IBM Garage guidelines for Regulated Industries
By: Neal Bhattacharya
Tags: Cloud Transformation, Organizational Culture, Digital Transformation, Development, Regulatory Compliance

IBM Garage enables large enterprises to accelerate, breakthrough, and work more like startups.

A successful IBM Garage engagement starts with establishing clear strategic objectives that a garage squad will strive to achieve. If an IBM Garage is operating without regulatory constraints in a regulated business domain, a document of understanding (or waiver) needs to be in place to demonstrate that squad’s activities are exempt from underlying regulatory restrictions (e.g., operating in a sandbox).

Unless exempt or operating outside the controlled regulatory scope of the respective industry, IBM Garage implementation in regulated environments needs to have a strong focus on demonstrating the effectiveness, reliability, safety, and security of an MVP and traceability of its implementation to its requirements, applicable standards, and regulations by integrating strict quality assurance procedures during co-create, co-execute and co-operate stages (1).

In the first part of this series, I discussed various product development challenges in the regulated sectors from the perspective of software development and introduced the readers to IBM Garage Method.

In the second part, I reviewed the current trends in various regulated industries and how the IBM Garage Methodology could help organizations identify and prioritize innovation opportunities throughout the enterprise to take advantage of the industry trends.

In this third (and final) part of the series, I will review the IBM Garage implementation approach and our way of working in the regulated environments.

Figure 1: Realize innovative ideas at speed in an IBM Garage

Garage Implementation

The following six strategies are adopted in IBM Garages operating within regulatory constraints:

1. Establish accountability through governance — IBM Garage governance determines the segregation of duties and enables alignment of regulatory strategies to business objectives through business unit accountability owners. Product owner(s) work with the relevant business unit accountability owner and other stakeholders to align MVP features and squad activities with business goals, corporate guidelines, and regulatory strategy. IBM Garage governance manages funding, sets up squads, sanctions, and approves work performed in the IBM Garage. Hypotheses are validated and included in MVP(s) through planned cadence. A clear audit trail of the decision-making process, backlog, changes in requirements, and traceability to test results is maintained in a system of record.

2. Centralize compliance data and information — Having a centralized location for compliance data helps during regulatory reviews and responses. Various stages of audits may refer to an output from an earlier assessment cycle. At the outset, IBM Garage squads discuss and agree on secure storage of data, artifacts, deliverables in a centrally accessible configuration management system for authorized personnel. Industry standards and guidelines govern the retention of data and audit trails. Digital tooling choices may vary based on corporate policies and procedures to meet the applicable standards. Having a forward-looking data retention/archival strategy helps define the needs for data storage and architecture necessary to support incremental regulations like MiFID I and II, or to meet compliance mandates under regulations such as SEC Rule 17a-4.

3. Integrate quality measures in squad KPI(s) — Quality management is integrated into overall IBM Garage governance by connecting squad activities to quality assurance objectives through a documented repeatable process. IBM Garage uses a measurement framework to evaluate speed to value and organization change. This measurement framework tracks the IBM Garage squads’ tangible progress with each initiative and allows organizations to successfully measure how IBM Garage delivers business value and enables organizational change towards agility. In safety and security-critical domains, performance measures and statutory standards of effectiveness and reliability, as applicable, are also included in squad KPIs and linked to the outcome of the strategic objective(s) of the IBM Garage. Embracing a robust measurement framework in the organization addresses many challenges around proof of conformance and accountability during regulatory reviews.

4. Align IBM Garage activities to the regulatory milestones — IBM Garage iterations are generally one week in duration. All IBM Garage activities incrementally prepare towards final regulatory review and, therefore, the overall planning of IBM Garage initiatives considers milestones such as Quality Assurance (QA) reviews and regulatory submission dates in delivery plan(s). As QA reviews generally follow the language in the industry’s standard operating procedures that may not be similar to the ones commonly used in the IBM Garage jargon, it is always beneficial to create a cross-reference of the terms used in an IBM Garage to the relevant industry-specific terms ahead of the reviews. If there are potential gaps in the IBM Garage processes and activities to the industry standards, then tailoring specific functions and activities, as applicable, can address such gaps. IBM Garage Squad Leads may seek guidance from compliance analyst/subject matter expert (SME) associated with the squad to understand how to comply with the applicable standards and guidelines for a specific industry.

