1. ©2004 - Sogeti Nederland B.V. Beware … The Controller is coming IT-Governance per unit? Ton Dekkers UKSMA October 2005, London

2. ©2005 - Sogeti Nederland B.V., Sizing Estimating & Control 2 Return on Investment PROCESS output input investment activities requirements return € € €

3. ©2005 - Sogeti Nederland B.V., Sizing Estimating & Control 3 Business Case BenefitCost Cost Reduction Revenue up Effort [Size] Cost [Size] Performance New business Knowledge … Duration Software Risk

4. ©2005 - Sogeti Nederland B.V., Sizing Estimating & Control 4 The Good News? From the Standish report of 2003: Only 34% of software projects are successful 66% ended up in varying degrees of trouble – 15% of projects are terminated – 85% average over-run

5. ©2005 - Sogeti Nederland B.V., Sizing Estimating & Control 5 Corporate Governance is a process, effected by an entity’s board of directors, management and others, applied in strategy setting and across the enterprise, designed to identify potential events that may affect the entity, and manage risks to be within its risk appetite, to provide reasonable assurance regarding the achievement of the objectives. Corporate Governance

6. ©2005 - Sogeti Nederland B.V., Sizing Estimating & Control 6 What Can Go Wrong? © Ton Dekkers, 2004

7. ©2005 - Sogeti Nederland B.V., Sizing Estimating & Control 7 A structure of relationships and processes to direct and control the enterprise in order to achieve the enterprise’s goals by adding value while balancing risk versus return over IT and its processes. IT Governance Information Systems Audit and Control Association (ISACA) IT-Governance Institute Gartner …

8. ©2005 - Sogeti Nederland B.V., Sizing Estimating & Control 8 CobiT © Control Objectives for Information and related Technology business risks <> control needs <> technical issues Guidance for: Managementrisks, budget Userssecurity, control of “functionality” Auditorsinternal control, opinion / advise

9. ©2005 - Sogeti Nederland B.V., Sizing Estimating & Control 9 Control Objectives Relation to peer group Future position (Goals) Key Goal Indicators Key Performance Indicators Goal Question Metrics (GQM) Functional Size Measurement

10. ©2005 - Sogeti Nederland B.V., Sizing Estimating & Control 10 CobiT © Framework

11. ©2005 - Sogeti Nederland B.V., Sizing Estimating & Control 11 CobiT © Framework (detail) √√ software provision

12. ©2005 - Sogeti Nederland B.V., Sizing Estimating & Control 12 Supported processes NMNM primary supportsecondary support P05manage investment√√PO09assess risks√√ P10manage projects√√P011manage quality√√ AI02acquire and maintain√√DS01manage service levels√√ AI06manage changes√√M02assess internal control√√ DS02manage third-party√√M04provide for audit√√ DS03manage performance√√ DS06identify costs√√ M01monitor process√√

13. ©2005 - Sogeti Nederland B.V., Sizing Estimating & Control 13 Input – Process - Output costs effort material activitiesproduct =price per unitxunits process output input

14. ©2005 - Sogeti Nederland B.V., Sizing Estimating & Control 14 Metric“formula” Project Delivery Rate(actual) effort / size Speed of Deliverysize / (actual) elapsed time Defect Densitynumber of defects (period) / size Reliabilityhours fixing (period) / size Price Performancecosts / size (Goal – Question) - Metric

15. ©2005 - Sogeti Nederland B.V., Sizing Estimating & Control 15 Hours (& money) The Measurement Model size (risk) analysis pdr basic hours influences +/- measures Risks/ opportunities consequences exp internal external

16. ©2005 - Sogeti Nederland B.V., Sizing Estimating & Control 16 Risk Analysis / Mitigation Platform Tools Experience Time pressure Team Size “Complexity” “State of the Art” …

17. ©2005 - Sogeti Nederland B.V., Sizing Estimating & Control 17 ISO 14143 (1) Functional Size Measurement The process of measuring Functional Size Functional Size A size of the software derived by quantifying the Functional User Requirements Functional Size Measurement Method A specific implementation of FSM defined by a set of rules, which conforms to the mandatory features of ISO/IEC 14143 - part 1: A measure of the amount of information processing required to be carried out by the software [‘what’ the user wants the software to do, not ‘how’] and excludes the influence of technical and quality requirements (ISO/IEC 9126).

