quality 01 08 eng

8/11/2019 Quality 01 08 Eng

1/21

The customer magazine of SQS Software Quality Systems

OPEN SOURCEThe legal stumbling blocks>> Page 22

# 01_2008

Q AU Lity

LONDON OR NEW YORK?Global stock markets head to head>> Page 24

TOP Of ThE LEagUGeneva portrait of a city >> Page 32

Se mless systemSaP nd qu lity>> Page 8

8/11/2019 Quality 01 08 Eng

2/21

1SQS / QUALITY # 01_08

Pure Germanstopping power.

The ContiSportContact 3 with very short braking distances.

w w w

. c o n t i n e n t a l - c o r p o r a t i o n

. c o m

EDITOR

ac ievin success wit SaP

If it says SAP on it, then it has SAP in it. But which SAP would you like? Thedecision is not always easy because SAP is going down a path of product divers-ication. Behind the SAP NetWeaver access portal you will nd a great variety ofsolutions for various industrial sectors, different sizes of company and all sorts of areasof application. SAP AG recently underlined the vertical expansion of its portfolio witha thunderbolt: although previously the company management had repeatedly stressedthat billion-euro takeovers were not on its agenda, SAP took over Business Objects for4.8 billion euros in ea rly October 2007. What does this mean for its customers? They are confronted with an increasingly mul-tifaceted but also ever more complex range of SAP products. If in the long run theyare to gain the competitive and productivity advantages that they hope to achieve withthe standard software, the rst step has to be analysis and evaluation. This can producesurprising results. The German company Postbank AG, for example, decided to joinforces with SAP to develop an entirely new i ndustry solution in one go (page 16). Ifsystem introduction is to proceed as quickly and smoothly as possible, quality manage-ment and testing have a crucial role to play. This is somethin g that the Mercedes-BenzBank learned (page 12). SAP itself, too, has intensied the validation of its own pro-ducts and, among other things, is running intensive software checks in India (page18). Then there is also testing after customisation: who should SAP customers rely onif they want to ensure the quality of the standard software within their own company?The answer, as so often, can differ, depending on the circumstances (page 15). In addition to SAP, as ever, this edition of QUALIT Y brings you other current trendsand stories some of which also go beyond the world of IT: do you know your wayaround Geneva (page 32)? And who has their noses ahead in the competition betweenthe London and New York stock exchanges (page 2 4)? I hope you enjoy your read.

Best regards,Rudolf van MegenCEO of SQS Software Quality Systems AG

8/11/2019 Quality 01 08 Eng

3/21

8/11/2019 Quality 01 08 Eng

4/21

4 SQS / QUALITY # 01_08 5SQS / QUALITY # 01_08

Discover how to reachnew standards of testingWith innovative tools and techniques, developed from hundreds ofprojects, Cognizant helps you deliver increased value to your businessby accelerating testing, increasing software quality and lowering costs.

Our state-of-the-art testing centre, staffed by thousands of dedicated professionals,delivers adaptable testing methodologies and streamlined test managementprocesses to deliver predictable and reliable results every time.

Cognizant Technology SolutionsTorhaus WesthafenSpeicherstrasse 575960327 Frankfurt am MainGermanyTel: +49 69 2722 695-0Email: [email protected]

Consultancy Functional Testing Performance Testing Test Automation Managed Test Centre

VISITUS ON STAND 38 AT THE SOFTWARE & SYSTEMSQUALITY CONFERENCE16-18 APRIL, DUSSELDORF

NEWS NE

ireland goes froms reng h o s reng h

SQS Software Quality Systems Irelandachieved record growth in 2007. Te numberof consultants based in Ireland and NorthernIreland doubled during the year 2007 andlarge customer projects increased as well asthe number of new customers contracting forlong term work. Stephen Magennis has joined Derry ORion the Irish sales team, covering both NoIreland and the Republic of Ireland.

Northern Ireland Business Unit Director,McConnell has been growing the businesour Belfast ofce with a n increasing numclients and aggressively hiring new consu

We have added a number of new serviour ever-expanding portfolio of ser Among these new serv ices a re: Vista Mtion, Requirements Validation, Quality PManagement, Offshore Testing, Test Envment Management and SAP Testing.

SQS Sou h Afr ca enjoys over100 per cen grow h n 2007

Te South African branch of SQS SoftwareQuality Systems AG recorded runawaygrowth last year. While sales roughly dou-bled, the number of employees working thererose from about 30 at the end of 2006 to 90in December 2007.

David Cotterell, Chief Executive Ofcer ofSQS for the United Kingdom, Ireland andSouth Africa (SQS-UKISA), expects growthto continue at the same pace this year too.The team in Durban achieved 40 per centof its sales through offshore projects forEuropean clients and almost a third of theservices were provided locally to South Africancustomers.

Current offshore projects include workingfor major nancial and telecommunicationsservice providers in Switzerland and for soft-ware vendors and a large international lawrm in the UK, among others. The main ta skstaken on by the SQS e xperts include functionaland performance testing, automated regressiontesting and specifying business requirementsfor software development.

The customers making use of our offshorecapacities have made considerable efciencygains and reduced their costs, says DavidCotterell. We will now be doing more tospread this message among those customerswho have not yet embraced offshore testing.

aDVER

Process and produc qual yfrom a s ngle source

In the new Process Intelligence (PI) Com-petence Center, SQS has established a coun-terpart to the Application Intelligence (AI)team. Since the beginning of 2008 the PIspecialists have provided services for processanalysis and improvement.

In our projects we have regularly found thatproduct and process quality are two sides ofthe same coin, says Detlef Vohwinkel, whoheads the new Competence Center. That, hesays, is why SQS has, with PI and AI, set uptwo service groups that have emerged from theprevious Code Quality Management and ITProcess Quality teams. They might be sepa-rate in their positioning but they frequentlycollaborate in projects. The two areas are alsogrowing together methodically, Vohwinkelsays.

Vohwinkels team carries out as-is analysesof processes for both in-house and third-party software such as in connection witha supplier evaluation. Conversely, SQS expertscan also investigate whether a principals pro-cesses are ready to take on development work.

Apart from analysis, the service team also pro-vides advice on process improvement up toand including the management of SoftwareProcess Improvement (SPI) projects. Finally,SQS provides rollout support for SPI projectssuch as training courses. The PI team uses all major process modelsfrom ISO 9001:2000 via ISO 15504 orCMMI to V-Model XT. The team also workson a xed-price basis.

Company founder Bons s eps downrom Execu ve Board of SQS

Heinz Bons, Chief Operating Officer (COO)of SQS Software Quality Systems, retiredrom the Executive Board of the companyt the end of December 2007. Te SQS co-ounder will continue to provide his serviceso the company as a chief consultant.

By the beginning of 2007, SQS was alreadyetting up three regional management teams

covering the operational side of SQS, in prepa-ation for Heinz Bons departure. The regional

management teams of Germany, UK/Ireland/South Africa and Switzerland/Austria/Nether-ands/Management Consulting assumed his

COO responsibilities. There is no direct succes-or to take over from this long-serving member

of the Executive Board.

Heinz Bons founded SQS in 1982 togetherwith the current CEO, Rudolf van Megen.Since then he has played a decisive role inmaking the company the worlds largest inde-pendent provider of software testing and qua-ity management. Until only recently, Bons

played a key role at SQS in respect of the tech-nology involved in important projects withpremium services for major customers.

We thank Heinz for the invaluable contribu-ion he has made to SQS, says Rudolf van

Megen, the fellow board member who hashared his professional journey, looking back

on Mr. Bons time with the company. As co-ounder and COO, he helped SQS to its marketeader position especially through his efforts

with our customers in the nancial servicesector and his many years of experience in the

eld of research and development for SQS.

N co tschanz s new CEOof SQS n Sw zerland

Since the start of 2008, Nico schanz hasbeen heading operations as the new ChiefExecutive Officer (CEO) of SQS SoftwareQuality Systems (Schweiz) AG. He has takenover from Reto Zst, who headed the Swissbranch of SQS from 2003.

Nico Tschanz, 39, began his professional careeras an independent consultant for an enterpriseresource planning (ERP) project with the Swisse-business provider Crealogix AG in 1998.Tschanz worked for this company in variouscapacities until the end of last year. By then hehad become a member of the E xecutive Boardand company partner.

His main aim as new CEO will be to fur-ther expand and consolidate the posi-tion of the Swiss branch of SQS as marketleader in software quality management andtesting. He will also continue to pursue thegrowth strategy for the company, whichnow employs around 100 consultants at itsZurich and Geneva branches. To bring aboutthis expansion, Tschanz will be focusing oncustomer-specic offshore bids and manage-ment consulting. Reto Zst, who was the CEO until recently,had already taken on wider internationalcommitments within the SQS group in 2007.He is now responsible for the regionalsubsidiaries in the Netherlands, Austriaand Switzerland, as well as expanding theEgyptian offshore centre and assuming keyresponsibilities in the areas of managementconsulting and services delivery for theSQS group.

