Jennifer Bonine: All right. We are back with our last few virtual interviews for the day before we're a wrap, and you guys get the last keynote out of our virtual STAR conference this time. I'm here with Griffin Jones. Griffin, thanks for joining me.

Griffin Jones: Thank you for inviting me.

Jennifer Bonine: It's great to have you. We've talked before at conferences, but for those people that maybe don't know your background or your passion around this space, let's talk a little bit about what you do so they know where your focus and body of work is, and then how you got into that, because there's, I think, a very personal way that you started to get involved in that space.

Griffin Jones: Fine. How did I get in?

Jennifer Bonine: Yeah.

Griffin Jones: Here's what I do. I'm the intersection of agile, software testing, and the regulated space also—so people that are FDA people or pharmaceutical, medical device people, or financial people that are trying to do agile transformation, I work with those people, especially the technical things to do the initial implementation.

Jennifer Bonine: And help them figure out how to do that. You’re personally in the regulated space, so when we talk about the regulated industry, and especially medical device, you have a very personal history with it in terms of being passionate around getting it right.

Griffin Jones: Absolutely. I've worked on computer radiography, digital radiography. My father worked in the nuclear industry once upon a time. Also, when I first got into the industry when my first son was born, there was an issue with the medical device when he was born that brought to a head the importance of these types of devices.

Jennifer Bonine: Yeah, and we all know people who work in this space have to have a particular passion and conscience for it, because it's not like testing just everything else. It's different than that.

Griffin Jones: Yeah, so when I interview testers in particular for medical or pharma spaces or regulated spaces, I'm usually looking for skill, pill, and will. The pill piece and the will piece are around, Are they capable of working in the regulated space? But the will is also around the issue of you're working with things that are touching people who are vulnerable and potentially are going to die. I've worked on products that, quite frankly, even if everything goes well, about 25 percent of the people are going to die.

Jennifer Bonine: Right, so yeah, best-case scenario.

Griffin Jones: They're incredibly vulnerable, so even small defects or small problems ...

Jennifer Bonine: Are big issues.

Griffin Jones: ... are a huge issue with respect to patients.

Jennifer Bonine: Huge issues. Yeah, it's very different when you start to talk in your space about ... for those testers out there who test various things, about life and death and issues getting out that cause loss of life as opposed to someone can't buy shoes online. They're two very different types of things.

Griffin Jones: Yeah, but it's interesting because those industries have the same business pressures that other industries have ...

Jennifer Bonine: Oh, absolutely.

Griffin Jones: ... but it creates a really difficult ... It puts the testers in a difficult position in terms of bug advocacy, when they see a problem and they think that it will potentially cause serious harm to a particular patient under certain circumstances, but they're bringing that information to a product owner, and the question is whether or not the product owner is appropriately balancing risk to patient versus other particular factors in the process.

Jennifer Bonine: Because they still have the same pressures, to your point.

Griffin Jones: Exactly.

Jennifer Bonine: It's not like they don't have the pressure to get to market just like everyone else does.

Griffin Jones: Yeah, these devices aren't riskless.

Jennifer Bonine: Mm-mm (negative). No, not at all.

Griffin Jones: It's about reasonable risk given the benefit that they provide.

Jennifer Bonine: You talked a little bit about when you interview or try and identify people that would be good in this space. I'm sure you've run across people that say, "I want to do this," but they don't maybe have the stomach to be able to be involved in that type of testing. How do you detect that?

Griffin Jones: Usually during the interview process, when you get serious about … “We need to work in this particular method” in terms of being very diligent and professional in the way that we document. The people that are not willing to do that, they sort of fall out, but there's been cases where people have difficulty handling situations where they discover problems that leak through their particular test and were delivered into the field, and have then resulted in potential risk to patients.

Jennifer Bonine: Yeah, absolutely. Very serious. Now, you said you do the agile piece in this, so I've heard from a lot of people, "You can't do agile if I'm regulated." Medical device companies, lots of people, that aren't as in tune with the things that you're doing and the industry's doing, help explain—if people are out there watching and they say, "I'm in that space and I don't believe you. We can't do this. It's not possible"—how?

Griffin Jones: Yeah, so usually the regulator isn't the issue. If it's the financial service industry and their regulators, or in my industry the FDA, are the agencies that have the responsibility for protecting the public and actually monitoring the industry, are actually reasonable in terms of the way that they're approaching the methods that people deliver. Agile is acceptable. You can do it in a way, in some way, to deliver product into the marketplace. The difficulty is usually with the people that define the processes in the company, and especially the middle management level, where they have competing pressures. Normally they've constrained their processes in such a way that they can't comply with some of the things that agile is asking them to do, and actually behave in an agile way.

Jennifer Bonine: Right. For people that say, "Well, we have to keep up our SOPs, or we have to have these documents and they require them and it has to look a certain way," what do you go in and advise them when they say, "But I have all this stuff and I have to update it and agile doesn't allow me to do that"?