18. ©2005 - Sogeti Nederland B.V., Sizing Estimating & Control 18 ISO 14143 (2) Functional User Requirements The representation of the ‘practices’ and ‘procedures’ the software must support to fulfill user’s needs Base Functional Component A defined category of elementary units recognized in FUR’s defined and used by a FSM for measurement purposes

19. ©2005 - Sogeti Nederland B.V., Sizing Estimating & Control 19 Certified Methods Function Points Analysis - IFPUG ISO 20926 Counting Practices Manual 4.2 (January 2004) Function Points Analysis - NESMA ISO 24570 Counting Practices Manual 2.2 (November 2003) Mark II Function Points ISO 20968 Counting Practices Manual 1.3.1 (September 1998) COSMIC Full Function Points ISO 19761 Measurement Manual 2.2 (January 2003)

20. ©2005 - Sogeti Nederland B.V., Sizing Estimating & Control 20 Function Point Analysis Transactions User ei eo eq eif ilf Data

21. ©2005 - Sogeti Nederland B.V., Sizing Estimating & Control 21 FPA: Rating (values) Function points (fp) per component: ILF7, 10 or 15 fp EIF5, 7 or 10 fp EI3, 4 or 6 fp EO4, 5 or 7 fp EQ3, 4 or 6 fp Complexity types:Low, Average, High FTR DET 1-5 6-19 >19 0-1 L(4) L(4) A(5) 2-3 L(4) A(5) H(7) >3 A(5) H(7) H

22. ©2005 - Sogeti Nederland B.V., Sizing Estimating & Control 22 FPA: counting example Transaction Type FTR DET Complexity Score External Output employee, department d-name, e-name, e-dayofbirth Low 4 fp Functional Process Print birthday list (sorted by department) Request HRM

23. ©2005 - Sogeti Nederland B.V., Sizing Estimating & Control 23 Transactions User transient persistent functional process ew xr COSMIC Full Function Points Data

24. ©2005 - Sogeti Nederland B.V., Sizing Estimating & Control 24 CFFP: Rating (values) All of the components are rated based upon: existence of (single) data groups Scores per component: Entry1 cfsu eXit1 cfsu Read1 cfsu Write1 cfsu cfsucosmic functional size unit

25. ©2005 - Sogeti Nederland B.V., Sizing Estimating & Control 25 CFFP: counting example Data Group employee department Data Movements Read Exit Exit Score Data Elements e-name, e-dayofbirth d-name employee [e-name, e-dayofbirth] department [d-name] employee [e-name, e-dayofbirth] department [d-name] messages 5 cfsu Functional Process Print birthday list (sorted by department) Request HRM

26. ©2005 - Sogeti Nederland B.V., Sizing Estimating & Control 26 Scope Management Fixed costs rather than fixed price Budget control: Price per unit Requirements (Functionality): expressed in units Priority: Units versus budget (in units) Scope creep: Scope {Manager / Surveyor / Consultant} CobiT: PO05, PO10, AI02, AI06, DS02, DS03, DS06, M01 SouthernSCOPE, Evolutionary Project Management

27. ©2005 - Sogeti Nederland B.V., Sizing Estimating & Control 27 Service Level Agreement Price agreements on service Service: some expressed in units or units related Budget: price per units (per service) Supplier selection: based on performance CobiT: PO05, PO10, AI02, AI06, DS03, DS06, DS09, DS01

28. ©2005 - Sogeti Nederland B.V., Sizing Estimating & Control 28 Outsourcing - Situation Relation Customer (Utility Company)  Supplier (Computer Services) Activities System support (enhancement / help desk) Object of interest Contract (SLA)

29. ©2005 - Sogeti Nederland B.V., Sizing Estimating & Control 29 Outsourcing - Benefits Controllability Size  Prioritizing Value for money Productivity: transparent, consistent Costs Maintenance costs  10% (Customer) Satisfaction  (Budget  Functionality  Delivery) CobiT: PO05, PO10, AI02, AI06, DS02, DS06, PO09, DS01

30. ©2005 - Sogeti Nederland B.V., Sizing Estimating & Control 30 Sizing, Estimating & Control Managed Delivery Bid mgt Contract mgt Project Office SEC Estimating & Performance measurement ‘E-street’ Developm. Center(s) Global Sourcing

31. ©2005 - Sogeti Nederland B.V., Sizing Estimating & Control 31 SIESTA 1.2 SIESTA (SIzing and ESTimating Application) Current: version 1.2.2 ‘Freeware’: part of services / promotion Multi-lingual: - Dutch - English - German - French - Italian - Spanish Supports most ISO 14143 based methods

32. ©2005 - Sogeti Nederland B.V., Sizing Estimating & Control 32 Conclusions Quantitative Project Management ≠ IT Governance Performance Measurement ≠ IT Governance CobiT ® is a framework for IT Governance Performance Measurement supports CobiT  IT Governance requires Performance Measurement The Controller will demand Performance Measurement

33. ©2005 - Sogeti Nederland B.V., Sizing Estimating & Control 33 Q & A Questions !!! & Answers ??? Q & A ton.dekkers@sogeti.nlton.dekkers@sogeti.nl # www.sogeti.nl/sec-ukwww.sogeti.nl/sec-uk Thank you for your attention