Taming the Wild Business Rule
by Alan S. Koch, PMP
Many BAs aren't clear about what a Business Rule is in the first place.
Q: A Business Rule is a type of requirement, isn't it? (After all, BAs are all about requirements!)
A: No. It is a rule that must be followed in a particular business context.
Q: If Business Rules aren't requirements, then why do I care about them at all?
A: Because they can be a source or cause of requirements for your project. For example, a Business Rule may specify how the system or the business process must do certain things. Or some of the steps in the business process or functionality of the system must enforce some particular rules.
Q: So a Business Rule is like a law or a regulation?
A: Close, but no. Laws and regulations must be interpreted to determine how they affect a specific business or situation. Compliance professionals do this sort of interpretation and define the Business Rules the organization must follow to comply. But not all Business Rules come from laws or regulations.
Q: Where else do Business Rules come from?
A: They could be necessary to comply with contracts. Sometimes it is a matter of adhering to industry standards or best practice. Or senior management may simply decide that they want the organization to operate in certain ways.
Q: Oh! So a Business Rule is a Policy!
A: Not really. Policy statements are generally high-level directives that can apply to a variety of cases. (For example, a business might have a policy of complying with a specific regulation.)
Q: But I've seen policies that get really specific about who must do what! Aren't those Business Rules?
A: Some well-written Policy documents include a list of roles and responsibilities to illustrate how the policy applies in specific situations. Each item listed under these Roles and Responsibilities might be a Business Rule (or nearly one, needing some minor clarification). But there is no guarantee that they will cover all cases where the policy applies.
Q: So our organizational policies are a good place to look for Business Rules?
A: Some Business Rules apply to the entire organization, but many are narrower in their reach, applying only to certain divisions or departments, or in some cases, only to one business process. They also might be necessitated by contracts or industry standards.
Q: You mentioned "compliance professionals." Who are they?
A: Most large organizations have departments or groups of people who do this sort of work. You may have to ask a senior manager to point them out.
Q: If we don't have a compliance group, then who does this sort of work?
A: In that case, compliance is the responsibility of various managers or subject matter experts.
Q: Thanks! Now I can find our organization's Business Rules.
Business Rules are often not documented.
Q: Help! I am having trouble finding our Business Rules!
A: Where have you looked?
Q: I started with our organization's Policy book. Some of the policies had obvious Business Rules, but many didn't! Then I went to the various departments. Almost no one has a policy book! The exception was accounting, where they have a policy book that is full of business rules.
A: Not surprising. Did you verify that the rules you found were up-to-date and valid?
A: Where else have you looked?
Q: I found a group who is responsible for compliance with data-protection standards. But they told me they don't have a set of documented business rules. They said they would be glad to answer any specific questions I may have. They also said they need to review and approve my System Requirements before they are implemented.
A: That's what those folks usually say. Where else have you looked?
Q: I checked with our contracts department. They have very specific rules about writing contracts and enforcing them. When I asked about rules in the contracts, they said that all contracts are different. If I asked about a specific contract, they could pull it and tell me what rules were written into it. But I have no idea what contracts might be related to my project!
A: No doubt. Where else have you looked?
Q: I'm out of ideas! If I find nothing written down, or if I can't trust what is written down, where do I find the Business Rules?
A: Elicitation, baby! During elicitation activities, you must validate the Business Rules you find in written form to be sure they are accurate and up-to-date, and you have to elicit additional Business Rules that may have never been written down.
Q: Of course! That's what I'll do.
Most people don't know what a Business Rule is, so asking people about Business Rules often results in no useful information.
Q: So I added this to my interview questions: "What Business Rules apply to this project?" What a waste! Most people just stared at me blankly, and some asked what a Business Rule is.
A: Did defining the term help?
Q: Some of them ventured a few ideas, but I seriously wonder if they really are business rules. Some of them just sound like the way they happen to do their work.
A: What about the people who knew what Business Rules are? Did you get good information from them?
Q: None of them could give me documented Business Rules. They just started rattling things off and I did my best to take accurate notes. But looking at all of my notes, I see that they are all over the map. And some things people said contradict what other people said. Asking for Business Rules doesn't work, so how can I elicit them?
