on the efficiency and efficacy of its processes, offering software products and related services based on international quality standards. The MPS-SW and MPS-SV models must be adequate to the profiles of companies of different sizes and features, both public and private, but particularly tailored to micro, small and mid-sized companies. MPS models are also expected to be compatible with internationally accepted quality standards, leveraging the entire competence of available process improvement models and standards. Therefore, the MR-MPS-SW is based on process requirements defined in process improvement models, covering the need to adequately implement software engineering principles based on the companies contexts, in line with the key international practices regarding the definition, assessment, and improvement of software processes. Similarly, the MR- MPS-SV models is aligned to the main international service practices. The MPS models are based on process capacity and maturity concepts. Within this context, the MPS model covers four key components: Software Reference Model (MR-MPS-SW), Service Reference Model (MR-MPS-SV), Assessment Method (MA- MPS), and Business Model (MN-MPS). The MPS models are described as guides in documents: General Software Guide: contains the general description of MPS models and details the Software Reference Model (MR-MPS-SW), its components and common definitions required for proper comprehension and application [SOFTEX, 2013a]; General Service Guide: contains the general description of MPS models and details the Service Reference Model (MR-MPS-SV), its components and common definitions required for proper comprehension and application [SOFTEX, 2012a]; Acquisition Guide: describes the acquisition process for software products and related services. It is described as a way to support institutions that intend to acquire software products and related services, based on the MR-MPS [SOFTEX, 2013b]Erro! A origem da referência não foi encontrada.; Assessment Guide: describes the MA-MPS Assessment Method, the requirements for lead assessors, assistant assessors, and Assessment Institutions (AI); Implementation Guide: series of thirteen documents that provide instructions to implement the maturity levels in organizations, as detailed in the MR-MPS-SW Reference Model [SOFTEX, 2013c], [SOFTEX, 2013d], [SOFTEX, 2013e], [SOFTEX, 2013f], [SOFTEX, 2013g], [SOFTEX, 2013h], [SOFTEX, 2013i], [SOFTEX, 2013j], [SOFTEX, 2013k], [SOFTEX, 2013l], [SOFTEX, 2012b], [SOFTEX, 2012c], [SOFTEX, 2012d]. MPS.BR-Assessment Guide:2013 9/115

10 3 Purpose This document describes the MPS model Assessment Method and Process, duly defined in accordance with the International Standard ISO/IEC :2003 [ISO/IEC, 2003], and detailed in section 6. The MA-MPS Assessment Method and Process were defined to: allow the objective assessment of software processes and services of an organization/organizational unit; allow the assignment of an MR-MPS-SW and MR-MPS-SV maturity level based on the result of the assessment process; apply to any domain within the software industry; apply to organizations/organizational units of any size. This document is intended, among others, to Assessment Institutions (AI), companies that wish to be assessed based on MA-MPS, and Implementing Institutions (II) of the MR-MPS. 4 Terms and definitions The terms and definitions of the General Software Guide and General Service Guide also apply to this guide. 5 Overview of the assessment process The purpose of the MA-MPS Assessment Method and Process is to assess the organizational unit s maturity in the execution of its software and service processes. The assessment process describes the set of activities and tasks to be performed in order to reach this goal. The process begins by selecting an Assessment Institution (AI) and ends with the proper documentation of the assessment process in the SOFTEX confidential database. The sponsor may be a representative of the organizational unit s board of directors, as well as other organizations requesting the organizational unit s assessment or third parties, for contracting purposes. The following is required to ensure a successful assessment process: Sponsor commitment: the sponsor s commitment is paramount to ensure that the assessment s objectives are reached. This commitment also concern the required resources, time and personnel available to perform the assessment. Motivation: the approach of the organizational unit s management significantly affects the result of an assessment process. The individuals responsible for the organizational unit must motivate participants based on an open and constructive approach. The former must also clarify that the focus of the assessment lies in the process, rather than the performance of individuals implementing the process. Feedback: the provision of feedback and fostering an environment that encourages open discussion regarding preliminary results, during the assessment, help ensure the relevancy of the assessment for the organizational unit. MPS.BR-Assessment Guide: /115