8/11/2019 Quality 01 08 Eng

5/21


New grow h oppor un es

or SQS UKSQS UK continues to full its leadership

osition in the UK market. During 2007both business and staff grew to new levels andoday the company is approximately twice theize it was when SQS UK and Cresta merged.

All busi ness un its gre w during 2007 and in008 new opportunities have been launched.

Based in the city of Manchester in the northof England, Dave Rigler has opened a newbusiness unit with Account Manager AlanUpton. SQS already has customers andemployees in this region that will give Dave atart on business.

Another new business unit in England will beheaded up by Patrick Chatee. Patrick is a wellknown entrepreneur in the market and hasalready been growing key clients in England.Additionally, the business units in Englandhave been aligned to industry sectors. Thistep is giving a greater focus for employees

and customers to benet from the extensivebusiness knowledge our testing and qualityprofessionals have.

A Center of Excellence for SAP systems hasbeen initiated, managed by Peter Wilkinsonand Gary Jenn. This country-wide supportcentre is delivering specialised services toSAP projects and hiring consultants to satisfydemand.

SQS UK customers benet from the uniquecombination of onshore and offshore testingprofessionals delivered through ManagedServices.

A bu ld ng soc e y scru n ses

s sof ware n er orRaiffeisen Bausparkasse in Vienna success-fully established Code Quality Management(CQM) by the end of 2007 and the nancialservices provider has been beneting fromthe initial CQM steps towards optimising itssoftware code.

We have now achieved our project aims,sums up Andreas Madjari, software architectat Raiffeisen Bausparkasse GmbH. We arenow enjoying the advantages we were aimingfor with the introduction of CQM. Madjariplaces particular emphasis on the greatertransparency for developers and management,the increased performance of software engi-neering and the improved system integration. Additionally, Raiffeisen Bausparkasse can nowallocate its IT specialists with more exibility,since the software code no longer has emplo-yee-specic features. The now successfully implemented Code Qua-lity Management system was introduced intothe Viennese company with the assistance ofSQS Software Quality Systems AG. The build-ing society was supported by SQS consultants,particularly in designing the necessary pro-cesses, selecting the appropriate code evalua-tion criteria and in evaluating, installing andcustomising the appropriate measuring tool,the Bauhaus Suite from Axivion, which plays

a decisive role in the automation of CQM.

The building society is currently planning toexpand CQM as part of an evolving process.It will therefore implement further evaluationcriteria using CQM.

New heads of ool developmenand SAP a SQS

Dr. Vincenza Pignataro is the new headof product management for test tools andPhilipp Gerber is taking over as head of thenew SAP Center of Excellence at SQS Soft- ware Qual ity Systems in Cologne .

Vincenza Pignataro joined SQS fromT-Com at the begin-ning of 2008. AtT-Com she was for-merly in charge of across-enterprise project to tra nsform pro-cesses and convert ITsystems in customer

contacts, order management and billing. AtSQS, Dr. Pignataro is in charge of tool devel-opment for the Group.

Building on SQSs decades of experience withtest tools, we are continuing to develop SQS-TEST/Professional and positioning it moreclearly in the market, she says. In keeping withthe sell what you use and use what you sellprinciple, improvements will be made whichwill be of benet for in-house use at SQS andmarketing externally to clients.

At the new SQS SAP Center of Excellence,Philipp Gerber is, forthe rst time, bundlingthe companys SAPcompetence from allover Germany. Thenew centre willlink in-depth SAP expertise and our

quality assurance know-how, Gerber says.

For this purpose the new team will, in addit-ion to personnel expansion and the new part-nership between SQS and SAP, enhance itsservice portfolio. The focus will be on bestpractice solutions that we align to our custom-ers specic requirements, he says.

Gerber, a physics graduate, joined SQS fromDeutsche Post. At logistics service provi-der Deutsche Post he was in charge of SAP projects in the letter post division, managingSAProllouts in Europe, America and Asia.

Readers survey: compan es

sa s ed w h it offshor ngQUALI Y readers consider I offshoring tobe mostly a good thing. Only 16 per cent ofrespondents to the latest readers survey inQUALI Y 2007 indicated that they weredissatised with the results of offshoringin their company.

The gures from the survey back up the ideathat IT offshoring has become everyday real-ity, namely for 54 per cent of the people ques-tioned. At the same time 13 per cent are stillconsidering whether to take the step. In termsof achieving expectations, 42 per cent haveobtained 80 to 100 per cent of the increasedvalue that they had hoped for. As far as preferred countries for offshoringare concerned, it is the Eastern Europeancountries which lead the way. Al l respondentsto the survey can imagine outsourcing toRussia, the Baltic states etc., while 85 per centof those taking part view India as a suitableoffshoring destination.

Other regions of the world such as Southeast Asia are further down in the rankings.

The results also provide an indication as towhy Eastern Europe is the favourite: becauseof the comparatively low cultural and linguis-tic barriers. 85 per cent see this as a signicantchallenge in relation to offshoring.

In addition, 77 per cent of the respondents areafraid of lengthy, complex processes, while 62per cent consider unpredictable quality of s er-vice to be a stumbling block.

Marke barome er for

sof ware es ng s onl ne With its SQS Consult website SQS S oftwareQuality Systems has launched the rst onlineservice for software testing trends. Constant-ly updated study results will keep visitors well informed.

The Internet portal is based on a representa-tive survey of the software testing market andsoftware testing practice that SQS has justcommissioned for the second time. Visitorsto the site will be able to not only retrieve thelatest gures, they will also be able to identifytrends and changes in comparison with pre-vious years.

At present the online service presents the nd-ings of the 2007 market study that Coleman& Parkes carried out in th ree countries.

The 2008 gures will be available in April.For the latest survey, analysts at Pierre AudoinConsultants (PAC) interviewed over 1,000 ITand quality assurance managers in 13 coun-tries. The website also features a benchmark-ing tool. Our new online service shows where softwarequality assurance is heading, says LilianaPreuss, head of PR & Marketing at the SQSGroup. In the past, companies and expertshad to rely on sporadic surveys and subjectiveexperiences. In contrast, the representativegures that are now available online createtransparency.

Te research site is at: www.sqsconsult.com

SQS o s ar es ng n Egyp

from summer 2008SQS Software Quality Systems has opened atest centre in Cairo, initially with a staff ofabout 25. Almost all of the test experts basedthere also speak uent German as well asEnglish.

The new offshore location for Europesing consulting house for software qmanagement and testing is an additiothe SQS branch in Durban, South Awhich is already experiencing strong g While the con sultants and testers in Dumainly work for customers in Englishking countries, the Egyptian ofce iented towards clients in Germany, Auand Switzerland. There is a German university in Cairothere have been three German-langsecondary schools there for decades, r Axel Bartram, member of the man agemSQS Germany, which means that abouwell-educated German-speaking graduaproduced every year. He says this estaan outstanding basis for high-quality ofservices.

All of the new SQS employees in CairoIT training and will undergo a traineegramme in software testing. The workcarry out for their clients will primarilyprise verifying technical IT conceptsparing and performing functional testsetting up and maintaining environmentest automation. In the medium term SQexpecting the number of employees inpart of North Africa to rise to three gur

SQS NEWS SQS N

8/11/2019 Quality 01 08 Eng

6/21


STRaTEgY STRaT

T ere is no 100 per cent security

As the person in charge of security at SAP, when y ou t alk aboutsecurity, can you then always assume that the people you are talkingto mean the same thing with this term?

By no means. In reality, even in the IT bus iness a lot of people still thinkonly of rewalls and virus scanners when they hear the word secur-ity. But security means much more: the term includes the attributes ofintegrity in the sense of intactness, availability and condentiality ofdata and of information generally. Basically, security in an IT contextmeans that all processes run as they are expected to even when thereis a possible threat from external inuences.

We le rn when thin s o wron

Nonetheless, it can be seen that security-consciousness varies greatly.Particularly great attention is paid to it, of course, when somethingunforeseen occurs. And, at the end of the day, we do tend to learn fromsituations in which something has gone wrong.

To create the greatest possible level of security again, you need, onone hand, to carry out monitoring and, on the other, to build trustamong colleagues. In this instance, this means differentiating betweenthe internal security risks of a company and the external threats whichoften call for a completely different approach.

What strategi es do you recommend for both internal risks and ex tern-

al threats?

Internal risks, that is insider threats, are best dealt with using twoprinciples. The rst is to promote an open and trusting workingatmosphere that minimises as far as possible any motivation to harmthe company, accompanied by awareness campaigns centring on thethreats and focusing attention on acting in a manner that promotessecurity. The second the principle of function separaton shouldapply throughout the company. This prevents critical c ombinations ofactivities, thus reducing risk to the company. There are also specialsolutions for IT systems such as SAP.

