March 2000
Volume 2 • Number 2

Contents

Risk Management Supporting Quality Management of Software Acquisition Projects

Challenges to traditional business practices prompt a need for change in organization, business processes, and information technology. Since business process reengineering and software acquisition projects are complex and the process maturity on the acquirer’s side is often very low, such projects are risky. Using risk management as a driver for the software acquisition process means quality assurance activities must focus on the most critical aspects. Risk management has been found to be an excellent mechanism for that purpose if it is carried out systematically and continuously. As organizational aspects are particularly crucial in complex software acquisition projects, the focus of this article lies on project and risk management organization and organizational risks. Also, experiences regarding risk management in general are discussed.

Key words: business process reengineering, critical success factor model, ERP (enterprise resource planning) system, project goal description, project quality management, roles in risk management

by Gerhard Getto, DaimlerChrysler AG

INTRODUCTION

Car manufacturers face a variety of challenges, such as worldwide competition, globalization, and new products and markets. There is a need for change in organization, business processes, information technology, and supporting software systems. Business processes have to be optimized to reduce product development time, shorten customer order lead time, and reduce manufacturing lead time. This allows changes to be made to customer orders at short notice, speeds up the confirmation of delivery date with sign-up of the order, and reduces costs. The main objective for information technology is to provide cost-efficient solutions that support future processes. Complex software acquisition projects are initiated to eliminate redundant software applications and databases, migrate to state-of-the-art hardware and software platforms, and make use of best-practice software solutions.

Software acquisition is a critical concern for businesses all over the world since the impact of software on business processes is increasing tremendously. U.S. enterprises alone spend more than $250 billion per year acquiring software products and services. There is a risk of failure in every acquisition project. Many of the mistakes that cause acquired software not to meet performance, schedule, and cost requirements include process-specific issues such as unrealistic time estimates, costs and manpower requirements, or suppliers and/or buyers who do not have adequate technical expertise (Moreau 1998). There are a number of risks in software acquisition projects due to their complexity and the fact that the process maturity on the acquirer’s side is often much lower than on the supplier’s side.

The awareness of the necessity of a mature software acquisition process is quite new. For example, the Software Engineering Institute’s Software Acquisition Capability Maturity Model (SA-CMM) (Ferguson et al. 1996) was published in 1996, whereas the first version of CMM for software (Paulk et al. 1993) was available in 1984. The importance of risk management in software acquisition projects is illustrated by the fact that it is one of the key process areas of SA-CMM. The European Commission sponsored the development of a risk management-driven software acquisition method called Euromethod (1996) and a best-practice library for managing software acquisition processes (ISPL 1999), which takes advantage of the experiences of using Euromethod in a range of acquisitions. An evaluation of existing software acquisition approaches can be found in (Getto 1999).

This article presents experiences gained in establishing quality and risk management at DaimlerChrysler AG along these lines of thought. As organizational aspects are particularly crucial in complex software acquisition projects, the focus of this article lies on project and risk management organization and organizational risks. A methodological view of this risk management process can be found in (Getto and Landes 1999). A business process reengineering project currently under way at DaimlerChrysler is used as a sample project to back these arguments.