11 Confidentiality: respecting the confidentiality of information obtained during assessments is paramount to obtain the required information. Full confidentiality must be assured to participants, whether assessment team members or interview respondents. Similarly, such understanding of confidentiality is essential to prevent any respondent from feeling threatened and allow all participants to freely express themselves. The confidentiality requirement also covers information contained in documents submitted by the organizational unit to assessors. Perception of benefits: the members of the organizational unit must understand that the assessment will generate benefits, which will directly or indirectly help them perform their duties. Credibility: the sponsor, manager and employees of the organizational unit must believe the assessment will generate results that accurately represent the organization/organizational unit. It is paramount for all parties to be confident in the assessors experience and ability to perform the assessment, in addition to their impartiality and adequate knowledge of the organizational unit. An MA-MPS assessment is valid for 3 (three) years as of the completion date of the final assessment within the assessed organizational unit. The assessment process encompasses 4 subprocesses: Subprocess 1: Contracting the assessment; Subprocess 2: Preparing the assessment; Subprocess 3: Performing the initial assessment; Subprocess 4: Conducting the final assessment Subprocess 5: Documenting assessment results. As a result of this process: data and information are obtained that characterize software and/or service processes of the organization/organizational unit; the level in which expected results are achieved and processes reach its purpose is determined; a MR-MPS-SW and/or MR-MPS-SV maturity level is assigned to the organization/organizational unit. Each subprocess of the assessment process is comprised of activities. Each activity is described by its respective underlying tasks. Each task is defined based on the items described in Chart 1. Additional considerations are provided whenever an in-depth explanation is required regarding any aspect of the task or activity. MPS.BR-Assessment Guide: /115

12 Task name Description Pre-task Input Criterion Output Criterion Responsibility Participants Required Products Generated Products Tools Post-task Chart 1 - Task description items Identifies the task by name. Describes the task in detail. Task that must be performed before the respective task. Conditions to be met for the task to be initiated. Conditions to be met for the task to be completed. Individual responsible for executing the task. Individuals involved in the task s execution. Lists all inputs required to execute the task. Lists products to be generated when executing the task. Lists tools that must be used to execute the task. Lists the task to be executed after the respective task is completed. 6 Description of the assessment process In this section, each of the five subprocesses of the assessment process is described, covering its purpose and activities/tasks. Table 1 - Assessment process ASSESSMENT PROCESS SUBPROCESS Contract the assessment ACTIVITY Research Assessment Institutions Execute agreements Implement the assessment Prepare the assessment s performance Plan the assessment Prepare the assessment Perform initial assessment Conducting the final assessment Document assessment results Conduct the initial assessment Complete the assessment preparation Perform the final assessment Evaluate the execution of the assessment process Report results Document results MPS.BR-Assessment Guide: /115

13 6.1 Subprocess 1: Contract the assessment Purpose The purpose of the Contracting the assessment subprocess is to establish a contract to perform an assessment, as requested by an organization/organizational unit that wishes to assess its own processes or the processes of another company. Organizational unit considerations Assessments can be performed within entire organizations or exclusively at organizational units within these organizations. For example, a single software factory may be assessed, leaving aside all other departments and sectors of the organization, even though the latter also develop software products. Hereinafter, the organizational unit (OU) will always be referred to as the assessed entity, even through the organizational unit may represent the entire organization assessed in some cases. Considerations regarding the MPS Assessment supplementing a CMMI assessment Organizational units with previous CMMI assessments may request a supplementary MPS assessment from SOFTEX, after the CMMI assessment result is duly published on the CMMI Institute website. MPS assessments supplementing CMMI assessments: may be performed within up to 6 months after the CMMI assessment; are performed by an experienced lead assessor designated by SOFTEX; are performed for level F, in case the organizational unit received level 2 from CMMI; level C, in case the organizational unit received level 3 from CMMI; level B, in case the organization unit received level 4 from CMMI; and level A, in case the organizational unit received level 5 from CMMI; only assess processes and results with different requirements among the two models. In this case, the specific assessment worksheet for the supplementary assessment must be submitted and completed by the company; At least the following documents are generated: Assessment Plan, Nondisclosure Agreement, Final Assessment Adjustments Report, Supplementary Assessment Report, Evaluation of the assessment process by the lead assessor and the Sponsor. All of the aforementioned documents are part of the Assessor Kit for the Supplementary Assessment. are valid for 1 day for the initial assessment and 1 day for the final assessment, whenever required; have the same validity term of the previously performed CMMI assessment. In MPS assessments supplementing CMMI assessments, the company must assign an employee, who understand the company s process, to accompany the lead assessor throughout the entire assessment process. Considerations regarding the MPS-CMMI joint Assessment MPS-CMMI joint assessments may be performed under the following conditions: The MPS lead assessor must be an experienced assessor; MPS.BR-Assessment Guide: /115