5. Implement safety and security controls — IBM Garage MVP architecture template includes standard security specifications considered in the initial stages of MVP planning and design. The product owner should document (in the product backlog) industry-specific security needs, applicable safety requirements, functional and non-functional requirements by following guidelines, processes, and applicable standards[1]. Design Thinking sessions during Co-Creation provide both business and user contexts to the functional requirements, further enhancing functional safety requirements. MVP(s) are built based on documented product backlog requirements using user-centric design to improve usability and adoption.

6. Verify and Validate[2] early and frequently — Rapid prototyping through co-creation and building production-ready MVP(s) through pair programming and test-driven development during co-execution enable businesses to start verification and validation cycles of the target product MVP early. The product owners and technical SMEs play a significant role in prioritizing backlog to ensure each iteration adds value to validation testing by focusing on functional and non-functional requirements. Incorporating compliance testing in MVP iterations allow for continuous feedback and opportunities to pivot if something goes wrong in an iteration or facts on the ground change. IBM Garage governance, specifically compliance and regulatory, may need to assess the adequacy of the frequency of these tests during product development cycles. Prototypes and MVPs with relevant metrics allow businesses to engage with the regulators to obtain their feedback during the initial stages of product development that often speed up final validations and approvals.

Governance

IBM Garage Operating Model includes three constructs — Enterprise, Interface, and Squads — to manage business engagement, program governance, product delivery, capability uplift, and organizational culture. IBM Garage Method promotes the culture of collaboration by introducing governance as the interface between the organization and autonomous squads.

The interface team defines the strategic objective(s) of an IBM Garage, captures them in an outcome-based value realization framework, aligns on what projects to pursue, and measures ongoing progress. For example, an IBM Garage initiative may pursue innovative design and research projects outside regulatory constraints within an organization; in contrast, another IBM Garage initiative in the same organization may operate within an air-gapped space in a controlled environment with compartmentalized information systems to iterate on a highly regulated product.

In regulated environments, the interface team may include dedicated roles from legal, compliance, and regulatory departments to engage them from the early stages of the product lifecycle (co-creation). This collaboration often leads to predictable delivery outcomes, among other benefits:

Having a senior leader from legal, compliance, and regulatory affairs help formulate hypotheses, align tactical decisions with practical regulatory strategy and anticipate risks based on known product concept(s).

Reducing bureaucratic barriers between compliance and project teams help facilitate frequent internal compliance reviews and approvals that may lead to accelerated approvals and fewer hurdles in securing final regulatory approval.

With involvement from business, IT, compliance, and regulatory representatives, business processes and procedures can be segregated from the other functions that need to be under compliance mandated controls allowing organizations to narrow down the scope of compliance.

Team collaboration with legal and regulatory leaders on the interface team can debunk the folk laws (2) and pave ways to innovation by formulating internal policies and guidelines.

Participation from compliance and regulatory affairs can improve collective understanding of the compliance burden by assessing where regulations are broad, narrow, or silent. Knowledge of the guardrails helps businesses choose between compliance innovation (staying within procedural safeguards of broad regulation) and circumventive innovation (escaping narrowly defined regulatory constraints) (3).

IBM Garage governance brings people together around a common set of objectives, promotes discussions about innovative ideas early in the concept stage to develop a product roadmap, integrates quality assurance with agility, and instills a quality culture.

Teams

Teaming in an IBM Garage is focused on collaboration across roles, trust, and the value placed on learning through experimentation. Teams in IBM Garages are autonomous squads that may vary in size, composition, and quantity depending on the squad goals and strategic objective(s).

An IBM Garage squad is a small, independent team generally comprised of the following roles:

A squad leader, who acts as an anchor developer and agile coach for the squad

2 to 4 development pairs who practice pair programming

User Experience Designer(s)

Architect(s)

Other role(s) and SME(s) as necessary

IBM Garage Squads can be co-located, distributed (at times globally), or a combination of both depending on the business and regulatory needs. Squad members are practitioners who have deep core expertise in a subject area combined with a broader working knowledge set and understand speed-to-value measures.

