CMMI Compliant Workflow Models to Track and Control Changes

The Capability Maturity Model Integration (CMMI) is a renowned Software Process Improvement (SPI) framework. Research studies have revealed that CMMI adoption needs a lot of resources in terms of training, funds, and professional workers. However, the software SMEs (SSMEs) have few resources and cannot adopt CMMI. One of the challenges of adopting CMMI is that CMMI tells “What to do?” as requirements to be met, and leaves “How to do?” to the implementers. The software industry especially SSMEs faces difficulties in successfully implementing various process areas (PAs) particularly Configuration Management Process Area (CM-PA). SG-2 (Track and control changes) is one of the important Specific Goals (SGs) required by CMMI to successfully implement CM-PA. As a starting point, we have achieved this SG by implementing its two contributing Specific Practices (SPs). The proposed WFMs were validated through an Expert Panel Review (EPR) process. In addition, a case study approach was used for the evaluation. The results showed that the models are useful, easy to use, supportive in the achievement of SG-2, and applicable to SSMEs. It is worth mentioning that this research work has not only contributed to the implementation studies but also added to the empirical software engineering body of knowledge.


Introduction
The success or failure of an organization depends on the quality of its products or services. Customers appreciate a reliable software product that operates un-erroneously and never crashes. One way to improve software quality is to improve software development processes. That's why many software development companies take interest in Software Process Improvement (SPI) programs. Continually improving the software process and regularly appraising its effectiveness will pave the way for the development of highquality software and help meet customer expectations. CMMI model facilitates the software development industry to take the quality of software processes to higher levels. However, no significant numbers of small and medium software enterprises (SSMEs) are adopting it. Xu et al. [1] have the opinion that CMMI offers software enterprises only guidelines and does not provide clear workflow models resulting into heavy cost of adoption. Few among the many definitions of SMEs are given in Tab. 1.
CMMI Level II [6] contains seven PAs, including CM-PA. Various studies have been carried out to implement PAs. However, no workflow model for implementing CM-PA to help SSME was found as shown in Tab. 2. Therefore, there is an urgent need to design workflow models for SPs of the CM-PA.
The focus of this research study is to achieve the second specific goal (SG-2) of CM-PA by designing workflow models (WFMs) for the implementation of two SPs (SP-2.1 & SP-2.2). To achieve research goals, the research questions are formulated and listed in Tab. 3.
The organization of this paper is to introduce related work in Part 2. The research methodology is explained in Part 3. Proposed WFMs are illustrated in part 4. Validation of the proposed models is provided in Part 5. Novelties and limitations of the proposed WFMs are presented in part 6. Conclusion and future work are highlighted in Part 7.   [13] 4 Supplier Agreement Management 2 Related Work A variety of related research was studied. However, keeping the concision in mind, only very close research i.e., WFMs devised for implementation of PAs at CMMI level-II is presented. To support SSMEs in implementing the best practices, Keshta et al. [7] designed WFMs for the two SPs of REQM-PA. The WFM for SP 1.1 includes five stages: "Request", "Understand", "Evaluate", "Accept", and "Finalize" whereas WFM for SP 1.2 includes five stages "Assess", "Report", "Negotiate", "Record", and "Commit". Keshta et al. [8] further designed WFMs for the other two SPs of REQM-PA. WFM for SP 1.3 has six stages "Initiate", "Validate", "Implement", "Verify", "Update", and "Release". Another six stages named "Request", "Maintain", "Validate", "Allocate", "Verify", and "Release" constitute the WFM for SP 1.4. The EPR process was used to validate the models against the specified criteria. The applicability of the models to SSMEs was evaluated in Saudi Arabian software industry. Bhatti et al. [9] proposed a six-phase methodology to deal with changing requirements: "Initiate", "Receipt", "Approve/ Disapprove", "Evaluate", "Implement", and "Configure" with CCB to act as process owner and play a central role. Tariq et al. [10] have recommended to include an additional SP in REQM-PA for Software as a Service and carried out validation through a case study. In the same way, Niazi et al. [11] designed the CMMI-Compliant Requirements Change Management (RCM) Model. The model is divided into five stages: "Request", "Validate", "Implement", "Verify" & "Update" and was evaluated through the EPR process. Similarly, Keshta [12] also designed a WFM for the implementation of SP 1.3 of PP-PA and defined phases for a project life cycle keeping in view the SSMEs. The model includes four stages: "Plan", "Design", "Review", and "Update/Rework". Keshta et al. [13] further developed WFMs for all SPs of PPQA from the perspective of small and medium software development organizations. Vivatanavorasin et al. [14] presented a three-layered WFM for SAM-PA which contains "Contextual", "Elaboration", and "Definition" layers. As a proof-of-concept prototype, a Supplier Agreement Management Tool was also developed. Iskandar et al. [15] suggested practices to improve tracking changes in software development including "Initiation", "Approval", "Scheduling", and "Deployment". The deployment, in turn, is achieved through sub-practices such as "Preparation", "Execution", "Validation", and "Completion/Reversion".
After a thorough literature review, it was concluded that there are currently no WFMs available for the implementation of the said goal. Therefore, to support SSMEs, there is an urgent need to design the same.