14 The CMMI lead assessor is a member of the MPS assessment team, has undergone the C1 course, and cannot have any association to the company responsible for implementing the CMMI or MPS in the company to be assessed. The same rules for the lead assessor apply in case of AI contracting activities set out in the Assessment Guide The entire assessment team must have undergone the C1-Software and/or C1-Services course and the CMMI Software and/or Service Introduction course, as applicable, and meet all MPS assessment team member requirements. The initial assessment must coincide with the readiness review applied to the assessment method defined by CMMI, and must be conducted on-site, with duration equal or greater than recommended for the MPS level. All members of the assessment team must attend the initial and final assessments. The assessment must be approved by SOFTEX, considering the following aspects, in addition to the items above: The assessment process adopted by the CMMI lead assessor must be described in detail and attached to the assessment contracting notification submitted by the AI to SOFTEX. CMMI lead assessor s statement, indicating that neither he/she and/or the CMMI Institute Partner to which he/she belongs has provided consulting services to the company to be assessed over the past 2 years. If the assessment is performed in Brazil, it must be conducted in the Portuguese language. Assessments performed in other countries must be conducted in the local language. Description of subprocess 1 This subprocess consists of two activities: Search Assessment Institutions and Establish agreement. ACTIVITY Table 2 - Subprocess 1 SUBPROCESS 1: CONTRACTING THE ASSESSMENT TASK Research Assessment Institutions Consult the SOFTEX website Request assessment proposals Prepare and submit proposal Execute agreements Select Assessment Institution Formalize contracting of the Assessment Institution Activity: Search Assessment Institutions (AI) The purpose of this activity is to obtain a list of Assessment Institutions, among those duly accredited by SOFTEX, and request proposals to perform MR-MPS-SW and/or MR-MPS-SV assessments within a specific organizational unit. MPS.BR-Assessment Guide: /115

15 Task: Description: Pre-task: - Input Criterion: Consult the SOFTEX website The contracting party consults the SOFTEX website to obtain the list of accredited Assessment Institutions (AIs) and selects one or more institution to request a MR-MPS-SW and/or MR-MPS-SV assessment proposal. Decision to perform a MR-MPS-SW and/or MR- MPS-SV assessment. Output Criterion: Previously selected potential Assessment Institution(s). Responsible individuals: Contracting party of the Assessment. Participants: - Required products: Generated products: Tools: Post-task: SOFTEX website with accredited Assessment Institutions List of previously selected Assessment Institutions. Internet access. Request assessment proposals. Considerations regarding the contracting party of the assessment The contracting party of the assessment may be the sponsor, representing the interests of the assessed organizational unit, and/or an external agent, such as the OICG (Organizing Institution of Corporate Groups), if the organizational unit is part of a group, or another organization that needs to know the capacity of the assessed organization s processes. In case of corporate groups, the sponsor and the OICG must reach an agreement regarding the selection criteria of the AI to be contracted 3. Considerations regarding the contracting of the Assessment Institution An assessment institution (AI) cannot be contracted when: It is the Implementing Institution (II) or the OICG (Organizing Institution of Corporate Groups) that supported the implementation of the MR-MPS in the organizational unit; It has provided consulting services in software and/or service processes to the organization or any of its organizational units in the past 2 years; Any member of the AI team has coordinated a private course for the organizational unit to be assessed in the past 2 years; Any member of the AI team works in the organization controlling the organizational unit to be assessed; Any member of the AI team has, over the past 2 years, acted as an advisor in academic study that has been used directly to implement the MR-MPS-SW or MR- MPS-SV; that is, when the advisee works in the organization and uses the academic study in the implementation process; 3 The II may be involved in this process to help identify these criteria MPS.BR-Assessment Guide: /115

