Regulated software development challenges
By: Neal Bhattacharya
Tags: Design Thinking, Digital Transformation, Regulation, IBM, Innovation

IBM Garage enables large enterprises to accelerate, break through and work more like startups.

Achieving a balance between compliance and time-to-market is critical for businesses to sustain and thrive in the regulated sectors. In regulated industries, the most crucial success factors are product safety, security, effectiveness, and reliability to meet regulatory standards and guidelines. Increasing the profitability of the products and services while meeting regulatory compliance is a constant challenge for industry incumbents. Market entrants need to sustain while waiting for regulatory approval to operate in the industry.

In this three-part blog, I will review various product development challenges in the regulated sectors from the perspective of software development against the backdrop of the current trends in the industries influenced by technology and regulatory forces. I will also examine how IBM Garage Method can help businesses address their existing challenges while driving innovation in the regulated sectors.

In the first part of this blog, I will discuss the challenges and introduce the readers to IBM Garage Method.

The Challenges

Regulated products need to demonstrate the desired level of effectiveness, safety and security, reliability, and traceability through rigorous quality assurance procedures(1) to achieve regulatory compliance. Businesses allocate a significant amount of their budget to demonstrate compliance because non-compliance can have severe consequences such as reputational risks, fines, and legal actions.

The following four areas often pose challenges in regulated product development.

1. Compliance Requirements

Interpretation of legal texts in regulations and related legislations plays the most significant role in defining compliance requirements for regulated products. Compliance requirements often imply, but do not specify, some software product capabilities (2). New or updated regulation(s) can impact several business processes and redefine how incumbents operate. Some laws may lack sufficient details[1] to guide compliance efforts. Even when laws are clear, it may still be challenging to build a comprehensive list of compliance requirements as regulations may impact different organizational divisions in different ways. When multiple departments within an organization try to address regulatory needs in their silos, it further exacerbates the problem.

2. Proof of Conformance

Regulated product development needs to follow specific standards, directives, and guidance to meet regulatory compliance, assessed by the auditors who follow specific standard operating procedures based on the guidelines of underlying regulation(s). Periodic regulatory reviews and approvals are common for regulated products. Success in these reviews depends primarily on the quality of data, evidence, and documentation to demonstrate conformance with the applicable standards. Businesses may also need to preserve and produce artifacts from various stages of the product lifecycle, business processes, changelog, organizational structure, and other information relevant to the industry during regulatory reviews.

3. Accountability

Regulatory compliance often requires that someone is accountable for approving the changes introduced in a product or a process through strict segregation of duties and auditable enforcement of the change control process. Safety and security-critical products and services often require managing compartmentalized information that creates knowledge and process silos intentionally within the organization. Large organizations may also need to navigate inherent complex bureaucracies to comply with the requirements that various departments may need to implement to ensure compliance.

4. Old Standards, New Changes

Many regulatory standards are not prescriptive and do not mandate the use of a specific software development methodology. However, they tend to favor process heavy (3) planned approaches based on following pre-determined steps to achieve the desired outcome(s). Regulated Product development often uses plan-driven V-model and Waterfall development approaches, but they are not well suited to accommodate changes[2] during software development and often lead to rework and delays. Product development cycles usually need to accommodate emergent requirements and other changes. To build digital products and other software, regulated organizations can benefit from adopting Plan-Do-Check-Act (PDCA) build cycles used in Agile methods (1). However, Agile adoption has been slow in these industries because of complex organizational dynamics and legacy governance.

Need for a Development Framework

Instead of taking a holistic approach to tackling these challenges, businesses often address them individually within existing organizational silos by utilizing flavors of various known methods and technologies that result in further complexities to adopt, sustain, and scale these novel approaches in the product development organizations. Businesses can benefit from adopting a framework that focuses on their consumer(s) and builds on the proven industry practices to promote organizational agility and quality culture, provides a mechanism for pursuing innovation and achieving compliance, implements collaborative governance to break down organizational silos, and improves technology adoption and scaling of products and services.