You can never completely rule out external threats, but in basic terms,the threat always depends on the speci c nature of the business a nd the

W y security must complement qu lityInterview wit security expert S c r P ulus rom SaP

political relevance of the company. There is no cure-all for thisthing to do, however, is to implement a standard for securityment, for example ISO 27001. The risks can be analysed in a

with its process instructions and appropriate measures institu

Which typical situations do people like you, i n charge of security,experience in your day-to-day work?

When, f or in stance, I am preparing the regular security rethe Executive Board, I always consider to what extent I shomyself to the actual incidents and disturbances and whetheralso broach the open-ended issues that represent a potential risituation, many of my colleagues opt to dispense with the opissues.

If they then speak to heads of department and advise of theinsecure software is bein g used in their area of responsibility,get the reply that everything is working smoothly and that tbeen unable to pinpoint any problems. Moreover, they say thaon certain applications such as Skype, which should not be off for this reason. (Editors note: Skype is a small softwarethat you can us e to phone other Skype users worldwide at no even in the case of the E xecutive Board, security requirementlimited simply to the request for additional rewalls.

How can you better communicate the importance of a wider apprecia-tion of security, particularly to management?

We have to nd a language that management understands. Nois often still the case that a lot of money is invested for securiin technologies that are meant to protect software, but whicsolve the problem effectively.

To nd the right solution at the right time, the management neable information and measurable facts. We need continually data on the security of softwa re. This is the only way t he peoplcan arrive at decisions that are not based primarily on a gut fe

How can security actually be measured?

Security cannot be depicted in simple black-and-white or yesgories that apply equally in all instances. First of all we have

8/11/2019 Quality 01 08 Eng

7/21


STRaTEgY STRaT

n our minds about the fact that there is no such thing as 100 per centecurity. Instead, companies must make decisions about what kind

of security is important for them, which security level they want toachieve and what price they are prepared to pay for this. Any suchanalysis is always based on the companys business objectives. Based onhese, indicators can be derived which can be used to measure security.

What relationsh ip exists between security a nd quality?

Security and quality are mutually dependent: they are complementaryn a certain way. Security is all about ensuring that the product onlyncludes functions whose specications have been predened and that aoftware program doesnt do anything that you dont expect of it. Thiss, so to speak, the negative denition of the minimum level of securityhat you create in a software application.

With quality on the other hand, in simplied terms, it is about meetinghe predened quality objectives and achieving all standards set. Thishen is a positive denition: the software does everything you indeed

expect of it.

How can companies align security and quality with their businessequirements? What approach do you recommend?

d like here to draw a distinction between two different target groups.

First, there are software manufacturers, and then there are softwareusers. The IT providers need clearly dened security standards for t heirproducts. They have to ensure the provision of secure coding and carryout all these steps in accordance with current best practice. The manufacturers also have to have processes with which they canaddress security issues as soon as they arise but above all before theybecome virulent. Still, as already said, you can be 100 per cent certainthat you cannot achieve 100 per cent security. For users, on the other hand, the rst and most important point is aclear denition of their requirements. On the basis of these, they canthen evaluate the software and services they want to use in the variousareas of their company. In the end, t he responsibility for the security ofcertain products and services must be clearly regulated and assigned toemployees with specic responsibility for this.

Security is me sur ble

What ca n security ex perts learn f rom quality speci alists?

They can learn the usefulness of metrics and how best to apply them.Here, we can benet from the many years experience gathered bythe testing and quality experts in analysing and evaluating software

code. By this I dont mean only pure system measurement but also thedenition of programming guidelines and how adherence to these canbe checked.

Which tren ds and cha llenges in t he world of I will security e xpertshave to prepare themselves for in the future?

We will have to learn to deal with increasing complexity. This is comingabout, for example, through the so-called Internet of Things, that is,the increasing inclusion of everyday objects in electronic networking.

This is increasing the ubiquity of electronic communication enormously the key phrase here is ubiquitous computing. With this, boundariesand limitations are playing an ever-smaller role. Accordingly, ever moresecurity risks which hitherto were limited to the IT domain are alsoreaching other areas in the world of work and everyday life.

Industri lise security

In these instances, security specialists must step in, as we are at a water-shed. The more complex the applications become and thus also theirsecurity risks, the more we have to standardise and industrialise security. And for this we need reliable data that records security better, quantita-tively and qualitatively, and makes it more controllable than hitherto.

Professor Dr. Sachar Paulus ...

... is Senior Vice President for Product Security Governance atSAP AG. In this c apacity, he is re sponsible for the SA P strategy forproduct security. He is considered a pioneering thinker in the secur-ity community and is a member of various I security organisationsincluding the Information Security Forum and the InternationalSecurity Management Association.

8/11/2019 Quality 01 08 Eng

8/21


STRaTEgY STRaT

E sin t e burden on b nkin experts

Te maintenance of I solutions such as SAP often requires moreesources than implementation. Expanded functions and serviceackages, for example, result in systems that are constantly chang-

ng. Each of these changes must be quality-assured. Tat is why theMercedes-Benz Bank decided to automate its regression tests. odayhis automation substantially eases the burden on banking employeesn specialist departments.

A new job function can fundamentally change your view of things.That was the experience of Dr. Thorsten Wittmann, Director of Finan-cial Backbone Business Intelligence at the Mercedes-Benz Bank, whenhe set up an across-the-board specialised support organisation for thebanks in-house SAP BW and SAP BA systems. Previously, eachpecialist department was responsible for maintaining its own systems.

That included tasks such as acceptance tests or specialised tests of newlyupplied system components. In the course of IT standardisation the

bank combined these functions in the new, independent team. Thebanks experts in specialist departments have since been able to betterconcentrate on their core tasks.

The support that we provide for our SA P systems is provided by col-eagues with both specialist and IT know-how. In a way they serve asnterpreters between the banks specialist departments and its techni-

cally oriented software and hardware staff, Wittmann says. From thenew service teams point of view it is no longer enough for new sys temcomponents merely to stay within time and budget in the course of theirdevelopment. Along with the factors time a nd money, he says, for usn the service team the quality and testability of the software delivered

are of decisive importance.

n orm tion or test control

At this sta ge of the proceedings, the Mercedes-Benz Bank decided toautomate the testing of its SAP systems. The banking and IT expertshad three main aims in mind. First, the structuring and standardis ationof all test processes to improve the quality of new components received.Second, the support team hoped to make its own test process controlmore meaningful. To achieve this, the management needs regular andeliable status reports on the given situation in order to deploy pro-ects and employees systematically. Third, t he Stuttgart ba nk wantedo speed up its maintenance processes. Automation, the bank hoped,

Mercedes-Benz B nk utom tes testin o its SaP systems

would lead to shorter pro-cessing times and paralleltrouble-shooting cycles.

External consultants fromSQS Software Quality Systems AG lent the Mercedes-BenzBank a helping hand. Theycontributed the idea of testautomation, drew up theconcept for the new proce-dure and set up a pilot envi-ronment. After it was testedand found to be a success, theSQS experts devised a con-cept for its full-scale use andimplemented it.

The structure of test pro-cesses is now geared to theproducts and services that the bank provides from leasing via nan-cing to investment business. The be-all and end-all for ensuring thatautomated testing runs smoothly is the quality and structure of the testcases supplied with the new system components. Wittmann and histeam have subjected them to stringent formal standards. As a result theautomation project led to all concerned adopting a more structured,cross-enterprise approach. That was the only way to lay the groundworkfor smoothing the running of the test machinery. Automation of the tests is managed mostly through the use of two tools.TestDirector from HP (formerly Mercury) is the link that connects testmanagement by the specialist testers. The bank already had the tool,but it had not been widely used. Test data is maintained and madeavailable through use of SQS-TEST/Professional.

The SQS tool has the major benet of working through the useof synthetic data and not requiring production data. In this way, previ-ously used specialist test data can be reused in the next test. Time-travelfunctions automatically set the dates required at the actual date.

In a second step the Stuttgart specialists harmonised the test proce-dure with the specic features of the SAP systems used. SAP BW,

for example, works with process chains that differ from those used intesting. To reconcile the two worlds we needed sufcient time, Witt-mann recalls. It is not something that you can simply do in passing. And because systems other than SAP supply data, his team also devel-oped a data driver that bundles the various information into a test case.

Less expense, more tr nsp rency

The Stuttgart bankers were satised with the rs t months of automatedtesting in their SAP environment. The speed of testing in particularhas increased considerably. It does not matter whether we put ten or100 cases to the test automatically, the time it takes to run them is moreor less always the same, says a delighted Wittmann. The results areavailable in a matter of hours. That, he says, is a signicant benet. Inthe past the bank regularly had to second staff from specialist depart-ments to carry out the necessary tests.