16 Any member of the AI team has performed gap analysis in the organizational unit to be assessed in the past 2 years; Any member of the organization or any of its organizational units to be assessed has been part of the AI team in the past 2 years; The AI has members in common with the II responsible for the implementation, or the AI (in case of the same organization) that performed the implementation in the past 2 years; The organization to which the organizational unit to be assessed belongs is an AI (it cannot assess itself); The AI does not have a lead assessor certified to perform assessments within the level required by the organization; The AI does not have a lead assessor certified to perform assessments within the MPS model required by the organization; In case of any other ethical restriction; If the AI has an II (same trade name and CNPJ [Corporate Taxpayer s Registry]), all rules applied to the AI also apply to the II. Task: Description: Pre-task: Input Criterion: Output Criterion: Request assessment proposals The contracting party contacts the Assessment Institution(s) selected during the previous step and requests an assessment proposal. Consult the SOFTEX website. One or more Assessment Institutions selected to request the proposal. Assessment proposals requested to the selected Assessment Institution(s). Responsible individuals: Contracting party of the Assessment. Participants: - Required products: Generated products: Proposal requests 4. Tools: - Post-task: List of Assessment Institutions selected to request proposals. Creation and submission of the proposal. Activity: Execute agreements The purpose of this activity is to formalize an agreement between the contracting party of the assessment and the Assessment Institution (AI) to perform a MR-MPS- SW and/or MR-MPS-SV assessment. 4 The proposal request may have different levels of formality (public notice, invitation letter, , telephone request) MPS.BR-Assessment Guide: /115

17 Task: Prepare and submit proposal Description: Upon receiving a proposal request, the Assessment Institution (AI) analyzes whether it has a lead assessor and assistant assessor available, based on the required skill set, and whether it is able to meet other conditions to perform the assessment, and subsequently devises a proposal and forwards it to the requesting party. Pre-task: Input Criterion: Output Criterion: Request assessment proposals. Proposal request for the performance of MR-MPS- SW and/or MR-MPS-SV assessment submitted to an Assessment Institution (AI). Proposal request for the performance of MR-MPS- SW and/or MR-MPS-SV assessment submitted to the requester. Responsible individuals: Assessment Institution (AI) Coordinator Participants: - Required products: Generated products: Tools: - Post-task: Proposal request MR-MPS-SW and/or MR-MPS-SV assessment proposal. Select Assessment Institution. Considerations regarding the proposal The SOFTEX reference value, pursuant to each assessment level, includes only the assessment value to be paid to the AI. The reference value does not include traveling, accommodations and food expenses incurred by the assessment team. Considerations regarding assessment requests abroad The Assessment Institutions can only submit assessment proposals in Brazil. Therefore, when requested to perform assessments abroad, the AI must consult the MPS.BR coordination at SOFTEX before replying to the requester and/or sending a proposal, due to the costs involved in this type of assessment (document translations, training, and C1 course), among other relevant issues. The proposal may only be submitted upon due authorization by SOFTEX. Task: Description: Select Assessment Institution The contracting party of the assessment selects an Assessment Institution (AI), based on its exclusive criteria, and discloses the result of this selection to all AIs that submitted proposals. MPS.BR-Assessment Guide: /115

