The Capability Maturity Model (CMM) Improving Business Operations

Our use of CMM assures our customers and shareholders that we can reliably deliver the results that they want.

Any executive or manager will benefit from understanding the ideas of capability and maturity, and applying them to his or her department or business. Even if not seeking formal CMM certification, a leader can improve team success with these ideas. And, if CMM certification is appropriate, these ideas are essential. Implementing CMM without understanding its underlying principles is a recipe for disaster.

The swimming events in this summer's 2012 Olympics in London illustrate the importance of capability. Ability is what we can do, once, in the best circumstances. Capability is what we can do reliably, over and over. Capability gets us through the trials and into the Olympics. Ability sets world records and wins gold medals. Michael Phelps, who won a world-record 8 gold medals in Beijing in 2008, won 4 golds in 2012. Clearly, he has the ability to win Olympic gold medals in swimming, and the capability of doing it more than anyone ever has. But does he have the reliable capability of winning a medal in every race he enters? No, of course not, and no one does. He placed 4th in the 400-meter individual medley. Now, being 4th in the world is pretty amazing. For Phelps, it was a poor showing. Capability - the steady, mature ability to produce repeatable results - gets you into the Olympics. Capability sets the stage for record-breaking ability. When we can consistently do good work, we sometimes do excellent work. When we are consistently excellent, we sometimes achieve greatness.

The Capability Maturity Model is about how organizations can achieve excellence, and sometimes, greatness. Or, to start at an easier, lower level, it shows us how to achieves good work and occasionally do excellent work. The concepts of capability and maturity are universal, applying to all people and groups of people. The CMM and CMMI implementations focuses on corporate success, especially in software development and manufacturing.

If you want to succeed, or lead your team to success, understanding the Capability Maturity Model and growing up through the five stages of maturity is a sure-fire part of your success program.

A model is an ideal plan or pattern. Comparing what we are doing and what we want to do to a model helps us plan a course of action to get us from where we are to where we want to be.

Capability is consistent, reliable ability. Suppose you want to hire a team to create software for your company. How useful is it if they've created software like this one time before? Ten times? Ten times, successfully, meeting all requirements and delivering on time? Ten times out of ten? Or ten times out of 100? If the team has done it once before, they have shown the ability to do it. But if they've done it ten times out of 100, then they only have a 10% success rate. If they've done it ten times out of ten, then they have a 100% success rate, and the proven ability to do what you want. That's the team to hire.

Maturity implies growth and levels. Physically and mentally, children mature into adults. We don't expect a child to walk before he or she is 8 months old. Piaget demonstrated that children are not self-reflective before age 8 - that is, they can't reflect on their own actions and think about what they do and the consequences. Knowing normal levels of maturity, we can support the healthy growth of our children without expecting either too much, or too little.

Corporations, departments, and teams have levels of maturity as well. Maturity is about consistency. A 10-month old toddler may stand and take a few steps, but we don't expect him to always be able to do it. But if a 3-year-old can't get up, walk around, fall down occasionally, and get up again, something is wrong. And older boys and girls, all the way up to adulthood. don't fall down without a reason.

But our teams fall down all the time. Every time a deadline is missed, that's a fall. Every time a project result is not delivered to specification, that's a fall. Every time the customer is not satisfied with the result, that's a fall. In fact, we've come to expect and accept falling down and failure as a part of doing business. We've set a low standard - we expect immaturity and lack of reliable capability, and make excuses for it. This fact was first addressed by quality guru Philip Crosby in the 1960s. His Quality Management Maturity Grid was the nucleus on which the Capability Maturity Model (CMM) and it's newer implementation, the Capability Maturity Model, Integrated (CMMI), were built. To learn more about this history, read The History and Purpose of the Capability Maturity Model.

CMM gives us a model of the levels of maturity of the capability of an organization to produce reliable results. Using the CMM model, we can determine our current level of capability. More than that, we can chart a course upward through the 5 stages of maturity to a level of excellence that places us above all competition. Or, if we don't want to shoot that high, we can go for enough reliability to stay in business. It's up to us. But two things are sure: In the path to success, we can't skip any steps. And if we don't follow the model, we're not likely to improve. In fact, implementing changes without a model is likely to make things worse, not better.

To lead our businesses, we need to step back from the day-to-day. We need to stop putting out fires and learn how to prevent them.

Leadership begins with assessment. It's not about blame, about who did what wrong. And it's not about praise: what hero saved the company. It's just an honest, non-judgmental look at where we are and where we want to go. If you are having trouble understanding the five maturity levels, it is likely that you are judging, rather than assessing. Once you drop judgment, you can assess and lead improvement. And that's a powerful thing to do: Gordon Bethune took that approach, and turned around Continental Airlines from worst to first. He prevented bankruptcy and brought the company from being the worst airline to being the best, in under a year. And then he took it on up to spectacular financial success.