The support team also appreciates the gain in speed within threehours they know where they sta nd in a given project.

The initial investment will pay for itself over time, especially as theprocedure and test automation are now also available for other devel-opment and maintenance projects within the company. The success ofthese new approaches to quality assurance in the SAP environment hasconvinced the Mercedes-Benz Banks management.

Dr. Torsten Wittmann, Mercedes-Benz Bank AG,says, Automating software tests boosts efficiencysignicantly.

8/11/2019 Quality 01 08 Eng

9/21


STRaTEgIE STRaT

E ective testin o SaP solutions

Tere is now growing demand for SAP Solution Manager and a keydriver of this has been the service and support strategy of the Walldorfsoftware house. Te SAP application management platform includesa high-performance, and for SAP customers, a licence-cost-free testmanagement component. On the one hand, this is a plus from a custo-mer point of view, while on the other, the decision to procure a testing

tool should always be made after a detailed, systematic and completeexamination of quality assurance in SAP projects.

SAP implementation projects generally prove extremely complex and,as a result, carry a h igh potential for risk. Here, comprehensive, system-atic testing of the software makes an important contribution to red-ucing errors. Testing tools such as the test management components of

SAP Solution Manager can increase ef ciency considerably. One thingmust be borne in mind, however: before improving the efciency of thetest activities, their effectiveness must rst be assured.

E ectiveness be ore e ciency

Surveys show that almost 70 per cent of companies do not follow auniform, consistent testing procedure. One in two companies cannotshow that they use any set testing strategy. The well-known sayinga fool with a tool remains a fool aptly describes what has been foundto be true: that dened test processes conducted properly by skilledtesting personnel must be in place if testing tools are to be employedsuccessfully.

The fact that a tool is provided at no licence cost should not mean thatthe costs and implications of implementing and using the tool should beunderestimated. Selection should therefore always be the result of care-ful and sy stematic evaluation, including a complete cost-benet analysis.For this, independent testing specialists must have in-depth market andproduct knowledge and be able to identify any strengths or weaknessesin the tools and address these without any conicts of interest.

Once a decision has been made for a product, implementatiotake the form of a project. In the course of implementationows and documentation must be adapted, users trained annecessary, interfaces set up for the purpose of integration withing system landsc ape. In addition, tool operation and suppororganised. Strong involvement of users in this process helps e

acceptance of the product and the later utilisation of the toolproject is suitable for checking feasibility within a limited co

E rly ult prevention

Quality assurance mea sures should never be restricted just to tof the software. In fact, fault prevention is much more effecost-efcient than testing for faults in order to identify andthem. Preventive quality assurance begins early on, with theand preparation for a SAP project. To ensure effective prevenprofessional quality assurance providers offer their customergrated consulting service throughout all stages of the projecstandardised procedures, they evaluate activities and ndingsup recommendations for optimisation. The customer is thus across-the-board transparency, and the risk posed to his preduced. Here, the principle holds true that quality assurance by independent parties ensures openness and objectivity.

SaP expert P ilipp gerber recommends system tic ppro cw en implementin testin tools

Re d on to discover:>> why testing tools are not a cure-all>> what to bear in mind when choosing and implementing

testing tools>> why effective quality assurance begins well before the

testing stage

Ph l pp Gerber ...

is head of the SAP Center of Excellence at SQS Software QualitySystems AG. Since 1997 he has, in various capacities, been takingSAP projects forward. Among his responsibilities is a global SAP

implementation project for Deutsche Post AG.

BUSINESS TECHNOLOGY LEADERSHIP

CIO provides opportunities to debate and discuss the issues youface everyday and learn from fellow CIOs practical experiences

Visitwww.cio.co.uk to join the CIO strategic network today

www.cio.co.uk .co.uk

How doyou access the CIOstrategic network?

8/11/2019 Quality 01 08 Eng

10/21


STRaTEgY STRaT

hi b seline qu lity wit st nd rd so tw reT om s M n el, he d o Development t Postb nk Systems ag,on t e use o SaP in t e b nks core business nd testin s pro ession

Dr. thomas Mangel ...

is a member of the Executive Board of Postbank Systems AG,responsible for the I projects of Deutsche Postbank. Te company isthe I service provider of Deutsche Postbank AG, one of the largestbanks in German retail banking. Previously, Mangel had other areasof responsibility at Postbank, for example as Managing Director forI Infrastructure. Dr. Mangel was involved in the development ofthe core banking system in collaboration with SAP as Head of ech-nology of Postbank Systems AG from entering into the contract withSAP through to implementation.

Deutsche Postbank is breaking ranks with the majority of the otherarge banks by using SAP for its core business activities. Why?

Postbank has undergone rapid change in the last ten years developingrom a public institution into a now global bank that is a leader in retai l

banking. This was in part achieved due to the companys decision in1999 to pave the way with standard software and SAP as the basisor core systems for retail ban king. The situation at that time favoured

his approach since the strategic plans of Postbank and of SAP

ttedeach other very well. We were looking for a system that covered all t hemportant functions of a global bank with the emphasis on retail bank-ng customers. At the same time, SAP was on the lookout for a strong

partner able to deliver the input for such a system as a standard solu-ion a partner who also had rst-rate knowledge of the fundamentalechnical requirements such as performance and operating procedures.

We were prepared to provide this expertise.

Does the standard software today offer what Postbank at that timewas hoping for in terms of f unctionalit y?

Yes. Among the most important components is the core transac tionystem for current and savings accounts. It manages all accounts and

maintains all trans action data. On top of this, it stores the master data ofboth business clients and retail banking customers. In short, the systems our transaction mach ine. If, for example, at the end of the yea r, Post-

bank accounts are faced with 30 million transactions within two days,hen this is all done via the SAP system. In total, we manage around

ve million current accounts and over 17 million savings accounts u singhis solution. In addition we manage more than seven million cards for

our customers through this system.

Tere was a lot of scepticism expressed at the start of your collabor-tion with SAP. What were the greatest obstacles and how did you

overcome them?

We were clear f rom the outset that a standard sof tware solution wa sbeing created and that this required particular role allocations betweenSAP and Postbank. This was the very reason why we decided to col-aborate with SAP. Rather than drafting a system design ourselves,

we limited our responsibilty to providing the business expertise anddescribing the requirements and contributed our experience in opera-ing automated and highly efcient IT systems on a broad basis. This

approach suited the SAP position. The relevant parties indicated to ushat they needed someone who, after the product was developed, would

demonstrate that the system could be used as a standard software solu-ion. However, we were expected to leave it to the expertise of SAP to

convert the requirements into a exible softwa re solution.

Quite a big risk for such an important system ...

Of course, we asked ourselves this question too: could we place ourcondence in something like this? The result of these deliberations wasan approach with which we fully a ligned the priorities of the bank withthis project from the E xecutive Board to the individual employees.

In the end, were you not dealing with two projects rst, supporting

SAP in creating the standard software and then implementing thesoftware?

Yes, these were two logically separated parts, although there were over-laps in chronological terms. As part of an initial phase, SAP had todeliver a parameterisable solution, or as SAP puts it: customisable. Wehad to adapt the functions provided to our individual requirementsas in every normal SAP project. We did have a few advantages andsynergy effects, though. Thus some of our developers worked at SAP from the outset in order to get to know the system at the developmentstage. This insider knowledge then stood u s in good stead later on at thecustomisation stage.

Did SAP grasp and implement the expertise from Postbank fromthe outset?

SAP had also familiarised itself with what a standard banking solu-tion has to achieve. And we provided application scenarios based on usecases from our specialist areas. It also helped that SAP was not a com-plete newcomer to the banking environment. The company had a lreadyhad solutions for nancial serv ices providers on the market, for exampleSAP CML for the credit business as well as SAP BCA, a predecessorof the core banking system developed in collaboration with us. We weretherefore able to presume a fundamental grasp of banki ng software andconcentrate on the technical and operational specications.

How did you ensure quality?

Quality management (QM) was a fundamental part of the programstructure. This provided for a multi-level project hierarchy in whichQM took on a support function at the program management level.The program manager was thus assisted by a quality manager, who,along with his team, took on responsibility for quality across the entireprogram. Of course, each individual project had its own qua lity objec-tives, but at the across-the-board program level, there was one personin charge of quality who pulled all the individual strands together, forinstance, the specications for fault removal plans and the tracing offault removal. Here, too, there were two stages: rst, we checked usingpredened test cases to see whether the SAP solution was suitable for

standard software. And, i n a second step, after customising, we tested tosee whether the system delivered exactly what we need at Postbank.

And there were no big surpri ses on commissioning?