IBM Garage Method provides a framework that a regulated enterprise can adopt to create, test, validate, and scale new ideas into operations. A documented lifecycle approach helps improve the products and services iteratively[3] from idea to production, production to learning, and learning to improvement. With a strong focus on user-centric design, utilizing the best practices of lean startup, extreme programming, design thinking, and iterative development, the IBM Garage methodology can help regulated entities improve their products and services by fostering a culture of innovation and collaboration in the enterprise.

IBM Garage Method in a nutshell

IBM Garage Method(4) is a bold, comprehensive approach to innovation and transformation that quickly creates, validates, and scales new ideas that an organization wants to implement. It is a prescriptive framework, based on the industry best practices and IBM experience® in the cloud and digital transformation, that guides product lifecycle through three distinct inter-connected phases:

In Co-Create, IBM Garage squad(s) define hypotheses for new business opportunities or gather new insights into existing ideas. IBM Garage practices are utilized to conduct in-depth user research, ideate, and develop minimal business cases, assess and rank ideas to determine what becomes a minimum viable product (MVP). In Co-Execute, IBM Garage squad(s) iteratively develop MVP(s) based on the validated ideas by taking a minimalistic cost-effective approach using just enough architecture, user experience while adequately addressing safety and security needs. In Co-Operate, IBM Garage Squad(s) scale proven MVP(s) to build resilient enterprise-grade applications using the latest cloud technologies to reach the target market and increase market growth by accelerating adoption using the practices included in the method.

Figure 1: Garage Method for Cloud

IBM Garage extensively explores consumer benefits and business needs and validates product viability with working prototypes before building a minimum viable product through weekly iterations. IBM Garage Method uses the best industry practices, such as design thinking, pair programming, and test-driven development. Design Thinking sessions provide additional business and user contexts to the functional requirements and add clarity for operational safety and security needs. Test-Driven Development and pair programming enable enterprises to start early verification and validation of the target product MVP and scale them into operation. All these techniques together provide better means to manage compliance requirements and establish proof of conformance.

Once the product owner approves the MVP(s) for launch as a limited release, they are iteratively enhanced and hardened based on the feedback received from the end-users and other relevant stakeholders. Once an MVP is approved for general release, it is scaled to grow with the target market as shown in Figure 2. Iterative product development using garages allows organizations to address regulatory changes efficiently and manage other impacts from emergent requirements.

Figure 2: Garage Lifecycle

IBM Garage Method follows a value realization approach that shifts organizational dynamics from “Leaders decide what to do, and teams execute” to “Leaders decide where to go, and teams decide how to get there” (4). Garage squads are autonomous and structured to achieve desired outcomes through support from the Legal, Regulatory, Risk, and Compliance departments.

The IBM Garage methodology consists of themes, workflows, and practices to cover the entire product lifecycle from ideation to operations, including capturing and responding to feedback and market changes.

Themes serve as the entry points for businesses to utilize method elements most closely aligned with their business goals and provide prescriptive pathways for organizations to achieve their cloud transformation goals. Garage Themes are Advise, Build, Move, and Manage.

serve as the entry points for businesses to utilize method elements most closely aligned with their business goals and provide prescriptive pathways for organizations to achieve their cloud transformation goals. Garage Themes are Advise, Build, Move, and Manage. Each Workflow consists of steps to achieve an outcome; each step is an ordered set of activities supported by Garage Practices.

consists of steps to achieve an outcome; each step is an ordered set of activities supported by Garage Practices. There are seven IBM Garage Practices, namely, Culture, Discover, Envision, Develop, Reason, Operate, and Learn, as shown in Figure 3.

Figure 3: Garage Themes and Practices

Next ..

In the next part of this blog-series, I will review the current trends in various regulated industries that are reshaping the regulatory landscape and how IBM Garage themes, workflows, and practices can help organizations identify and prioritize innovation opportunities throughout the enterprise by careful evaluation of risks and uncertainties across horizons against their product roadmaps and industry trends.