The Rule Maturity Model: Five Steps to an Agile Enterprise

"It is not the strongest of the species that survive, nor the most intelligent, but the one most responsive to change." — Charles Darwin

No one doubts that business agility is important. It's a competency that enables organizations to be fast and first — first to introduce new products, first to embrace new business models and first to pioneer new markets. Business rules are a crucial enabler of agility because they offer levers by which business managers can implement competitive strategy, promote and enforce policy, and ensure compliance with legal and regulatory requirements.

Unfortunately, most organizations have little awareness of business rules because they're buried in code within legacy systems, poorly detailed in long-forgotten documents or, worse, stuck in people's heads (and we can only hope they haven't retired). For these organizations, the cost of change is high, the speed of change low and the impact of change unpredictable.

At the opposite extreme are the few organizations that have defined business rules in a separate repository so they can be changed at will and applied enterprisewide at the speed of business change. For these firms, the impact of change is predictable and governance policies and procedures are in place to foster agility while ensuring business continuity.

So where does your organization fall in this broad spectrum? This article presents a Rule Maturity Model (RMM) that offers a simple, practical roadmap by which organizations can align business objectives with business rule management practices for achieving those objectives.

Rule Maturity Model Basics

The RMM has six levels from 0 to 5. As described above, a Level 0 organization is scarcely aware of the value of rules while a Level 5 organization uses business rules as proactive levers for change and compliance, seeing into the future and gaining momentum over the competition.

Each level of the RMM represents a major business objective with respect to business rule management:

Level 1 = Knowledge of Rules

Level 2 = Agility of Rules

Level 3 = Consistency and Alignment of Rules

Level 4 = Prediction of Rules for Short-term Futures

Level 5 = Stewardship of Rules for Long-term Future

As detailed in the table at right,

each RMM level creates an alignment between organizational objectives and corresponding business rule management practices, and maturation to each next level implies advances in roles, processes, technology and culture.

An RMM assessment is an evaluation of the appropriate level for a particular business opportunity or challenge. Higher RMM levels are not always better than lower ones. The goal of the assessment is to determine the level that delivers the most value at the least risk, cost and cultural impact. It's a good business practice to start at lower levels in the model and move up incrementally. Certain aspects of the business may target lower RMM levels, and it may even be appropriate for certain aspects of the business to remain at Level 0.

The detailed RMM diagram below

depicts the Business Value, Technical State and Business Control vectors of the model. Surveys show an interesting phenomenon in which inconsistent maturity levels within an enterprise can cause unexpected and possibly devastating problems. As an example, you might achieve maturity level three on the Technical State vector by delivering sophisticated rule authoring software, but if your organization is a maturity level two on the business control vector, you may be putting that power into the wrong hands. Most shortcomings in business rule deployments can be traced to inconsistent achievement of RMM levels across these vectors.

In some enterprises, the cost and effort required to achieve high RMM levels may have little value. Thus, it's most important to understand where and when higher levels of maturity become strategically important, based on business demand, competition, market changes and constraints such as budget, timeframe, and available technology.

Achieving one level is a prerequisite and first step toward achieving higher levels of maturity. The sections below describe each level in detail and include examples of the cost-benefit implications of reaching that specific maturity level. (For more information on the RMM and related materials, click here and register for free downloads.)

Getting Started: Maturity Level 1

Most organizations and IT projects today are at Level 0. A Level 0 organization is unaware of business rules and their importance. The rules are hidden, buried in process descriptions, manuals, or in system designs where they're likely to be lost, unknown and resistant to change. No one knows where to start looking, where to stop or how long it may take to find certain rules. Even more concerning, rules are not managed rigorously as strategic levers for achieving objectives.

Simple rules might state that "a premium customer is every customer with a credit rating for A or B," or "if a premium customer requests a loan of more than $500,000, allow a delay in the first payment date of 30 days." People operating at Level 0 carry out business transactions without knowing what the rules are or where they are executed in business processes or automated systems. The organization survives with rule changes that are difficult, time consuming and costly.

An RMM Level 1 organization seeks knowledge of some of its rules and it separates them from other business or requirement artifacts. A Level 1 organization captures the rules in a simple manner on a project basis, with minimal investment in new software or commitment of organizational roles to the task. Rules are typically free-form rule statements, stored in documents, spreadsheets, simple extensions to modeling or requirements tools, or in a relational database with rule-related metadata. Business people know where to find these rules and can trace them to business processes and systems. This traceability ensures shorter rule-change cycle than experienced at Level 0.

