Nihilent

DNA - July 2, 2007

IT midcaps stare at tougher certification
Rabin Ghosh

Software Engineering Institute makes quality rating must every three years

With the Software Engineering Institute (SEI) mandating a reassessment of the Capability Maturity Model Integration (CMMI) certification for IT companies, small and tier-II information technology companies may face a challenge in getting themselves reassessed to the earlier level, and may lose out on business opportunities.

Since smaller companies have limited experience in executing large projects, they have less statistical data, a necessity now, for substantiating higher maturity certification. A lower maturity rating means they could miss out on big projects.

The CMMI certification is based on the effective usage of statistics by IT companies to improve quality.

Nihilent Technologies chief operating officer Minoo Dastur says SEI is not happy with the quality of lead assessors or that of high maturity level (4 and 5) companies, and with reassessment, the number of CMMI-compliant companies is certain to fall.

Last year, SEI said it would limit the validity of its CMMI certification to three years (against till-perpetuity earlier). It also set a sunset clause which would require organisations to get themselves re-assessed to the new version (CMMI v1.2) by August 31, 2007, or within three years from the end-date of the last CMMI Appraisal Method for Process Improvement A (SCAMPI - V 1.1) appraisal, whichever is later.

Now onwards, every company will need to get re-assessed every three years.
"Earlier, anybody in the business could get themselves re-certified. This time, the process is more complex and tougher," Ganesh Natarajan, managing director, Zensar Technologies, said. Zensar, a CMMI Level 5 organisation, is confident of retaining its maturity level rating under the new regime as well.

Here lies the potential problem for the small- and medium-sized Indian IT companies. Out of about 1,600 companies certified by SEI in 2006, 177 were Indian. The US, with about 600, was the only country with more certified companies.

Indian IT companies are among the early adopters of CMMI certification and almost all the top 200 IT firms are of higher (level 4 or 5) maturity level. This has helped them get a competitive advantage over IT companies in other countries.

With the new certification rules, many fear that the small IT companies which managed a high maturity certification earlier, may not be able to retain them.

"SEI has changed the rules. It's far tougher now. While the big companies will pass through, medium companies will face delays, and the smaller companies would find it very difficult," Ashok Sontakke, vice president, quality and processes, Nihilent said.

Sontakke, who also heads Nihilent's CMMI Consulting Practice, is one of the 13 High Maturity Lead Assessors (HMLA) the country has. HMLAs number just 58 globally.

The threat comes from many global tenders, particularly those from banks and government agencies, which have a pre-requisite that the bidder be of high maturity level. Hence, many firms could find themselves ineligible.

"About half our customers ask for CMMI certifications. Though the first time outsourcers don't insist on it, to them it's only preferable that we are certified," Moorthi Chokkanathan, head, India delivery, Hexaware Technologies, said.

Hexaware plans to get itself reassessed under the latest SEI regime later this year.
Without waiting for the deadline, all major Indian IT companies are prepared for the new regime.

"We have already been re-certified for version 1.2 for all our global delivery centres. Even though under the previous regime, there was no requirement for re-assessment, we have done external health check every year," Alexis Samuel, general manager, quality development, Wipro, said.

Infosys Technologies' senior vice-president, quality and productivity, Satyendra Kumar, also said the company has undergone multiple appraisals, even though not mandated by SEI. "Our internal assurance and improvement processes ensure that the organisation continues to adhere to CMMI requirements, including adoption and compliance to any new changes that the SEI comes out with from time to time," he said. Infosys has already adopted CMMI's latest version and plans to go for re-assessment by August.

The industry welcomes SEI's move. "Periodic re-assessment ensures that the software services companies are on their toes in terms of adhering to quality processes. In any case, most of us are used to 6 monthly / annual ISO audits and a re-certification once in three years," Sudhakar Ram, chairman and group chief executive, Mastek, said.
Hexaware's Chokkanathan agrees. "Every year, we add about 20% to our headcount. So, it is a good idea to go for re-certification every three years on a much expanded workforce," he said.

The challenge for the industry also stems from the shortage of HMLAs, which could increase the time period for it to get certified. And shortage presents an opportunity.
Sontakke says about 450 high maturity organisation world-wide would need to get themselves reassessed this year. At $40,000-50,000 per certification, it translates into an $18-22 million opportunity for the 58 HMLAs. Nihilent would be tapping that space.

To tide over the shortage and improve cost effectiveness, Mastek's Ram said the ISO auditors should also get assessed as lead assessors under CMM / CMMI so that they can combine both the audits.

Back