You can compare the replacement of a core banking system with a hearttransplant. Particularly since we were also changing the entire technicalinfrastructure from BS/2000 to an IBM mainframe and server. With

such a step, it goes without saying that the quality assurance was set atthe highest level. In addition to the traditional levels such as moduleand integration tests, we therefore ran additional intensive tests simu-lating operational conditions. Postbank Systems built a test bench forthis purpose that simulated actual operation. On it, we ran what isknown as a production run without customer impact over a period ofseveral weeks with up to 500 bank employees. This enabled us to ensurea smooth start for the new system.

Who is now ta king cha rge of qualit y assura nce for the operat ion andmaintenance of SAP?

We decided early on that testing is a discipline all of its own. A separateorganisational unit is responsible for test management. Testing is thus nota task that, for instance, developers or the specialist departments performin addition to their own tasks. It is taken on by specialists, essentially testmanagers with responsibility for adhering to a particular methodology,test engineers with technical system expertise a nd the testers themselves.Separate job specications ensure that we have the necessary sk ills at ourdisposal. If, for example, a regression test of the SAP system for bankgiro transfer is due to be done, we need specialists who know straight offwhich test cases in our databas e are needed for this.

How is the SAP systems test performing today compared to, forinstance, software developed in-house?

It basically holds true that SAP as a provider of standard software deliv-ers good basic quality for instance, updates and functional enhance-ments. This means that we are building on a level of quality comparablewith the quality offered with self-developed software before this goesinto the integration test. If the product supplied does not include anyfunctional adaptations relevant to us, we carry out a specied quota ofregression test cases. It goes without saying that the responsibility forthe production run for both self-developed and standard software lieswith ourselves.

8/11/2019 Quality 01 08 Eng

11/21


STRaTEgY STRaT

Muc more t n n extended workbenc

ndia is regarded as a future world economic power. Its I capitals Bangalore, where several thousand I companies have now set up

operations. As a result of the enormous demand for highly skilled

abour, in and around Bangalore there is a higher-than-average turn-over of staff of as much as 35 per cent. But this is not the case atSAP, which in 2004 began having its software validation performedby Indian specialists. Tree years later, staff turnover is far below theverage for the industry.

When SAP considered outsourcing software testing activities to Ban-galore, the company was cautious due to the many adverse reports basedon rst-hand experience there. Personnel consultants reported a staffurnover of between 20 and 40 per cent annually. Few companies had

employees with more than ve years service. And press articles hadeported that the delight at low labour costs in this emerging market

would not be maintained, since, on average, around 25 per cent ofemployees leave the company within their rst year.

Despite these negative gures, in 2004 SAP decided to set up a soft-ware testing centre in Bangalore. This centre was intended to carry outhe nal steps in the va lidation process directly before releasing the end

product. These nal tests provide simulations of customer scenarios,ncluding implementations, upgrades and patches.

Before the commencement of offshoring activities, the validation tea mhad consisted of 30 permanent members of staff in Germany who col-aborated with 60 freelancers, mostly consultants, from all corners ofhe globe. To expand the service portfolio and meet new requirements,

SAP continually recruited more staff to its team of testers and set outby rstly appointing ten Indian project managers and ten Indian system

SaP is lso testin its so tw re in Indi SaP M n er M rtin ad m knows w y

Re d on to discover:>> how SAP is building up testing expertise in India >> which strategies are successfully reducing staff turnover>> who is commuting regularly between Walldorf and Bangalore

administrators for the Bangalore operation. In close collaboration withthe head ofce in Germany, they were given both off- and on-the-jobtraining in preparation for their work. In the period following this, the

company appointed more system administrators and professional testersin Bangalore. Thus, in addition to the team members in Walldorf, thereare now around 100 full-time Indian SAP staff in the software testingdivision. As a result, the number of freelancers required has droppedconsiderably.

How has SAP managed to contain t he turnover of skilled labour typicalof this region? How do you keep employees happy and in their posts?

Responsibility on the round

Success is achieved through a number of di fferent factors. Firstly, it wasvery important to gradually hand over more and more responsibility tothe Indian employees on the ground. The team in India is very muchmore than an extended workbench and head ofce worked hard toconvey this to staff convincingly.

Thus the scope of responsibility of the Indian employees grew continu-ally: rst, they carried out the regression tests for software corrections,then they carried out upgrades as well and, nally, took on responsibilityfor performing the tests. Today, the team in Ba ngalore is responsible fordesigning some of the SAP tests used worldwide and also providesproject managers for several important g lobal projects.

This is coupled with intensive team development. Workshops, regularreview meetings and joint activities such a s trips help promote cohesionand appreciation of each others qualities. Adhering to a clear structureof meetings from the outset has also proved very efcient. In addition tomonthly review meetings with management, the validation team intro-duced weekly team meetings and regular telephone conferencing. Ontop of this, staff hold works meetings from time to time with manage-ment participation. This means that there is an open, trusting team cul-ture among management and sta ff. From the very rst day too, a goodrelationship was built up between the two head managers in Germany

and India. These one-to-one meetings a lso played a role in this s ome-thing that is not necessarily the order of the day in India.

Tr vel between two cultures

This dialogue between cultures cannot be a one-way street, how-ever. The Indian members of staff who wanted to learn new skills atthe SAP headquarters travelled to Germany. Likewise, the Germanstaff members who would later be in charge of knowledge transferand setting up the team went to Bangalore. And, as a matter ofcourse, all team members underwent intercultural training to get toknow the business c ulture of the other country.

Meanwhile, low staff turnover is underpinned by a hiring policy withclear job specications for candidates. In addition to one German andone Indian manager, a local HR specialist was also put in charge ofinterviewing. This meant that the Indian personnel consultant couldexplain any key issues about the cultural background of applicants. Aswell as those selected locally, ve Indian students were appointed whohad completed a one-semester work placement in Germany with thesoftware validation team.

To sum up, after three years of collaboration, nearly all team membersare still on board. During this period, SAP has established a culture ofdivision of labour. If it looks like it makes sense or seems necessary todelegate responsibility to Bangalore and the resources are in place for this,they just do it. This is why, for example, the project managers for devel-oping and validating three important SAP solutions are to be found inIndia. Currently, this offshoring of testing is running smoothly.

Dr. Mar n Adam ...

... studied mathematics and computer science and has a PhD in mathe-matics. He has worked at SAP in Walldorf since 2001 and is head of

the Production Unit Solution Validation division, which is respon-sible for quality assurance testing directly before product release.

8/11/2019 Quality 01 08 Eng

12/21


BEST PRaCTICES BEST PRaCTI

So tw re testin becomes utom ted

With its new ran ge of dua l clutch t ransmissions (DC s), GE RAGFORD ransmissions is seeking to combine the advantages of auto-matic and manual transmissions in one solution. Te level of I com-

lexity involved in these mechatronic systems is considerable. Andhis means that their quality assurance requirements are just as high.

By automating the testing process, this automotive industry supplier

s ensuring system reliability and safety while at the same time opti-mising cost-effectiveness.

One of the fastest-growing divisions of GETRAG FORD Transmis-ions is that of product development. Here, software continues to

constitute a major part of the new mechatronic systems. One exampleof this is the new dual clutch transmi ssions, which offer great dynamics

with optimal efciency. On one hand, these dynamics come from theengine, which has a specic speed. On the other, the vehicle itself createsgreat dynamics, which pushes up the requirements for calculating timeand correct computing of the d ata by the processors. We havent built3 GHz Xeon processors into our transmissions, but instead 66 MHzprocessors, explains Jrg Hermes, the specialist in charge of valida-ion and verication at GETRAG FORD Transmissions. We of course

have to test the software much more intensively and extensively a nd alsobe able to verify this check, since the control software has relevance forafe operation.

Control so tw re

The control software in the dual clutch transmissions is responsibleor carrying out the right gear change at the right time. Thus it haso pre-engage the correct gear, as is its job under normal operating

conditions. On top of this, the software also performs diagnostics.t registers when there is a fault in the transmission system and inhis event triggers countermeasures.

One example of this is a sensor that recognises whether, for instance,he rst or the third gear is engaged. If the s ensor is faulty, the control

gETRag fORD Tr nsmissions is reducin IT costsor developin du l clutc tr nsmissions

Re d on to discover:>> how software ensures engine safety >> legal requirements for software tests>> what reduces the cost of repeat tests

software can no longer ensure correct gear changes and then blocks thegear train affected, but still allows the driver to continue safely until hecan either drive the car to the gara ge for repair or steer it in a controlledmanner on to the ha rd shoulder.

The control software runs on a separate operating system supplied fully

tested by the manufacturer of the transmission control unit (TCU). Con-nection takes place via an electronic interface to the ABS (antilock brakesystem), ECU (engine control unit) and EIC (electronic instrument clu-ster). It is important that the safety design includes an additional level forthe safety software. With this two-level principle, this separate softwarechecks the ndings of the control software via validity checks.

Model-b sed development

The control software of the transmission is subdivided into variouslogical subsystems. The engineers at GETRAG FORD Transmissionsdesign it on the basis of a structured analysis. In doing so, they followthe approach of model-based development. In addition to the productdevelopment requirements, they also have to full numerous legal con-ditions in the process.