Because rules are separated without much rigor at Level 1, they take on the characteristics of new-business or new-systems requirements. Business experts provide input and review the output, but they do not play a direct role in creating the rule statements for the rule repository. Agility is in its infancy at Level 1, which is why most organizations that launch rules initiatives aim for Level 2 (at a minimum).

The objectives in reaching RMM Level 1 are business-oriented, and this is the only level you can achieve without investments in new technology. In one real-world example, a company with automated transaction systems hoped to minimize the number of exceptions routed to employees for human intervention. The company had a short timeframe and a small budget for the project, but nonetheless, achieving Level 1 proved valuable. The project began with an effort to separate the rules for human exception handling by capturing them in Microsoft Excel and tracing them to program code. In the course of the project the company documented process models, identified where rules operated and mined the explicit rules from code. Project managers then worked with decision makers to craft new rules, they ran reports to verify the new rules, and they passed the specifications on to IT, which implemented the changes.

This project required no investment in software or organizational change, yet it made it possible to trace rules to processes and systems, it ensured faster and easier rule change cycles, and it enabled the organization to monitor the impact of rule changes over time.

Stepping Up: Maturity Level 2

An RMM Level 2 organization aims for agility in its business rules, adopting rigorous approaches to capture and manage them. A Level 2 organization separates the rules from other assets using a well-defined rule authoring process in which it creates new rules or changes existing rules, gains business approval, analyzes and tests those rules and finally puts them into production (if automated).

A Level 2 organization is well positioned to take advantage of a Business Rule Management Systems (BRMS) because rules are expressed in a form that's closer to that needed for automation. In addition, this level demands separation of rules and traceability of rules to business systems and system artifacts, both of which are well supported by BRMSs.

Organizations aiming for Level 2 typically store rules in a rule repository (something more sophisticated than Excel) that is used by business and technical people. The repository also captures standard terms and related reusable rule clauses, and it enables robust rule reporting and analysis. Rule-related roles are defined and the notion of project-level rule stewardship has been established. Typically, a BRMS is used for automated rules. The responsibility for creating business rules is shared by business analysts and technical people.

The Oregon Public Employee Retirement System (OPERS) moved up to RMM Level 2 in response to regulatory requirements, litigation concerns, audit concerns and the need to support rapid, cascading rule changes. OPERS wanted benefits including separation of business rules from other considerations and direct involvement of business people in rule change. The organization took a Business Process Management (BPM) approach, and it used IBM's Rational RequisitePro requirements management tool to capture rules and collaborate with business teams about rule change.

OPERS organized rules into "families" by various processes and activities. Within each family, rules cascade from the "parent" rule into specific, detailed rules required in the process or activity. RequisitePro can spot relationships between rules that are traceable to the same processes and activities, and OPERS can also quickly identify rules that are affected by changes in underlying processes and activities. The organization's business rule template is divided into sections identifying the source (statute paragraph, family and so on) and the actual rule language (including examples as necessary).

Contrary to what's typical for Level 2 organizations, OPERS did not employ BRMS technology. Nonetheless, it achieved rule-change agility with the combination of a repository and strong business involvement. What's more, responsibility for documenting and specifying rules and rule change passed from IT (QA) to primary business users. Where the rule change-approval-test-and-deploy process used to take two to three weeks, cycle times are now down to three to five days.

Getting Consistent: Maturity Levels 3

An organization aiming for RMM Level 3 seeks consistency among rules and alignment to current and changing objectives. Achieving Level 3 demands business rule governance across projects, systems and perhaps even business units.

A Level 3 organization identifies business-driven benefits for standardizing or sharing cross-project business rule techniques and automated business rule services. Business Rules Centers of Excellence are common in these organizations, and multiple BRMSs are often deployed, with common business rules techniques, standards and roles shared across those systems when appropriate.

Maturing to Level 3 is a significant step that demands cross-organizational rule governance and a more sophisticated rule repository. It also requires that roles and responsibilities are assigned around rules and that that these individuals collaborate to maximize rule coordination and reuse.

Level 3 introduces automated rule analysis and simulation capabilities, and rules expressed in business-friendly languages can be translated into executable rules automatically or with the aid of intelligent software. Business analysts or business experts can author, change and test rules without the aid of technical people. Usually, but not always, technical people put the rules in production.

Freddie Mac, the mortgage finance giant, has matured to Level 3 as part of its drive toward continuous service improvement, quick response to dynamic market conditions and competitive advantage. In particular, the organization sought to standardize rule authoring and automation options across projects. The approach included the creation of a Business Rules Center of Excellence, adoption of ILog's JRules BRMS, and the establishment of standards and processes for business rule governance. Freddie Mac credits the rules approach and BRMS deployment with speeding the implementation of new loan programs by as much as five times over the previous approach in legacy systems.