Research Methodology
It has always been believed that research methodology profoundly impacts the validity of research results, so it was very meticulously designed. The phases involved in designing WFMs are shown in Fig. 1.
The success of the research largely depends on the establishment of robust validation criteria. The criterion for validation of the WFMs in this study having similar nature has been derived from the work of Keshta et al. [7,8], Niazi et al. [11], Keshta et al. [12,13], and Vivatanavorasin et al. [14] as given in Tab. 4.

Proposed Workflow Models
The WFMs proposed for the aforementioned SPs are composed of core stages that logically group the activities involved in a particular SP. The proposed WFMs are constructed by employing the well-known Entry-Task-Verification-eXit (ETVX) model. For each WFM, the associated inputs-outputs, the potential artifacts, and actors are identified. Note that the actors are from a sample SSME.

Workflow Model for Overall CM-PA
To design an abstract WFM for CM-PA, in addition to other research materials, PMBOK 6th Edition, SWEBOK V3.0, CMMI 1.3, and ITIL were studied. The proposed WFM for the entire CM-PA is shown in Fig. 2. The scope of this work (SG-2) is shown in light green.

Proposed WFMs to Track and Control Changes (SG-2)
The second specific goal of CM-PA is to "track and control changes". Its purpose is to maintain the baseline established through SG-1. This is achieved by implementing two SPs, namely "Track Change Requests" and "Control Configuration Items".

Satisfaction of SPs
The proposed WFMs should address the practices to achieve SG 2 of CM-PA.

Satisfaction of Users
Models should satisfy users and help them achieve their needs and objectives. Ease of Learning & Use The model should be simple, easy to understand, and easy to adopt. Applicability of the models to SSMEs.
The WFMs should be implementable in SSMEs, that is, it should enable SSMEs to track and control changes.

Workflow Model to Track Change Requests
"Track change requests" is the first of two SPs contributing to SG-2. WFM for this SP has five stages, namely "Initiation", "Evaluation", "Implementation", "Updation" and "Closure" as illustrated in Fig. 3. In Tab. 5 accompanying process guide is shown. Tab. 6 lists the literature findings at each stage. For the sake of brevity, only three of the many references are provided.

Workflow Model to Control Configuration Items
The proposed WFM for this SP is divided into five stages: "Initiation", "Authorization", "Maintenance", "Review" and "Record" as illustrated in Fig. 4 followed by the pertinent process guide in Tab. 7 followed by supportive findings from literature in Tab. 8.

Validation through EPR
An expert panel review was conducted to verify the proposed WFMs, in which opinions on the model were obtained from 10 experts according to the specified criteria. The experts having expertise in the fields of SPI, Project Management, Configuration Management, and Software Development were consulted as shown in Tab. 9.        Iskandar has the opinion that every change fulfills business, the technical or external requirement(s). The author designed a process to improve tracking changes in software development. The author included the "Initiation" as the first stage of the process.

Bhatti's Change Management Methodology
In the "Initiation" stage of Bhatti's methodology, the request is initiated by a customer or any of the team members. Change Request(s) are the work products of his stage.

WFM for Change Management
The second stage of WFM designed by Keshta is "Validation", which determines the nature of the change, evaluates the change, and conducts an impact analysis. Then the change is validated, that is, it is rejected, batched for the future, or approved for implementation. In fact, "Evaluation" and "Validation" are interchangeably used.
Keshta et al. [8] 2 Improving Track Changes in Software Development Iskandar has termed the group of activities carried out at this stage as "Approval". The evaluation is done for the same purpose i.e., to arrive at the right decision to approve, batch or reject the change.
Iskandar et al. [15] 3 The flow of Change Control Process In SWEBOK, the authors have given the title "Preliminary Investigation" to the aforesaid activities on the basis of which CCB approves a change, reject a change or batch it for future. SWEBOK V3.0 [16] C-Implementation Stage

WFM for Change Management
"Implementation" is the third phase of WFM designed by Keshta to implement change management.
Keshta et al. [8] 2 Improving Track Changes in Software Development Iskandar emphasized backing up the system before implementing changes so that it can be restored in the event of a failure. In the "Deploy/Execute" phase, the changes are incorporated and released to the production environment.

Change Control Process
The authors of SWEBOK have the opinion that in the implementation process, only approved changes should be implemented, and these changes should be discard-able to restore the previous stable state. Niazi et al. [11] (Continued )     The process that Iskandar designed to improve tracking changes starts with "Initiation".