In regulated IBM Garages, Compliance Analyst(s), a special role, manage compliance objectives, and advise the squads. Representatives from the compliance and regulatory affairs department perform in this role. They help the squads by interpreting regulations and keeping implementation-level decisions consistent with corporate quality and regulatory goals. They also perform compliance assessments and tests as necessary to keep IBM Garage activities aligned with business objectives. Compliance testing is built in the iterative process and automated whenever possible beyond the controls of the developers. Many industries utilize independent software testing vendors to conduct this type of testing. The frequency and scope of these tests depend on the regulatory needs.

In some highly regulated environments, specifically in safety and security-critical domains, independent QA functions are introduced through 3rd party vendors who operate outside the immediate control of IBM Garage governance. Compliance analyst(s) work closely with the independent QA team(s) and support the QA process and provide objective audit evidence through relevant IBM Garage metrics.

Implementation of DevSecOps practices in highly regulated environments with air-gapped spaces and compartmentalized systems need special considerations (4). An assessment of the regulated environment is generally done during IBM Garage planning to identify specific segregation of duties and other necessary controls for regulatory compliance. This assessment influences various aspects of governance, teaming, and information exchange among squads in the respective IBM Garage(s).

Way of Working

IBM Garage was built for disruption. Developing hypotheses and validating them through experiments against quality objectives, such as metrics, throughout the evolution of a product or a service is the way of working in an IBM Garage. The IBM Garage Method seeks a balance between Big Design Up Front, where extensive design documentation precedes the code, and No Design Up Front, where developers receive little guidance on the parameters to work within. IBM Garage utilizes various practices from Enterprise Design Thinking[3], Lean Startup, Agile methods like Extreme Programming[4], and DevSecOps to iteratively develop MVP(s) based on just enough known requirements, user experience, and minimal viable architecture while addressing various compliance needs.

Agile approach

IBM Garage Squads implement epics, groups of related user stories that describe higher levels of system functions. A rank-ordered backlog consists of the user stories that define an epic. The product owner keeps the backlog up to date always and reprioritizes stories daily, as applicable, in a system of record. Squads hold regular weekly playbacks with the relevant stakeholders to gather feedback and to stay on track. Weekly playbacks and retrospectives improve squad performance and overall success of an IBM Garage.

Data and Documentation Strategy

In regulated environments, IBM Garage squads document proof of governance, traceability, and quality assurance to meet compliance requirements. The IBM Garage Method emphasizes data and documentation strategy from the early stages of product evolution. The compliance analyst/SME provides specific guidance on applicable compliance mandate(s) and what constitutes as evidentiary proof of quality objectives for a particular initiative.

Design Thinking

IBM Garage Method augments agile practices with design thinking to introduce empathy in software design by placing the user in the center of all design decisions. Regulated industries can benefit from employing a user-centric approach in building digital products to improve safety and usability by adding a human-centered perspective to the technical artifacts (5) covering functional and non-functional requirements. Design thinking, a human-centered approach, has the potential also to add value to Human Factor Engineering (HFE), widely used in the medical devices industry, by incorporating the subjective components of usability[5].

Pair programming and Test-Driven Development

IBM Garage development squads often use pair programming [6]and test-driven development to build and test code. When two developers write all the code, it undergoes continuous code inspection, making it possible to reduce errors, meet recommended standards, and align with code conventions (6). Test-driven development, which has roots in extreme programming, confirms whether code is working as expected for behavior by building code and test cases together iteratively one use case at a time[7].

Conclusion

The adoption of emerging technologies will continue to increase in every industry. Both market entrants and industry incumbents will strive to find ways to improve time to market, reduce operating expenses, and bring better value to their consumers through better adoption of these technologies in their products and services. Regulators will increasingly adopt agile and collaborative approaches towards regulations to understand these new technologies and their impact on the regulated markets. Technological innovation in regulated sectors will continue to prompt updates to the existing statutes or introduce new ones. The IBM Garage Method can help regulated businesses find a balance between regulation and innovation, adopt change as a culture, improve communication with the regulators, and break down unnecessary barriers of inherent complex organizational structures of regulated entities.

Next…

This series is IBM’s first study on utilizing IBM Garage Method in regulated industries. IBM will produce additional articles on this topic in the future.