18 Pre-task: Input Criterion: Output Criterion: Creation and submission of the proposal. Proposals received from one or more Assessment Institutions (AI). Assessment Institution (AI) selected to perform the assessment at the organizational unit. Responsible individuals: Contracting party of the Assessment. Participants: - Required products: Generated products: Tools: - Post-task: MR-MPS-SW and/or MR-MPS-SV assessment proposal. Result of proposal assessments, duly notified to the selected AI and other participants. Formal contracting of the Assessment Institution. Task: Formalize contracting of the Assessment Institution Description: Pre-task: Input Criterion: Output Criterion: Due proposal acceptance is formalized as required by the Assessment Institution (AI) and the contracting party. Select Assessment Institution. Assessment Institution (AI) selected to perform the assessment. Effective contracting. Responsible individuals: Contracting party of the Assessment. Participants: Required products: - Generated products: Tools: - Post-task: Assessment Institution (AI). Formal contract or proposal acceptance Notify SOFTEX of the assessment contracting process; Submit the Assessment Plan Model to the Organizational Unit; and Submit the template of the Indicator Worksheet and Nondisclosure Agreement ( Prepare assessment subprocess). Considerations regarding SOFTEX contracting In exceptional cases in which AIs cannot be contracted, SOFTEX may be contracted instead. In this case, the latter will assign a lead assessor and one or more assistant assessors, subject to the same restrictions as the AIs. MPS.BR-Assessment Guide: /115

19 6.2 Subprocess 2: Prepare the assessment s performance Purpose The purpose of the subprocess Prepare the assessment is to notify the contract to SOFTEX, which must authorize the assessment, plan the process, and prepare the required documentation for its performance. Description of subprocess 2 Subprocess 2 comprises three main activities: Implement the assessment, Plan the assessment and Prepare the assessment. Table 3 - Subprocess 2 SUBPROCESS 2: PREPARE THE ASSESSMENT S PERFORMANCE ACTIVITY TASK Notify SOFTEX of the assessment contracting process Implement the assessment Analyze the assessment team composition and designate the assessment auditor Request participation of an assessor in training from the organizational unit Pay due contributions to SOFTEX Authorize the assessment process Plan the assessment Prepare the assessment Submit the Assessment Plan and Project Selection Worksheet template to the organizational unit Plan the initial assessment Submit the Indicator Worksheet template and Nondisclosure Agreement to the organizational unit Complete the Indicator Worksheet MPS.BR-Assessment Guide: /115

20 Activity: Implement the assessment The purpose of the Implement the assessment activity is to disclose the contracting of the AI to perform a MR-MPS-SW and/or MR-MPS-SV assessment to SOFTEX, in order to obtain its authorization. Task: Description: Pre-task: Input Criterion: Output Criterion: Responsible individuals: AI Coordinator. Participants: Required products: Generated products: Tools: Post-task: Notify SOFTEX of the assessment contracting process The AI Coordinator must complete the SOFTEX Notification document regarding the AI contracting process and send it to SOFTEX and the individuals responsible for MPS.BR via . This notification, which includes the definition of the assessment team and the local coordinator, must be submitted at least 20 days prior to the initial assessment. The selection of the local coordinator is paramount to ensure proper assessment procedures. This position is designated by the assessment sponsor. The local coordinator works alongside the lead assessor to develop the assessment plan and is responsible for providing the required infrastructure to perform the assessment. The local coordinator may or may not be part of the assessment team Formal Contracting of the Assessment Institution. AI contracted to perform an MPS assessment. Notification to SOFTEX regarding AI Contracting submitted to individuals responsible for MPS.BR Lead assessor. SOFTEX template of AI Contracting Notification to SOFTEX. AI Contracting Notification to SOFTEX ( to avaliação.mps@nac.softex.br). text editor, Analyze the assessment team composition and designate the assessment auditor. MPS.BR-Assessment Guide: /115