Both CMM and CMMI work with a map of five levels of maturity. They are sequential. You can only move up one step at a time. Of course, without management, you can fall down the entire flight of stairs all at once. The five levels are:

1. Initial: Chaotic, ad-hoc, folkloric, heroic. This is the ordinary operating level of most companies, groups, and departments.
2. Repeatable: Processes are defined well enough that they can be repeated. But there is no coordination across departments.
3. Defined: Consistent processes are defined for the whole company. Standard Operating Procedures are in place, and people can use them and learn from them.
4. Managed: Processes are kept up-to-date. If a process is improved, everyone gets a copy of the new process.
5. Optimizing: Processes are being improved in a reliable way. Work is being done to measure the results of defined processes, and improve on these measurements.

Before we look at each of these levels in detail, let's return to our analogy of swimming. Athletic activity is a good model for understanding capability and ability.

1. Initially, kids play in a pool. Some swim and some race. No one is keeping score.
2. Repeatable: At summer camp or in gym, kids practice and improve their swimming. There are some races, and winners are rewarded. Those who like swimming keep swimming. That is, they repeat.
3. Defined: Competitive swimming is being taught, and everyone learns ways to get better. But there is no comparison of the methods of one camp or school to another. Member of a swim team have to follow rules, but there is no way to know if those rules really help with success.
4. Managed: Camps, schools, colleges, and athletic facilities that want to train champion athletes develop better sets of rules. They think about rules and methods, and try to improve them.
5. Optimizing: The best universities and Olympic-level training facilities benchmark themselves against their competitors, learn competitive methods, and test rules and methods to see if they improve swimming times. Methods that make faster swimmers are adopted and maintained, producing the best swimmers and award-winning results. These places can be called Centers of Excellence.

Before we go further, take a moment to rate your own department or company. How well does it shape up? If you don't know, you are at level 1. How far do you want to take your company? If you choose not to go for the top, how will you stay in business when your competitors do better? (That's a real question: There is a lot of room in the world for companies that are not quite as good, but also not quite as expensive, as the best in their field.) And, if you choose to shoot for excellence, how can you make it affordable?

Various terms are used to describe the initial level of maturity, which is often not recognized. At this level, procedures are not recognized. So how is work getting done, and how do people learn to do their jobs? The answers to these questions explain the meanings of the terms we see:

• Work is chaotic. When someone is given a job, they do it. Give it to someone else, and they'll do it differently.
• Learning is ad-hoc. If someone doesn't know how to do a job, they do it any way they can, or learn from someone else, or go take a course. This is handled on an as-needed basis.
• People learn a job in the way that folklore is passed on, from one person to another. You ask someone, "How did you learn to do things the way you do them?" The answer is, "Dave taught me." "Who's Dave?" "He used to work here. Everybody says he was good." "How do you know he was really good?" "I don't know. He's gone now. There's no way to tell.
• As a result of all of this, much work is done poorly, or not at all. The occasional successes that are achieved are created by single people who are really good, or teams that are really good. These are heroes to the company. The focus is on what they can do, but not on taking what they can do and making it into repeatable procedures.

As you can see, a company operating at the initial level cannot reliably deliver results. They probably succeed sometimes - after all, they're still in business. But they don't know how they do it, and a customer can't count on them doing it well the next time.

At CMMI Level 2, each department has a book of Standard Operating Procedures (SOP). If someone hasn't done a particular job in a while, he or she can open the book, turn to the procedure, and follow the steps. If a new employee comes on board, they don't need to find Dave and ask how to do their job: The answer is in the book.

That doesn't mean that the answer is right. Oh, it probably works. But there may be no evidence that it is the best way to do the job. It may be out of date. And repeatable doesn't mean that it is repeated. Perhaps some people on the team follow the procedure, but others do not.

Also, each department has its own SOP book. But with the number of mergers and acquisitions these days, it's highly likely that two departments are doing the same work in different ways. Maybe one even succeeds much more than the other. But there is no channel of communications for sharing better ways of working.

At Level 2, we can repeat our performance, and sometimes we do. But we can't improve on it, at least, not reliably.

Each level builds on the level below it. A company must reach Level 2 and have repeatable written procedures before it can try for Level 3. Level 3 adds two elements not present in Level 2:

• Standardization. The same procedures are used across the company. If two or more departments do the same work (say, hiring sub-contractors), they both use the same methods to select those sub-contractors and put them under contract.
• Checklists. A historical record is kept showing that a particular worker did, in fact, follow a particular procedure at a particular time. An audit would be able to define the fact that the right procedure was used on each particular job.

CMM Level 3 provides a vendor and its clients evidence that the vendor will do good work. The client can know, "This is what they did last time, and it worked, adn they'll do it again on this project." Even though the work is unique, as every project is, reliable methods are likely to lead to consistent success.

The US military and the government of China now generally require that all contractors can demonstrate that they have reached CMM or CMMI Level 3. The US Military requires this of sub-contractors, as well.

Companies operating at CMM or CMMI Level 3 generally do well. But they are more likely to be reliable sub-contractors than major contractors, leaders, or innovation. Leadership in an industry requires managing the improvement of procedures, not just the use of procedures. At CMM Level 3, there is little reason for any employee to find a better way of building a mousetrap. The management system encourages people simply to demonstrate that they are using the prescribed mousetrap.