Iskandar et al. [15] 3
Bhatti's Change Management Process WFM designed by Bhatti also starts with the "Initiation" stage with the opinion that the impact analysis should lead to an authorization decision.
Bhatti et al. [9] B-Authorization Stage 1 CMMI for Development -Implementation Guide Chaudhary believes that it is necessary to seek approval from CCB before updating any configuration item or putting them in the CMS.
O'regan has prepared a simple process map for carrying out impact analysis, approval of CCB, and recording the approval/rejections decisions along with the rationale.
O'Regan [18] 398 IASC, 2022, vol.31, no.1  According to [22], researchers are free to develop their criteria for the classification of experts. The experts in this study are divided into 3 groups. Experts with less than 15 years of experience are classified as juniors, experts with more than 17 years of experience as senior, and the remaining experts as intermediates. According to this criterion, the panel consists of 4 seniors, 4 intermediates, and 2 juniors.
The questionnaire was specially designed to obtain the opinions of the experts on the proposed WFMs. This questionnaire is based on similar work by Niazi et al. [11] and Keshta et al. [7,8,12,13]. The questionnaire consists of three parts, including a cover letter stating purpose, demographics, and expert opinions. The questionnaire has seven questions and was reviewed by academicians to make it clearer and easier to read. The summary of the expert's responses based on the five-point Likert scale is shown in Tabs. 10 and 11. The Q-8 was open-ended that was used to collect feedback to improve the models.    According to the results of the EPR process, experts believe that the proposed models are easy to learn, cover sub-practices, can effectively implement SP, help achieve SG-2, help improve the quality of the software produced, and are suitable for SSME as well as for the software industry. However, like other things, there is room for improvement in the proposed model.

Validation through Case Studies
To test the worth of the model in the real world, a case study was conducted in two Pakistani SSMEs willing to implement WFMs. In order to maintain confidentiality, the cover names are used. The participating SSMEs are briefly defined in Tab. 12.
The participating SSMEs were appraised by CMMI experts for readiness against the underlined SPs at level-II and were found unready. A brief presentation covering the objectives of the study was delivered in an opening session for both the SSMEs. In order to evaluate the effectiveness of the proposed WFMs after implementation, SCAMPI Type-"C" and Type-"B" appraisals were conducted by the lead auditor in both SSMEs against the said SPs. The result of appraisals was encouraging. Both the SPs were declared "Fully Implemented" and its contribution towards the satisfactory achievement of the SG-2 in both the SSMEs was appreciated. According to the lead auditor's statement, both SSMEs will undoubtedly be rated as "fully implemented" in the SCAMPI Type "A" assessment. Feedback was also collected from participating professionals at the closing meeting.

Mitigation Actions Taken Against Threats to Result's Validity
First, the closed-ended questions in the questionnaire may not have captured the true views of respondents. In order to reduce the impact, an open-ended question was included to get free opinions thereby improving the accuracy of the response. Second, the panel members may have a different interpretation of the questions/WFMs and may have responded accordingly. Due to the close correlation, the questionnaire was taken from the work of Keshta. This was further refined by adding coverage of the framework at the sub-practices level and reviewed by another proficient academician. Third, the responses may have been limited to the knowledge and experiences of the respondents. Fortunately, experts with extensive industry experience participated in this study. The presence of world-renowned experts in the panel added to the effectiveness of the review process. Fourth, the responses of senior, intermediate, and junior experts might be different. The P of Chi-Square (X2) test was calculated and found > 0.05 for ∞ = 0.05 and the degree of freedom = 2 against the responses. This means that the difference between the answers provided by the experts is negligible. Finally, the general literature review process may not have seen the relevant research work. However, according to Hossain et al. [23], this cannot be regarded as a systemic omission.
6 Novelties and Limitations of the Proposed Models 6.1 Novelties Novelties of the models are tabulated as under in Tab. 13.

Limitations
Although the models have all the novelties, these have some limitations as well. First, these models are compatible with the current version of CMMI. Second, its applicability was tested in Pakistani SSMEs. However, these need to be revised for future versions and validated for other countries.

Conclusion and Future Work
The main purpose of this research is to design a workflow model to realize the SG-2 "Track and control changes" of CM-PA at CMMI level-II and validate it. To this end, five research questions (RQ-A~RQ-E) were formulated. Further WFMs were designed for its two associated SPs. Responses received from the experts as per the five-point Likert scale satisfy the validation criteria. The results were further confirmed by conducting case studies. The results showed that Pakistani SSMEs are capable of adopting the proposed models with minor adjustments. Satisfactory comments from experts and participating organizations speak well of the WFMs and add to the confidence in the evaluation results. The WFMs were refined after several rounds of improvements by incorporating suggestions from academicians, professionals, and finally feedback from case study participants. This work should continue to design WFMs for other SPs of this PA, other PAs of Level-II, and higher levels for which workflow models have not yet been developed. Conflicts of Interest: The authors declare that they have no conflicts of interest to report regarding the present study. Keshta et al. [8] Bhatti et al. [9] Tariq et al. [10] Niazi et al. [11] Keshta [12] Keshta et al. [13] Vivatanavorasin et al. [14] Chemuturi et al. [21] Applicable to Software SMEs.