What do we normally mean by an ASPICE Assessment about? You will usually encounter an ASPICE Assessment if you work for a supplier where you’re developing automotive electronics. Your customer expects your applied processes to meet certain criteria.

With the criteria of ASPICE in mind, you can design processes in a purposeful way. The quality of your processes can affect the reliability of your product. Surprised? Let's say you can't control the configuration of a major release. Then your customer fails to integrate your system into the car. The consequence: Just because of the missing system, the car manufacturer has to postpone the start of production. Reliable processes can therefore be mission critical! ASPICE provides you with elementary process criteria based on industry experience.

Hence, the assessment is designed to evaluate whether your processes reflect these criteria. To do this, an assessment checks the implementation of a process against the process requirements specified by ASPICE.

Many professionals feel uncomfortable when it comes to an assessment: Your customer may send a third-party person to your organization who evaluates your processes extensively. At the end of the day, the customer is told the level of capabilities in the assessed project. You, in turn, will benefit from report of an ASPICE Assessment that provides guidance for process improvement. 

An ASPICE Assessment this is the evaluation of the capabilities that exist within your R&D processes.

Automotive SPICE is derived from the acronym for SPICE: Software Process Improvement and Capability Determination. So, the last character stands for dEtermination – the capability level reached by your processes. Ultimately, ASPICE is a process assessment model for determining the capabilities of your development processes.

Since your customer requests the assessments, the assessment scope contains a selection of processes that are performed in the customer’s project. The capability level therefore refers to these processes - ASPICE assessments usually do not cover the entire R&D. If you work for car maker A, the assessment only refers to processes applied to projects for ca maker A. Processes for car makers B and C are not considered. 

With ASPICE, there are only assessments, no audits. In other domains, there are exhausting debates about their distinction: An audit is against the process and refers to a management system. For this, the evaluation follows a binary logic, determining only whether the requirements have been met or not. 

An ASPICE assessment examines your processes based on actual evidence: To the assessor, you must use work products to prove your processes meet the requirements. In the ASPICE assessment, you are asked only about the ASPICE requirements - not about additional internal process requirements.

In doing so, ASPICE takes a much more fine-grained approach than an audit: instead of simply determining whether you passed, ASPICE looks at many parameters. This starts with what are called base and generic practices: These practices reflect good industry practice. Here, you list the process requirements necessary to achieve the process goal (process outcomes). You use work products to demonstrate the implementation of these practices. This gives the assessor an indication of process capability. Thus, he can apply a process attribute to the process and evaluate it.

The assessment then reveals the extent to which certain processes, or their attributes, meet the ASPICE requirements. So, you’ll get one level statement per assessed process. Based on a matrix, this statement aggregates the ratings of base practices, process attributes, and capability levels to an instance. In the end, a detailed picture emerges of how goal-oriented the project's R&D processes are, and where there is potential for improvement. This makes an ASPICE assessment a valuable asset.

An ASPICE Assessment covers a set of processes in a particular project.
There, it extensively determines the potential for process improvements.

What is the purpose of your ASPICE assessment? Do you want to provide a basis for process improvement, or do you want to determine process risk that could have an impact on a specific release?  An ASPICE assessment supports both goals, but the approaches differ. 

• Process improvement assessments identify strengths and weaknesses of the processes: In other words, are the processes fit for purpose? With this information, you can redesign your processes to mitigate weaknesses. Use this type of assessments used in the process improvement phase, and to prepare preparation for a product risk assessment.
• Can you encounter quality risks effectively? To find an answer to this question is the intent of a product risk assessment. In a release, the assessment represents the customer's view who wants to get a reliable product in time.

Let me give you a practical example to explain: SWE.6 is the Software Qualification Test process. In a process improvement assessment, we review the implementation of the process against the ASPICE process requirements. For this, we are inspecting appropriate examples. One fifth of the requirements are sufficient for a test here.  

On the other hand, in a product risk assessment, if only 20% of the requirements had been tested for a release, then there is a significant risk that the software will not function properly.

Whether your assessment scope is on a product improvement project or on product risks, the assessment is about the capabilities associated with the processes.

Since independent individuals evaluate a set of processes in a specific project of your team, the assessment structure reflects the interaction between the outsider and you and your team members. I would like to show you an illustration that reflects the typical phases and activities of an assessment process. Some activities are in the responsibility of the assessor, others are the tasks of your team and your organization. You can also distinguish between activities that are performed at your location from others that are performed remotely.