ISO IEC 61508 is the applicable standard here. It stipulates particu-lar development measures and methods that are largely covered by theV-model for software development also used by GETRAG FORD. When testing, the validation team at GETRAG FORD Transmissionsasked themselves two main questions: which testing methods meet thespecications of the ISO standard for the unit level test? And whichframework is necessary to accommodate the particular features ofmodel-based development? We had to nd a workable solution thatwas applicable across the board as well as being economically efcient,says development engineer Bernd Jakoby. We were unable to nd sucha solution on the market, since the ISO standard does not yet takeaccount of model-based development and the tools for the different tasksin the development process offered only self-contained solutions.

GETRAG FORD Transmissions therefore implemented its owndevelopment and testing process, including an integrated tool solu-tion, S-Test. The name sta nds for security testing and wa s developedin-house as a linking tool.

It primarily links the modelling tool Matlab Simulink from thecompany Mathworks and the CTE XL Test Editor from Daim-ler. S-Test opens selected models from Matlab and creates an XML

le that the CTE XL Editor can convert into test cases. It also spe-cies the required test sequences. S-Test subsequently loads theseles as soon as tests are due to be performed. S-Test then gener-ates the test environment and starts up the relevant test sequen-ces in the Matlab Simulink tool. Then S-Test converts the analysisand documentation of the ndings into les that the CTE XL TestEditor can read out. Finally, these les and the Matlab models arefed back into the Rational ClearCase tool from IBM, concluding thesoftware testing and development cycle in question.

Turnin theory into pr ctice

Once the engineers at GETRAG FORD Transmissions had implemen-ted S-Test, they still didnt know whether their solution would also beusable in practice or if the costs would decrease as hoped. Hermes and Jakoby therefo re contacted the independent softwa re testing specia l-ists at SQS Software Quality Systems. As part of a pilot project, theirremit was, together with other experts at the Fraunhofer Institut IESE(Institute for Experimental Software Engineering), to nd out whetherchecks could be done with the S-Test software at a developer level andwhether the cost calculations carried out previously were in fact realis-tic. The SQS experts were also to a nalyse across the board whether thetesting strategy at GETRAG FORD Transmissions was in line with t hestate of the art i n embedded software development.

SQS was chosen for this because the company had already had expe-rience of testing in automotive engineering and aircraft constructionvalidation projects. The individual steps were as follows: SQS set up a

test procedure, detected errors within the tool chain and estabdocumentation system in close c onsultation with the develop

On the whole, S-Test proved a success, since it is suitable for ntoo as a relatively easy to operate, intuitive tool, says Jrg Hewe still did nd some process ow errors and this enabled usome improvements before issuing it to our colleagues for uthe development division brought in additional aspects of mmeaning that the functions of S-Test also had to be enhanced. step, the quality experts also increased the reusability of the tsince, in practice, the software checks mostly consist of repknown as regression tests.

Both the developers and the testers of GETRAG FORD Transdual clutch transmissions are happy with the solution arBecause the software tests are now easier to carry out, particmany manual steps run automatically, the costs of quality ahave also fallen. On top of this, the current procedure suppcross-test design. Bernd Jakoby is pleased to report that all mcications are now subject to a clear-cut version check. From to the test, we now have an integrated system.

With th is foundation, GETR AG FORD Transmissions i s ctaking the next steps along with four SQS employees. They ading the procedures established in the pilot project to all mthe transmission control software. They are gradually transfernewly-gained expertise to developers. The latter should be ablthe tests themselves soon. This wi ll push automation further adrive costs further down.

8/11/2019 Quality 01 08 Eng

13/21


BEST PRaCTICES BEST PR

the mpac of shor falls n qual y

Sk pe fa lure for almos wo da s:a cha n reac on caused b sof ware faul s

For almost two days, the Voice Over IP (VOIP) and instant messaging servicefailed. Skype says that a chain reaction was to blame, initially triggered by the resa large number of Skype user systems after a software update. Worldwide, a largeof computers of Skype users were restarted within a short period after a softwareThis unusually high number of system restarts affected Skypes network resourceof login requests combined with the lack of peer-to-peer resources then triggeredreaction with grave consequences.

In fact, Skypes peer-to-peer network has an in-built function for repairing itself. Bcase a hitherto undetected fault in the routine for allocating network resources arthwarted the self-repair mechanism. The result was that Skype could not be usemajority of its users for almost two days.

Source: golem.de, 20.08.2007

D n erous or controlled?

Tere is more and more of it. And not only that: it is free. It is under-tandable, then, that open source software (OSS) is becoming increas-ngly popular in commercial system development projects, whichre often subject to considerable cost pressure. Te use of OSS

has to be managed, however, otherwise many a company may ndtself in court.

A legal dispute between the body representing OSS interests,gpl-violations.org, and the voice-over-IP provider Skype and its supplier

SMC, for example, resulted in an IP telephone having to be withdrawnrom the market. It used open source software that infringed the licensingconditions, thereby violating rights and was therefore against the law.

Examples such as this are multiplying as more software producersnclude OSS. The uncontrolled use of open source in large IT pro-ects is therefore fraught with risk. From the companys standpoint this

can be critical for its business, because not only can it result indirect demands for money or demands for full disclosure of theource text, but considerable damage is also liable to be caused to the

companys image.

Tr nsp rency or commerci l secret?

The main source of risk with the uncontrolled use of OSS lies in what isknown as copyright, or in equivalent arrangements under other licenceagreements. In this case the OSS licence calls for the disclosure of sour-ces, including further developments or derivations. The term derivative,n particular, can be interpreted so widely, depending on the licence,hat the mere use of an OSS module will lead to the entire system

being classed as derivative. As a rule though, commercial producersdo not want to disclose all or parts of the source code of their systems,because this source code is usually not only intellectual property butmay well also include commercial secrets. Nevertheless, anyone whowishes to utilise the huge productivity gains to be had from using readi-y available subcomponents from OSS sources with an acceptable degree

of risk needs active licence compliance management (LCM).

For relatively small organisations or projects with manageable levels ofcomplexity, risk assessment can conclude that neither a formal LCM

Usin open source so tw re is not wit out its risksLicence compli nce m n ement elps void t e stumblin blocks

Re d on to discover>> which risks are associated with open source>> why the topic of open source keeps some courts busy >> which form the management of open source software should take

process nor one-off regular examinations of the system are necessary.However, the decision to run such a risk must be taken consciouslyand take account of all relevant information. In short: awareness of thelawful use of open source software must be a given.

Te process of establishing licence compliance management ismade up of four phases:

Denition: First, management must dene the strategy for the software

system that is to be examined. This is generally based on the intendedpurpose and the area of application. The development teams can thenuse the strategy to derive specic rules on the use of OSS components.

Screening:This phase determines the composition of the particular soft-ware system. Specialised tools are not only able to establish the obvioususe of certain components but can also detect secret copying at sourcecode level. Analysis:The results of the screening rst have to be interpreted andvalidated. This may render it necessary to check the ndings against thelicence rules of any OSS components that have been used.

Control:On the basis of the information obtained in the precedingphases, whatever short-term corrective measures that may be necessarycan now be initiated. In some circumstances the consequence may alsobe that long-term changes to the product strategy or even corporatestrategy are required.

T r eted risk control

Companies can also use the results of the LCM process to position them-selves within a maturity model on the use of open source software. Thisproduces a high level of transparency concerning where a company issituated in terms of its LCM and which risks still persist. This gives theIT management a tangible matrix to work with so that it can target therisks and reduce them step by step, and at the same time reach a highermaturity level. The maturity is usually determined by an assessment. A very low level of process maturity, for example, would be classied asunaware by analogy with the CMMI (Capability Maturity ModelIntegration) process standard, while an organisation with a very highlevel of process maturity would be assigned the seal strategically tested. Measuring process maturity in this way according to a level model hasproved very successful in practice. It puts a company in a position tocarry out an assessment of current risks while at the same time advan-cing strategic target setting.

Dr. Frank Simon, SQS AG

aDVER

8/11/2019 Quality 01 08 Eng

14/21


TRENDS TRE

London or New York w ere to list

Why do c ompanies go public? o become better known, ga in accesso capital, create a larger market for their shares and deal on a basis

of equality with major international clients. o broaden their share-holder base and potentially give existing shareholders the chance toxit. o raise their prole with a view to expanding operations into

new international markets. And to reward and encourage employeeshrough the introduction of share incentive schemes.

These reasons particularly apply to companies of all sizes that areconsidering an international listing, and the choice for middle-sizedcompanies is arguably to seek a listing in either New York or London,with a choice in London between the Main Market and the Alternativenvestment Market, or AIM, launched in 1995. Which might it be,

and why?