Rule Mastery: Maturity Levels 4-5

An organization at RMM Level 4 sees business rules as predictions for future success and safety. Business people hypothesize about future events and how the organization will respond in a carefully pre-calculated manner, planning for acceptable impacts on the client base, revenue, profit and staff levels. They do so by crafting rule sets and testing, simulating, comparing and storing those sets in anticipation of related threats and opportunities.

A Level 4 organization anticipates and manages its destiny, creating its own, safer world. It employs tools for capturing and analyzing rules, developing metrics against which the desired impact of rules are managed. Business analysts and business experts proceed confidently from understanding future business objectives to simulating rules within that future context.

An organization aiming for RMM Level 5 embraces the stewardship of business rules, which means business rule governance is built into business processes, the processes can be continuously refined, and the organization can reinvent itself as necessary. Level 4 organizations look out over a short-term horizon while Level 5 firms have a longer-term perspective.

Level 4-5 organizations are rare today, and, indeed, this level of maturity isn't appropriate for all industries. Rule management technology is widely used in the financial services industry, so investment was seen as critical at Pershing LLC, which provides processing services to than 1,100 institutional and retail financial organizations and independent registered investment firms. A subsidiary of the Bank of New York, Pershing has achieved aspects of Levels 4 and Level 5 maturity in a drive for consistency and reliability in the face of financial market volumes, and conformity across business processes addressing compliance, credit and business risks.

Pershing wanted the benefits of enterprise-level rules that could be shared and applied across the organization. The company couldn't find off-the-shelf technologies that would meet its stringent compliance requirements and transaction volumes, so it built its own enterprise rule engine and developed rules that could be broadly applied but customized by individual business units. The effort bolstered rule reusability, uniformity and regulatory control, and Pershing now processes orders more quickly and efficiently, according to Ali Quraishi, a director in Pershing's Technology Group. When market conditions change, the firm can quickly respond, with business experts driving the rule changes.

Dell Financial Services LP (DFS), the financial arm of Dell Computer, is another firm that has achieved aspects of Level 4 and Level 5 maturity. The company's goal was to develop a new technology platform and reinvigorate the entire originations system. Its approach was to develop an enterprise policy hub comprising Fair Isaac's Blaze Advisor BRMS, the Falcon ID solution for credit fraud detection, and the Capstone Intelligent Data Manager for credit bureau data access. DFS says the implementation helped it become a more predictable organization, enabling business managers to assess the impact of business changes across channels, conduct what-if analyses and optimize the rules. Fraud detection has improved and the time to market for new financial services offers has been cut from six to nine months down to weeks.

Seeking the Right Level

The relationship between business and IT evolves as a firm matures from one level to the next. At higher levels of maturity, the sophistication of the methods and software lets business people do most of the rule authoring, analysis, testing, simulation and implementation. In the most recent advances of BRMS products, rule management, rule authoring and rule analysis steps can be handled to some extent by less technical business users. Another trend is the emergence of Enterprise Decision Management, which combines historical data with analytical models to predict and suggest better rules (see related Q&A interview with James Taylor, coauthor, with Neil Raden, of the new book "Smart (Enough) Systems" ).

The RMM is a tested roadmap by which organizations set realistic business rule expectations and design a practical roadmap for getting there. It keeps firms grounded in a step-by-step business rules approach, customized to target business objectives, not just technical goals. Use the RMM as a guide for matching business benefits to appropriate business rule investments, defining first steps and keeping a longer-term vision in sight.

Business in certain industries may be won or lost on the level or rule maturity. As one organization in an industry reaches a higher RMM level, it raises the bar for its competition. The right level in your industry may be a moving target. Experiment with lower levels and aim for higher ones only if and when doing so will make a significant competitive difference. The best approach is to take it one level at a time. Using the Rule Maturity Model, you can realize the vision of the Business Rules Approach, which is intended to enable business leaders to take control of the guiding levers of the enterprise, and enable technology to match the rate of business change.

Note: This article is based on an excerpt from the recent book, "The Business Rule Revolution," an anthology of business rule experiences edited by Barbara von Halle and Larry Goldberg. To learn more about the book, click here to register and gain free access to rule-related resources.

Barbara von Halle is founder and a managing partner of Knowledge Partners, International LLC (KPI). She is responsible for evolving KPI's business rules KPI STEP and its Rule Maturity Model (KPI RMM) and for ensuring their proper use across industries. She is well known for her pioneering work in the area of business rules, including writing and consulting work as early as the 1980s.