A: You have to use the BA's most powerful question: Why?
Q: What do you mean?
A: When someone says that the system must do something, find out why. Ask follow-on questions to determine if it is just the way they want it to work, or if it must be that way because of a policy, law, regulation, contractual term, or other immutable thing -- in other words, because of a Business Rule. Then if that is the case, keep asking questions until you understand the Business Rule itself.
Q: But if the person just told me the requirement, why do I care about the Business Rule?
A: The requirement the person was talking about may not be the only requirement that comes from that Business Rule. After you have discovered a new Business Rule, your elicitation must include looking for other requirements that it may trigger.
Q: Wow! That is really important! And, I guess I should be doing that for all of the business rules I discover, right?
A: Absolutely! I would say something like, "We have this rule" (and I'd describe it), then ask, "Does that affect what this system must do?"
Q: So if I am finding all of these Business Rules in so many different places, how can I validate them and get rid of the contradictions?
A: That becomes its own elicitation effort. For each Business Rule, you must identify the managers or Subject Matter Experts who would know about it, and ask them explicit questions about it -- especially about apparent contradictions.
Q: Alright! I'm going to go out and find those Business Rules and the requirements they cause!
BAs usually miss the opportunity to build a central repository of Business Rules.
Q: So I just nailed down the Business Rules that are relevant to my project, and I found several system requirements that had not come out before! This really works. Now I have a whole list of business rules in a Word document. What should I do with these business rules? Where do I put them?
A: Part of your job as a BA should be to capture Business Rules in written form so everyone can reference them, and so you and others don't have to rediscover them again in the future.
Q: That would be great. But how and where?
A: It would be best if you collaborate with the other BAs to create and maintain a repository of the Business Rules each of you discovers as you do your work. If you do that, then over time the issues we've been talking about will go away because there will be an authoritative source of Business Rules that you can reference!
Q: That would help with requirements work. But what about everyone else in the organization?
A: As you are building this repository, make it available to everyone in the organization so they can see what is in it when they need to. Also, inform managers at all levels about it and ask them to tell you whenever a Business Rule is created or changed so you can keep the repository up-to-date.
Q: What if we discover that someone else already has a Business Rule repository? For example, the Accounting department has a complete list of their rules.
A: I would work with them to merge all of the information into one repository if possible. (The BA group doesn't have to own the repository if someone else needs to.)
Q: I can't imagine the Accounting department wanting to give up their list of rules or add all of ours to it! What is the best way to deal with them?
A: I suggest you ask about putting their rules in the central repository; they may be more receptive to the idea than you think. But if they want to keep their rules separate, you can either point to their list from the repository, or copy their rules into the central repository regularly to be sure they are up-to-date.
What does the BABOK say?
Q: I am going to be sitting for the Certified Business Analysis Professional (CBAP) certification exam soon. What is a Business Rule, according to the BA Body of Knowledge?
A: The BABOK Guide V3 Glossary says this: "business rule: A specific, practicable, testable directive that is under the control of the business and that serves as a criterion for guiding behaviour, shaping judgments, or making decisions."
Q: Wait! That starts with a whole string of adjectives! Why is each of them important?
A: Well, "specific" means that each rule should apply to a specific situation, as opposed to being a generic statement. Remember the Policies? They start with a generic policy statement, but in the Roles and Responsibilities section, they list specific instances and how that policy applies in each case. Those specific items are Business Rules.
Q: And What the heck does "practicable" mean?
A: The BABOK Guide clarifies it this way: "needing no further interpretation for use by people in the business." In other words, it is explicit, leaving no room for misinterpretation.
Q: And "Testable" means…?
A: The rule is documented with enough clarity that a business process, software system of set of activities can be objectively evaluated (or tested) to determine if they comply with the rule.
Q: And why do they include the phrase, "is under the control of the business"?
A: That is to distinguish Business Rules from rules that are imposed from outside the organization; things like regulations and industry standards.
Q: Wait a minute! You said a while ago that business rules can come from regulations or industry standards. Oh, wait, I just answered my own question. Business Rules may come from regulations, but they aren't regulations.
A: That's right! Our compliance people tell us the Business Rules we must follow in order to comply; and those people are within the organization.