Eight or nine years ago, a New York listing was felt to be chic, butn the nal analysis the hard nancial facts are what counts. Londons

AIM is the worlds leading market for smaller, growing companies in allbusiness sectors from all over the world. Over 1,500, including severalhundred non-UK companies, are listed on AIM. Its success is due to aimplied regulatory environment that is specically designed for the

needs of smaller companies. The German stock market no longer hasanything comparable.

Unlike most other markets, AIM does not stipulate minimum criterian relation to company size, track record or a set number of shares to

be in public hands. That, for a start, makes it more accessible than theNYSE. It has a simple admis sion process and appropriate regulation formaller companies, and it offers UK tax breaks for investors in AIM

companies.

Compellin re sons

Gaining access also costs less in London, and that means not just thenitial cost but the ongoing costs of c ompliancy with the SECs report-ng requirements and with the provisions of the US Sarbanes-Oxley

T e m rketpl ce o c oice W ic is t e ri t one or middle-sized comp nies?

Re d on to discover>> the benets of an international listing >> why an NYSE listing has lost much of its chic>> where AIM has the edge on US exchanges>> how going public has beneted SQS

Act of 2002. Costs are up to 10 times hi gher in New York tha n inLondon. A UK listing that costs 150k a year can cost between 1mand 1.5m in the United States, and in view of the extent and risks ofliability involved, D&O insurance for companies listed in New Yorkhas become hard to nd at any price.

Not surprisingly, European stock exchanges are raising more newmoney from IPOs and attracting more international IPOs than USexchanges and London leads the way, accounting for more than half

of new issues in Europe. London now employs more people in nan-cial trading than New York, and its trading volumes have in recentyears been much higher than Wall Streets. These, then, are some ofthe compelling reasons why London is the marketplace of choice forinternational companies.

Comp nies pply to delist

Where does that leave the two? London has been successf ul in attract-ing a large number of companies and in trading high share volumesthat generate business for platform operators, traders, and so on. InNew York, SEC requirements have scared off international companies.BASF, E.ON and Bayer are among German companies that are app-lying to the SEC to delist in New York (which, by the way, is easier saidthan done). That still leaves 11 DAX companies listed in New York, butBayer reckons it will save 15m a year by delisting, while its New Yorklisting costs Siemens 3 0m a year. For Martin Graham, the head of AIM, the challenge is to ensure thatLondon does not price itself out of the market with exaggerated regu-latory requirements. As long as it does not make this mistake, Londonwill have the better starting position. New York in turn must ensure thatits regulatory requirements are less exacting, especially for internationalcompanies. Otherwise it will tend to continue to become less attractive. With the current state of the market, fewer companies are oating thanwas the case a couple of years ago. That, however, is not because theywould not like to go public but because capital is harder to raise whenmarkets are volatile. Yet the number of IPOs remains relatively highin London, perhaps 100 a year in the Main Market and twice as manyin the AIM.

And, regardless of the state of the market, the reasons for going publicare unlikely to change much. They are, essentially, to raise fresh moneyfor investment and acquisitions and, in the case of SMEs, partly toenable founders to realise some of the companys value.

goin or intern tion l rowth

Take SQS. In 2005 the Cologne-based software testing and qualitymanagement company became the rst German rm to seek a listingon Londons AIM market. It has doubled its ma rket capitalisation in alittle over two years as a result of listing in London. That has enabledit to make selective regional acquisitions in the UK, Ireland and South Africa and to expand into management consulting with an ac quisitionin Austria. And these acquisitions have to a large extent been paid for in

equity. The capital that was raised also helped to boost organic growthby more than 20 per cent.

Going public has sharpened the companys image and made it betterknown, especially as many of its clients are also listed in a major inter-national marketplace and are able to nd out more about SQS in wayswith which they are fami liar. So SQS feels that the bottom line has beendecidedly positive.

An international listing makes business more transparent aprofessional, and that applies to middle-sized companies andto the DAX 30. It is denitely to be recommended as a way and interested companies should not let themselves be discoumarket vicissitudes.

In particular, companies that are going for international gromight like to nance acquisitions by means of a share issue shsider an international listing, and London is a good choice. L

a crucial factor, and that means trading volumes, which speak selves. Language is another factor, which is why English is pa listing in a country with yet another language.

Finally, a word of caution. Going public is like getting marriedthat must stand the test of ti me. But no company needs to be it must think hard before committing itself.

Paul Bewicke

8/11/2019 Quality 01 08 Eng

15/21


TRENDS TREND

Development m n ers ur ently required

!

Offshore outsourcing of software development is not a zero-sum gamewhen it comes to jobs. It is a false a ssumption that just as ma ny jobst home are lost as are created in India, eastern Europe or elsewhere.nstead, the case is that specialist service providers in particular arereating a multitude of new jobs in central and western Europe.

80 per cent of companies that rely on offshoring, according to a studyby the US consulting rm Booz Allen Hamilton, give cost reduction ashe deciding factor. Yet in the last three yea rs, the lack of skilled lab our

has emerged as a key rea son for pursuing this option. Indeed, whereas,according to the survey, in 2004 fewer than 40 per cent of respondentscited access to skilled labour as a reason for offshoring, last year thisgure had risen to almost 70 per cent.

a hi h dem nd or speci lists

According to the an alysts at Pierre Audoin Consultants, this demandor expertise instead of simply cheap labour is creating a lucrative

market segment for local providers of specialist services and thus alsoobs on the ground. As PAC analyst Melanie Mack observes: Throughhe increasing industrialisation of IT production, the need for specialist

from worker to m n er:IT o s orin is c n in job pro les nd cre tin onsite jobs too

Re d on to discover:>> why IT offshoring is not a zero-sum game>> who benets on site from offshoring >> how the IT labour market in central and

western Europe is changing

staff for quality assurance is on the rise. The primary task of serviceproviders operating in this market is to demonstrate clearly to users theadvantages offered by separate specialists as opposed to system integra-tors. Here, the offshore component must play a key role in the serviceportfolio offered, since the days of steadily growing budgets for softwa redevelopment and testing are over. Providers can respond to the resultingpricing pressure with exible onsite-offshore models, according to thePAC study. The efcacy of the onsite-offshore mix is demonstrated by the successstory of SQS Software Quality Systems AG in the last two years. Salesand staff numbers have nearly doubled in this period. Whilst South African operations in particular showed these high growth rates, theEuropean branches of the company also grew more rapidly than theaverage in the IT service market as a whole.

Not everythin is outsource bleDevelopers and testers at home are therefore affording themselves newcareer options when they get used to working with colleagues whomay be located thousands of miles away. This internationalisationinvolving set tasks remaining on site is opening up new long-termprospects for the home labour force. This is due to the fact that if acustomer wants to achieve his specied time, cost and quality objec-tives through outsourcing, he will still always have to set up a strongonsite team. The experience gained from the SQS projects in South Africa s hows that t he distribution of onsite and offshore resource s ison average 50:50 and that it can take two years at the earliest toreach this ratio. Only a few development projects manage an offshoregure of 70 per cent.

If this remote and local task-sharing is to succeed, the companies andstaff in the West must instigate changes that turn operational devel-opers and testers into managers and process specialists. This is because,for projects distributed internationally, pure programming and testingis becoming increasingly unimportant in western European businesslocations. Instead, tasks such a s project management, requirements andchange management as well a s project preparation are becoming higherpriorities in western Europe. This in particular includes organising theavailable staff and ongoing monitoring of results, progress reportingand the use of resources for the project in question. Control centre workis increasingly at the heart of day-to-day operations.

All this also requires the ability to dea l with the unex pected: whatshould be done if errors are mounting up and t he project looks like itsrunning into difculties? What resources can then be used for prior-itising and assessing risk?

Brid in the p between business nd IT

IT staff are rarely able to answer these questions on their own. Theytend instead to rely on the input of their specialist departments andmanagement. One element of the new job proles for offshoring projects therefore strongly emphasises intercommunication. This in turnrequires intensive training in social and communication skills and adeeper understanding of how business and technical experts in onesown company operate. This need for business expertise affords many former business special-ists the prospect of changing over to IT and developing new career pathsfor themselves at the interface between business and technology. Thusoffshore outsourcing in IT can accelerate the general structural changetaking place in the labour market, provided that companies and staffinvest in the education and training required for this.

