Are external audits covered by PPQA PA?

PPQA and the CMMI do not preclude the use of external resources to perform PPQA process and work product audits. You can “outsource” this activity and still be compliant with the CMMI. However, from a practical implementation approach, this is not a good practice. Do you really want a group/company/consultant who does not have a vested interest in the success of your organization/company to be the eyes and ears of senior management? Just as you want to avoid internal bias and filtering by management internal to the organization when reporting PPQA results, you want to avoid other kinds of bias and filtering by outside factors. For example, there is the risk that an outsourced PPQA group may filter the results so they can grow their presence in your company when it is not justified. When an external company has an active sales and marketing force, there is always pressure to “grow” the account. In addition, what if the external PPQA provider has to pull their resources from you to use on a different project? That will not benefit your organization.

Here is a analogy that might be a bit of a stretch. We have a cleaning service for our home. Every three weeks or so the agency sends some cleaning ladies to our house. Sometimes there are two ladies and sometimes three. There have been occasions when the same ladies come multiple times. Whereas at other times they send new ladies. Therefore, there is no consistency from cleaning visit to cleaning visit. Some ladies do a better job than others. And despite the feedback evaluations we send in after each cleaning visit asking that they continue to send the ladies we are pleased with, there is constant churn. The churn may be due to attrition and hiring of new staff or growing business where the excellent cleaners have to support a larger client base and train new ladies. At any rate, this type of behavior could happen to you if you outsource your PPQA function. That is why I strongly recommend building an internal PPQA capability. Who better to objectively evaluate your processes, procedures, and work products than internal people? And besides, I have found that internal PPQA people are much harder on the organization, thus driving greater benefits, than external people.