CMM Level 4 begins to change that. Procedures and their results are defined well enough that an improvement can be validated. Say, for example, programmers follow a certain procedure to estimate the time and cost for their projects. The company has a procedure for this. But one employee does some research and says, "I think I've found a better estimation method." He gets approval to try it out. Maybe he even does it the standard way and the new way. After the project is over, the two results are compared. If his method produced more accurate estimates, it is adopted as the new procedure. It replaces the old one, and every department learns his new method. He receive praise and appreciation, and maybe a bonus, as well.

And estimation is just an example. Every procedure is managed for improvement. Any new procedure that reduces errors and defects; saves time by being faster; saves money by costing less or using fewer materials; or is easier to learn, understand, and use replaces older procedures. Everyone is learning better ways to do things, and is encouraged to come up with better procedures, as well.

Companies operating at CMM or CMMI Level 4 are industry leaders. But they are not at the very top of the ladder. CMM Level 4 ensures that a company is getting better. But what can ensure that a company is doing its best? That calls for CMM Level 5, Optimizing.

For nine years, the Stanford swim team was ranked #2 in its region. Working with nutrition pioneer Dr. Barry Sears and the Zone diet, they shifted to #1. They made the change in a single year and maintained it for more than five years after that. And the only change they made was to the swimmers diet.

This is an example of how CMM Level 5 organizations work. (No, I'm not saying the Stanford swim team was appraised at CMM Level 5!) But the team's rules and methods were so clear, and followed so well, that they could be confident that nothing was changing except what they chose to change. That way, when a change was implemented, they could be confident that a particular change was the cause of the new result. If the result was better, then the change was to a better procedure.

This level of improvement requires strictness. In this case, team members caught breaking their diet a second time were thrown off the team.

This clarity, precision, and strictness has benefits. Not only did Stanford become the #1 swim team, but the research was sufficiently rigorous to be published in scientific journals. The teams methods and the Zone diet were validated at the same time.

At CMM or CMMI Level 4, procedures and their results are very well defined, and, to some extent, measured. CMM or CMMI Level 5 pushes measurement to its limits. The exact results of procedures are measured after each project and tracked historically. This data is analyzed, both in common-sense post-project reviews and statistically, to find and fix errors in procedure and prevent or eliminate future defects.

CMMI Level 5 is associated with other best practices in Quality Management, such as Six Sigma and the Japanese Gemba Kaizen for JIT, which is the best practice for continuous improvement. At this level, for example, an improvement of a production line method that reduces time of production by 1/100th of a minute (0.6 seconds) is worth adopting. That one change is probably not worth the cost of updating the SOP manual. But constantly making changes like that turns a company into a Center for Excellence that is creating Best Practices.

A best practice is, quite simply, the best known way, worldwide, to do a particular task. When your company is doing a best practice, you are ahead of the competition. At CMM Level 5, you stay ahead of the competition by improving your own practices before your competitors catch up.

This article is written primarily to leave you inspired, and with a better understanding of the Capability Maturity Model. Thinking about your organization within this model is one way to develop leadership, team cohesiveness, and greater long-term success that will benefit the bottom line.

CMM and CMMI are major investments. Most companies that go on this path do so because their vendors - such as the US Military - require it. Companies that do follow this path are then appraised, and can publish the results of the appraisal if they wish to. Because corporate structure and culture change with mergers, acquisitions, and changes of leadership, even a recent appraisal is not a guarantee of performance. Just like a champion athlete can have an injury or family problem and lose a season, a highly capable company can have changes of team or management that will lead to failure on the next project. But the willingness to go for certification and be appraised is a sign of an effort - and some success - in the right direction.

If CMM or CMMI is implemented only for the purpose of getting a good appraisal and meeting vendor requirements, the company is likely to be worse off than when it started. Efforts at changing corporate culture that are not led from the top and applied deeply and completely lead to fragmentation and internal hostility. To learn more, read Business Success: Maturity & Capability, or Negative Synergy.

I encourage you to think about and make use of what you have learned. Any company, no matter how small, and no matter what industry it is in, can improve by taking it's own maturity and capability seriously. Developing mature capability means, quite simply, being able to consistently satisfy and delight customers. That leads to many good things: ensuring customer retention, lowering cost of sales, lowering project and development costs; improving compliance at lower cost.

CMM was developed to ensure success of software contracts for the US military, and NASA was a big part of the process. I used to play with those guys, and the history and original purpose of CMM is worth knowing. These days, I prefer to work with small businesses, even as small as one person or a team up to 10 or 20. Such companies can improve rapidly and achieve excellence. We can take the best practices of the think tanks like SEI and the aerospace companies where life is on the line, and use them to blast off to our own success. Let's make use of the ideas from the best of the best. Whether you are even considering CMM or CMMI appraisal or not, you can learn to succeed from the best companies in the world.