21 Considerations regarding the assessment notification to SOFTEX SOFTEX will not accept notifications of assessments to be performed in companies that belong to corporate groups supported by SOFTEX if the 100% statement documents have not been previously submitted. In these cases, upon receiving these documents, SOFTEX will inform all stakeholders of the rejection and its respective justification. Considerations regarding the SOFTEX slide and document templates The slide and document template (assessor kit) are standard-issued and cannot be modified by the lead assessor. Considerations regarding the assessment team The assessment team is composed of internal and external members of the organizational unit, in order to ensure the team has proper knowledge of the organizational unit assessed (internal members) and has no direct interest in the assessment s results (external members). Internal assessment team members are known as representatives of the organizational unit. Representatives are assessors with the same duties and rights as other members, and contribute with their knowledge of the company to allow the entire team to better understand the organization, its processes and artifacts. These members must be independent when performing the role of assessors; they cannot be hierarchically superior to interviewed employees and cannot have a relevant participation in projects to be assessed (the lead assessor is responsible for determining whether project participations are relevant or not). The lead assessor must ensure that appropriate representatives are selected. Certain requirements must be considered during its selection: Individuals must have participated in the official MPS.BR Introduction Course (C1- Software and/or C1-Services, as appropriate); Individuals must have experience in executing processes associated to the MPS model level to be assessed; The representatives of assessed organizations are expected to have: Unbiased judgments and opinions; Knowledge of the organization, its processes and artifacts; A collaborative approach towards the assessment team; Commitment towards the accuracy of assessment results; Interpretation of terms, jargon, names and other specific organizational elements. After the Initial Assessment, these individuals must assess whether the required adjustments were properly implemented, understand them (in order to explain them to other assessment team members during the final assessment), and sign the Initial Assessment and Final Assessment Adjustments Report, duly completed with adjustments implemented. During the Final Assessment, the assessed organization s representative must act as a facilitator during interviews, ensuring all questions and answers are properly understood by respondents and by the assessment team. During and even after the Assessment period, the representative must avoid any comment, conversation or insinuation regarding the activities performed during the assessment process. Impediments to become the Organizational Unit Representative in the Assessment Team: Members of the organization to which the organizational unit belongs. Relatives of any of the company s partners. Relatives of any of the company s board members. External members are: MPS.BR-Assessment Guide: /115

22 The AI lead assessor in training designated by SOFTEX, duly authorized to perform the assessment under the levels indicated by SOFTEX; AI assistant assessor(s) (this requirement does not apply when SOFTEX is the contractor, in which case SOFTEX may designate any assistant assessor); Assessor(s) in training designated by SOFTEX, if applicable. When planning the assessment team, the AI coordinator must consult SOFTEX to verify the need to include a lead assessor or assistant assessor in training. If SOFTEX assigns any member to the assessment team, it must issue a notification to the AI coordinator and to the OICG (in case of corporate groups), or to the assessment sponsor, formalizing the assignment. Table 4 is provided as a guideline regarding the minimum and maximum initial/final assessment durations and the assessment team composition, considering that the lead assessor observer is not part of the assessment team. Regarding the assessment team composition, it is important to note that there cannot be more company representatives than accredited assessors. Under special circumstances, the assessment team may not contain any representative of the assessed organization. This scenario is allowed when all of the company s employees are prevented from becoming members of the assessment team; in case of companies with less than 10 employees, the lead assessor is responsible for waiving the participation of company representatives. In case of larger companies, the lead assessor must notify and explain to MPS coordination the reasons for impediment, and obtain due authorization from SOFTEX. Being part of an assessment team is a full-time job and, therefore, assessment team members must not schedule other commitments on any of the initial and final assessment dates. The lead assessor is responsible for checking whether the MA-MPS Assessment Method and Process is being followed regarding team composition. Implementing Institutions must also assist the lead assessor by checking these requirements and instructing the organizational unit in selecting the projects and representatives to be assigned to the assessment team. MR-MPS Level Table 4 Assessment team composition and timeline Initial Final Assessment Assessment Assessment team composition Duration Duration (days) (days) A Lead ass. (1); assistant ass. (1 or more); organizational unit representative (1 or more) B Lead ass. (1); assistant ass. (1 or more); organizational unit representative (1 or more) C Lead ass. (1); assistant ass. (1 or more); organizational unit representative (1 or more) D Lead ass. (1); assistant ass. (1 or more); organizational unit representative (1 or more) E Lead ass. (1); assistant ass. (1 or more); organizational unit representative (1 or more) F Lead ass. (1); assistant ass. (1 or more); organizational unit representative (1 or more) G Lead ass. (1); assistant ass. (1 or more); organizational unit representative (1 or more) MPS.BR-Assessment Guide: /115