There are three phases of the assessment process:

• Preparation phase
• Execution phase
• Coclusion phase

The assessment preparation is mainly dealing with planning the assessment. The assessment scope is defined as well as the objectives and other factors that influence the assessment. The result is an assessment plan with all necessary data for the assessment as well as an assessment agenda, which is coordinated between the lead assessor, the sponsor and the organization to be assessed.

An important part of this is the assessment scope definition which contains mainly: processes, capability levels, instances, parts of the product, teams and locations.

An important planning decision is also to determine the assessment use case: Do we speak about a

• Process improvement assessments or a
• Process-related product risk assessments?

You learned more on these different use cases in my initial video.
On the chart, you can see four activities with the preparation phase:

1. Initialization,
2. Planning
3. Document screening
4. Team preparation

The assessor moderates the initialization meeting with the sponsor and the representative of the project being assessed.
Planning the assessment process and reviewing documents are among the important preparations of the lead assessor. As a team leader, it is advisable that you also instruct your project team. How best to do this is the subject of another video.

An assessment is most efficient when performed on site and in person. In the opening briefing, the assessment usually begins with a short introductory session. The lead assessor provides a presentation to briefly introduce the concept of ASPICE, the assessment process and the scope of the assessment. After this, a representative of your company presents the product, the project, and the organization.

The interviews and documentation reviews are then carried out according to the agenda. The actual interviews on the processes start with

1. Project management,
2. Quality assurance and
3. Configuration management.

With these crucial processes the assessors will receive a good insight into the project. This is followed by the engineering processes according to their natural sequence. This sequence is important because these processes build on each other.

For example, to check the traceability of the system tests to the system requirements one need to have previously understood the structure of the system requirements.

After the engineering processes, remaining support processes and supplier monitoring will follow.

Between the interviews, the assessment team performs consolidation sessions. There, the evidence recorded are reviewed and consolidated, and the practices and process attributes are rated. These consolidations and their results are confidential. The main reason is that ratings may need to be revised later due to new evidence.

At the end of the assessment the assessors present the results.

The final phase gives an assessment report. An assessment report shall provide your team with information about

• The capability levels. Your processes are rated individually due to certain parameters. The assessor calculates them with a rating formula.
• The rationale why the assessor made the rating decision: For this, he or she justifies the impact – or absence – of relevant process outcomes.
• The statement of how the evidence provided relates to process requirements of ASPICE. a detailed description of the identified strengths, weaknesses, and observations per practice
• The reference of the seen evidence to the documented observation
• A management summary to identify most crucial aspects of the assessment.

If you want to learn more about the formal process of an assessment, you will find a solid presentation in the Automotive SPICE Guidelines.
So, with the three phases you’ve learned the structure of the ASPICE assessment process, from preparation to execution and reporting.
As in any process, there are different roles in an assessment. I would like to talk about this briefly with you.

There are three major roles, lead assessor, co-assessor and sponsor.

Let‘s start with the lead assessor. This person is responsible for the formally correct execution of the assessment. The required qualification for a lead assessor is the Automotive SPICE Competent or Principal Assessor level.

The Lead assessor is the person who

• Communicates with the assessment sponsor
• Plans the assessment
• Ensures that the assessment team is qualified and covers all aspects necessary to consider as assessment context, e.g. cybersecurity or functional safety
• Ensures that the assessment is conducted according to the requirements of the assessment process
• Ensures the correct assessment documentation.

An assessment team consists of at least two assessors, the lead assessor and one or more co-assessors. These must be certified with the VDA QMC, otherwise the assessment will not be recognized by most OEMs. For an independent assessment, at least the lead assessor must be from another organization.

The sponsor of an assessment is responsible for:

• Ensuring that the assessors have a valid certification.
• Ensuring that the assessment team has access to all necessary resources.

The sponsor is the person who commissions the assessment. He or she receives the assessment report and decides whom to share it with. Think of your sponsor as your sparring partner: he or she is an outsider to your project, but highly interested in its success. If the sponsor comes from your own company, he or she is usually a member of senior management. If a manufacturer commissions an assessment from a supplier, the supplier‘s representative becomes the sponsor.

Furthermore, it has proven useful to appoint an assessment facilitator for each site who takes care of the organization of the assessment.

To summarize: In an assessment, you need at least three important roles: the lead assessor, one or more co-assessors and the sponsor from your senior management.