Dr. Bill Curtis Director, Consortium for IT Software Quality

The Technical Debt Management Cycle:Evaluating the Costs and Risks of IT Assets

Technical Debt Damages Business Value

2

The Technical Debt Metaphor

33

Structural quality problems in production code

Technical Debt

Principal borrowed

Interest on the debt

Business Risk

Liability from debt

Opportunity cost

Interest—continuing IT costs attributable to the violations causing technical debt, i.e, higher maintenance costs, greater resource usage, etc.

Principalcost of fixing problems remaining in the code after release that must be remediated

Opportunity cost—benefits that could have been achieved had resources been put on new capability rather than retiring technical debt

Liability—business costs related to outages, breaches, corrupted data, etc.

Technical Debt the future cost of defects remaining in code at release, a component of the cost of ownership

4

How to Use Technical Debt

Estimate ofTechnical Debt

Calculating CostOf Ownership

Explaining IT Cost of Quality

AssessingBusiness Risk

Managing Portfolio Quality

CAST’s Application Intelligence Platform

5

ApplicationAnalysis

Evaluation of 1200+ coding &

architectural rules

Application meta-data

Transferability

Changeability

Robustness

Performance

Security

QualityMeasurements

Detected Violations

Expensive operation in loopStatic vs. pooled connections Complex query on big tableLarge indices on big table

Empty CATCH blockUncontrolled data accessPoor memory managementOpened resource not closed

SQL injectionCross-site scriptingBuffer overflowUncontrolled format string

Unstructured codeMisuse of inheritance Lack of commentsViolated naming convention

Highly coupled componentDuplicated codeIndex modified in loopHigh cyclomatic complexity

Language Parsers

Oracle PL/SQLSybase T-SQLSQL Server T-SQLIBM SQL/PSMC, C++, C# Pro CCobolCICSVisual BasicVB.NetASP.NetJava, J2EEJSPXMLHTMLJavascriptVBScriptPHPPowerBuilderOracle FormsPeopleSoftSAP ABAP, NetweaverTibcoBusiness ObjectsUniversal Analyzer for other languages

Technical Debt Management Cycle

6

IT ExecutivesApplicationManagers Developers

Set policy and quality priorities

Step 1

Build/Release/QA/AI Center

Set thresholds for app quality

Step 2Measure

Technical Debt

Step 3

Plan reduction goals & actions

Step 4

Remediate violations

Step 5

Track results

Step 6Report to the

business

Step 7

7

Step 1 Set Policy and Quality Priorities

Quality Policy

Corporate purpose

Expected behavior

Training

Reporting

Audit

Quality Priorities

Customer-facing

Internal business

ReliabilityPerformance

SecurityMaintainability

ReliabilityPerformance

SecurityMaintainability

8

Step 2 Set Thresholds for App Quality

Retail Website

Product information

Online purchase

Delivery scheduling

Reliability 3.5Performance 3.5Security 3.9Maintainability 2.5

Reliability 3.8Performance 3.9Security 2.5Maintainability 3.0

Reliability 3.5Performance 3.0Security 3.9Maintainability 2.5

Step 3 Measure Technical Debt

10

Step 4 Plan Quality Goals & Actions

Releas

e 5

Releas

e 6

Releas

e 7

Releas

e 8

Releas

e 9

Releas

e 10

Releas

e 11

Releas

e 12

2.52.72.93.13.33.53.73.9

ReliabilityPerformanceSecurityMaintainability

Scor

e

Quality Score Target by Release

11

Step 5 Remediate Violations

PortfolioQA Data

Repository

App Management

12

Step 6 Track Results

Releas

e 1

Releas

e 2

Releas

e 3

Releas

e 4

Releas

e 52.6

2.8

3

3.2

3.4

3.6

PlannedActual

Perf

orm

ance

Effic

ienc

y

AppDevExec

Step 7 Report to the Business

13

Resilience

Efficiency

Security

Transferability

Changeability

Quality Category

Outages, slow recovery

Degraded response

Breaches, Theft

Lengthy comprehension

Excessive effort

Operational problems

Availability

Work efficiency

Data protection

IT productivity

Delivery speed

OutputMeasure

Business risk

IT cost

Technical debt

Reducing Technical Debt Is Imperative

14