23 Considerations regarding the impossibility of having a company representative in the assessment team simply due to the fact that no employees participated in the C1 course In case company representatives cannot be assigned to the assessment team due to the fact that no company employees participated in the C1 course, the lead assessor must request due selection of the future company representative in the assessment team, who must take the C1 course as soon as it is offered. If this option is not feasible, the lead assessor may provide the C1 course as a restricted course. Considerations regarding assistant assessors in training SOFTEX may request the inclusion of assistant assessors in training to participate in assessments. If there are no restrictions imposed by SOFTEX, the AI Coordinator must include these assessors as assessment volunteers. The participation of volunteer assessors in observed assessments is not recommended. Although this is not a full restriction, the assessment process should never feature a volunteer performing the role of assistant assessor for the first time. The decision to accept or reject volunteer assessors in observed assessments must be made by the observer and the assessor under observation. Each assessment may have up to one volunteer assessor. The addition of a volunteer assessor does not change the need for all MPS assessments to have at least one assistant assessor from the AI. The request of lead or assistant assessors to participate in assessments as volunteers must be made to SOFTEX. Assessors may request participation in assessments as volunteers in the following situations: Assessors approved in C3 who are not affiliated to any AI. Initial lead assessor with no intermediary or experienced lead assessor for Level E, D and C assessments, and who are not affiliated to an AI. In this case, the assessor may also be assigned to level A or B assessments, assessing Level E, D or C processes. Intermediary lead assessors who are affiliated to an AI that has no experienced lead assessor for Level B and A assessments, and who have already fulfilled the training requirement regarding statistical process control. Only one volunteer assessor in these conditions is permitted in level A or B assessments. Considerations regarding the need to review the assessment contracting notification In case of any of the following situations prior to the initial assessment, the assessment contracting notification must be changed and resubmitted to the individuals responsible for MPS.BR ( availação.mps@nac.softex.br): 1. Changes in initial and final assessment dates; 2. Changes in the assessment team; 3. Changes in the MR-MPS level covered in the assessment; 4. Changes in the organizational unit to be assessed; 5. Other relevant situations at the AI coordinator s discretion. Eventual changes during the initial assessment must be duly registered in the Initial Assessment Result document and do not require the submission of a new notification. MPS.BR-Assessment Guide: /115

24 Task Description: Pre-task: Input Criterion: Output Criterion: Responsibility: Participants: - Required products: Generated products: Tools: Post-task: Analyze the assessment team composition and designate the assessment auditor The ETM coordinator must analyze the composition of the assessment team regarding compliance with the model and level for which the lead assessor is qualified, as well as the intended MR-MPS level and model for the assessment, any potential conflict of interests, and compliance with assistant assessor requirements. The assessment auditor is also designated in this task. Notify SOFTEX of the assessment contracting. Assessment contracting notified to SOFTEX. Approval or rejection of the assessment team and designation of the assessment auditor. ETM Coordinator. AI contracting notification to SOFTEX. Notification of the approval or rejection of the assessment team and assignment of auditor. . Request participation of an assessor in training from the organizational unit or Pay due Contributions to SOFTEX. Considerations regarding the assignment of the assessment auditor Level G and F assessments may be audited by an intermediary lead assessor. In assessments of higher levels, supplementary and joint assessments may only be audited by an experienced lead assessor. In exceptional cases, in which an auditor cannot be assigned, SOFTEX must be responsible for auditing the assessment process. Task: Description: Request participation of an assessor in training from the organizational unit If SOFTEX requires due observation of a lead assessor or participation of an assistant assessor who is not affiliated to the contracted AI, it must issue a request to the contracting party of the assessment upon consulting the AI coordinator regarding this possibility. This request cannot be refused in case of organizations whose MR-MPS implementation and assessment have been supported by SOFTEX. MPS.BR-Assessment Guide: /115