A well-wr en n roduc on o es ng SAP

An SAP solution undergoes profound changes over its lifeOn the one hand, it may have to be adapted for business reasexample as a result of mergers or the introduction of new pr

On the other, technological enhancements or adaptations supgrades and support packages are required. Both of these inmake it necessary to carry out repeated, comprehensive tesapplications. For this reason, SAP AG provides its customers wboth procedure models and a complete set of tools for testin solutions. In their book, Testing SAP Solutions, which appeaas part of the SAP Press series, Markus Helfen, Michael LaueHans M. Trauthwein provide a complete, easy-to-understandduction to the subject matter. The book begins with a brief outline of testing methodologyshort introduction to the theoretical principles, an overview of the tasks involved in preparing and executing the softwareThe focus of part two is f unctional testing. This section of thcentres in particular on the SAP Solution Manager, which greasupports test management. On top of this, the authors discueCATT tool from SAP for test automation automatic testing, inding consideration of its cost-effectiveness, as well as the SA TestData Migration Server, which simplies test data managemenal and third part of the book describes and explains perfoand load tests. The authors give an in-depth illustration of cal performance testing procedure and provide detailed inforabout the support offered by tools such as SAP LoadRunner fromHP (previously from Mercury).

As a team, Markus Helfen and his colleagues at SAP provide agood, comprehensive overview of testing in an SAP context. Theinclusion of plenty of graphics ensures the reader has a gooof the subject matter, with the tool descriptions accompanscreenshots throughout. Beyond theory, the authors provide dreports from customers on all aspects of the subject matter, oreal-life examples. The book will provide project and test mwith valuable information and suggestions on optimising te

Philipp Gerber

Markus Helfen, Michael Lauer,Hans M. rauthwein:esting SAP Solutions. Rockville,MD (SAP Press) 2007. 47.99.

Book rev ew

Ren Gawron ...

has been Chief Financial Officer (CFO) of SQS Software QualitySystems AG since 2001. He is primarily responsible for administ ration,accounting, nance, mergers and acquisitions, investor relations andthe consulting rms personnel.

8/11/2019 Quality 01 08 Eng

16/21

8 SQS / QUALITY # 01_08

TRENDS

Tis article examines the experience of environment managementt two organisations and identies some of the common conceptsn approaching the projects as well as some of the recommendationsnd techniques employed.

n the rst, environment services were provided to support the testingon a programme to integrate a replacement billing system with existingystems for a telecommunications provider to ensure a seamless trans-tion for customers.

n the second, an investment banks environment management pro-cesses and tools employed were reviewed. As a consequence they thenmplemented the recommendations alongside a migration of existing

non-production environments from one data centre to another to ensurehe banks business could continue to deliver its competitive edge.

The initial step in both engagements was to understand the currentituation. This included:

Hardware Which hardware and other infrastructure was available?

Application architecture Collation of a software component matrixacross all applications and systems in use by the business or within theelevant group.

Scheduling Understand which environments are required and when.This step is critical to understand and plan demand.

Team dependencies Who has the required technical skills?

Once the current landscape was understood and requirements nalisedan approach was agreed on. Some of the core techniques employed andprocesses that needed to be i mplemented were:

Service level agreements If development and test teams have ser viceevels, their environments need SLAs too.

Team dependencies Reduce dependencies on other teams by auto-mating and transferring knowledge for repetitive tasks from technicaleams to environment management teams.

Access control Ensure that environments can only be modied ina controlled manner.

Shared environments Sharing environments due to lack of hard-ware budget is often false economy as this increases managementcomplexity, causes conict and results in both project compromises andlowed project schedules.

Software components and services Ensure each component hasa reliable and dened packaging, release and deployment mechanism.Preferably the mechanism is automated and consistent betweencomponents.

Audit compliance The test environment is part of the test assetsand the environment build process must be reliable and repeatableto ensure audit compliance for the overall software development andtesting life-cycle.

Environment templates Appropriate selection of software compo-nents into pre-dened environment templates allows development, testand environment teams to work with known congurations of environ-ments to increase famili arity, improve support and reduce environmentdeployment time.

Virtualisation and environment management tools Ensure thathardware is used most effectively and realise the benets of being ableto deploy environment templates instantly. Enable users to self-serveenvironment deployments. In conclusion, environment issues occur across many industry sectorsand with a variety of situations and requirements. Clients can obtainvalue through investing in environment management processes toimprove the overall efciency of the application development life-cycleeffort, including: improving the build and deployment time of newenvironments, reducing the resource required to support and maintainnon-production environments, decreased environment downtime andincreased hardware utilisation and efciency.

Jul an Brook

is a principal consultant for SQS UK. He has worked with SQS(formerly Cresta) since 2000 both in the US and in the UK and is thecompanys guru on test environment management.

Reducin time lost on IT projectsEnvironment m n ement str te ies to elpreduce 40% o time lost to environment issues on IT projects

What if you cant find the 32 hidden risks in this picture?

We know where to look.If you look at a successful company, you will most likely find

it offers something special. For us, thats providing insurance

insight. To help our customers understand where risks are

hidden, we offer one of the largest and most advanced global

risk management networks in the world. Through a Relationship

Leader who serves as a single point of entry, you get access to

highly trained professionals who know your industry, know where

to look for risks and what solutions you should consider. In a world

where risks are changing all the time, that is special indeed.

www.zurich.com/corporatebusiness

General Insurance

Life Insurance

Risk Management

8/11/2019 Quality 01 08 Eng

17/21


ISEB Foundation Course ISEB Intermediate Certicate Course ISEB Practitioner in est Analysis

14.04; 07.05; 28.05; 16.06 London 14.07; 18.08; 18.09; 22.09 London 07.04; 12.05; 21.07; 15.09 Leeds

21.04; 23.06; 27.08 Manc hester28.04; 07.07; 01.09 Dublin

19.05 Birmingham 19.05; 28.07 Belfast

02.06; 06.08 Woking 30.06 Edinburgh

07.04; 28.04; 19.05 London07.07; 11.08 London

21.04; 28.07 Leeds06.05; 04.08 Dublin

12.05 Birmingham 02.06; 08.09 Belfast

09.06; 15.09 Ma nchester16.06 Edinburgh30.06 Woking

01.09 Bristol

07.05; 09.06; 21.07; 01.09 London 19.05; 18.08 Woking 28.05; 27.08 Dublin

02.06 Leeds16.07 Birmingham

04.08 Manchester04.08 Belfast11.08 Edinburgh

ISEB Practitioner in est Management Practical est Estimation Practical esting Processes

12.05; 09.06; 04.08; 27.08 London 07.05; 16.07 Belfast

19.05 Leeds28.05; 01.09 Woking

02.06; 11.08 Dublin02.06 Reading

21.07 Birmingham 28.07 Edinburgh

18.08 Manchester

23.05; 07.07; 15.08 London 07.04 Woking 18.04 Belfast

12.06 Leeds 26.08 Dublin

17.04; 19.06; 07.08 London13.03 Woking

01.05 Dublin09.06; 18.09 L eeds

31.07 Belfast

Advanced esting echniques Requirements estin g Practical est Desig n

15.05; 24.07; 04.09 London 08.04 Woking

05.06 Leeds07.08 Belfast

06.05; 11.07; 19.09 London 10.04 Woking 11.06 Leeds 08.08 Dublin

15.05; 17.07; 11.09 London22.05 Belfast04.09 Dublin

Introduction to Agile esting Practical est Management Practical est Planning

14.05 London11.07 Dublin

12.05 London 07.04; 23.06; 04.08 London14.08 Dublin

esting Basics User Acceptance est Management User Acceptance esting

14.04 London12.05; 18.08 Dublin

22.09 Belfast

15.04; 17.07 London 03.04; 25.09 Belfast

15.05; 21.08 Dublin

17.04; 15.07 London 01.04.; 23.09 Belfast

13.05; 19.08 Dublin

est Management Advanced WinRunner 9.2 Advanced Quick est Professional 9.2

03.04; 11.09 London21.04 Dublin

10.07 London 24.04; 26.06; 31.07; 25.09 London22.05; 04.09 Dublin

F un da me nt als of Load Ru nne r 9.0 L oad Ru nne r 9.0 Ha nds- On L ab L oadR un ne r Vu Gen 9.0 Sc ript ing for t he We b

28.04; 02.06; 30.06; 28.07 London 18.08; 15.09; 29.09 London

16.06; 15.09 Dublin

04.04; 02.05; 06.06; 04.07 London 01.08; 23.08 London

20.06; 19.09 Dublin

02.04; 30.04; 04.06; 02.07 London 30.07; 20.08 London

18.06; 17.09 Dublin

Q C 9. 2: Pr oj ec t P la nn in g a nd C us to mi sa ti on Us in g Q ua li ty Ce nt er 9. 2 U si ng t he Q ua li ty Ce nt er 9. 2 D as hb oa rd

22.04; 20.05; 17.06; 22.07 London 19.08; 16.09 London 15.04; 29.07 Dublin



L oadRunner VuGen 8.1 for SAP Quick est Professional 9.0 for SAP Using WinRunner 9.2 03. 07 London 30. 06 London 08. 07 London

Using Quick est Professional 9.2

21.04; 07.05; 23.06; 28.07 London 27.08; 22.09 London

19.05; 01.09 Dublin

EVENTS EVE

quality 01 08 eng

Documents