Griffin Jones: Many of these companies are very old, old as in more than fifty years old, so they've had fifty years to create their quality systems. They've become sort of frozen in their processes. The first thing I usually end up doing is evaluating their existing quality system and evaluate whether or not we can actually do agile within the constraints that they've already defined. In some cases, you have to take the wrenches out and open up their SOPs and policies and make them more open to different ways to implement, but then you get into the interesting issues. Once you open up the process to making that possible, there's a very strong culture in those organizations to work in a particular method that isn't necessarily agile.

Jennifer Bonine: Right, and do you find ... You obviously go into companies and help them through this transition. A lot of it is not just the actual process, but the cultural change that has to go along with it and helping them evolve their thinking and moving them along in that regard.

Griffin Jones: Yeah, usually we're doing some type of simple pilot to prove that we can actually make it happen. Then we scale it up, usually within a particular division, using a particular team. There's a method to do it. Usually it doesn't work well to choose the most critical project that has a tight deadline which is a gigantic one that's distributed.

Jennifer Bonine: Yeah, don't do that one.

Griffin Jones: The interesting thing, big companies usually lack motivation to make these types of changes until they have a particular crisis.

Jennifer Bonine: That causes it, mm-hmm (affirmative).

Griffin Jones: That's one of the issues, but smaller companies, the small startups, are completely motivated to work that way because they can't bear the burden of a overly documented, non-value adding process.

Jennifer Bonine: Right. They just don't have the manpower to create all of that stuff.

Griffin Jones: In those cases, the issue ends up being they don't fully understand the particular context of working in a regulated space and how vulnerable they are to having their company essentially shut down.

Jennifer Bonine: Right, which can happen, right?

Griffin Jones: Absolutely.

Jennifer Bonine: It's balancing that risk, as you talked about.

Griffin Jones: The agency has a website which actually lists out people that have been bad actors professionally and are barred from the industry.

Jennifer Bonine: Wow. Wow.

Griffin Jones: Personally.

Jennifer Bonine: Wow.

Griffin Jones: There's a list of companies that the agency fines, so they take your money or they bar you from selling product or they confiscate your products.

Jennifer Bonine: Wow.

Griffin Jones: Mm-hmm (affirmative).

Jennifer Bonine: Wow. That's serious, right?

Griffin Jones: Mm-hmm (affirmative).

Jennifer Bonine: That's serious to get barred from an industry.

Griffin Jones: Absolutely.

Jennifer Bonine: Not all industries have that same site you can go to and see.

Griffin Jones: True.

Jennifer Bonine: We don't have that always, but that visibility and transparency into that is interesting. One of the other things that happens here at the conference, for those that aren't here on Friday, which is tomorrow, will be the workshop that you give on WREST.

Griffin Jones: Right. It's a workshop on regulated, RE, software testing. It's a free workshop. We're going to do it at STARWEST also coming up. What we do is we get together people that are interested that work in this particular space and we talk about ... We share our experiences. We talk about some of the challenges that we have and we also share some of the ways that we've worked around those particular challenges.

Jennifer Bonine: It's a good opportunity for people in the regulated space to come together in a forum. It's a free forum so they don't pay additional. If you come to the conferences, you can attend this free forum and talk with others. As you mentioned to me earlier, it's a very safe environment in terms of not disclosing. It's safe inside of that room to share information and challenges.

Griffin Jones: The rule of thumb is that if you have something that's confidential, don't share it, but people are fairly open and will be able to explain some of the challenges that they have. The real synergy is interesting, hearing the challenges in financial services versus medical devices versus flight control systems versus gambling, so like Vegas gambling, how they have very similar problems.

Jennifer Bonine: Yeah. It is. A lot of times, we do think of, I think, regulated, and we automatically think FDA, and we think that medical, or we think financial, but there's a lot of other, as you mentioned, regulated industries, like flight controls, which everyone gets interested in especially when the news hits on different things that happen.

Griffin Jones: We had a person who has a very ... a named ... everyone would recognize the name of an online game, who was the regulatory person for that company. He came, I think, last year. He shared that they're highly regulated because they sell to minors and they are worldwide. He shared that the South Korean regulations about how they write their legal notices and how they collect money from minors was a significant regulatory issue for the company.

Jennifer Bonine: Wow. Interesting, but again, a place to get a forum where they can talk and hear about it, what other people are dealing with. Again, very similar to these conferences in general in just getting a forum, getting people together, giving people opportunities to have dialogue and learn new things, find new things, and make new contacts.

Griffin Jones: Yeah. While the paper documentation that comes out of the presentations and the slide decks are interesting, and the virtual conference is wonderful, there's a real benefit to being personally here and interacting with people after sessions, and then being able to ask your particular questions of speakers.

Jennifer Bonine: Yeah, and just get that real dialogue and an engagement going. We talked to some people earlier and there's a lot of blogs and different things that people follow, but if folks want to get more information about WREST, or if they're thinking about attending STARWEST in the fall and want to participate, what's a good way to get in contact with you and get information?

Griffin Jones: WREST has a website, which I don't remember right off the bat, but quite frankly, if you contact SQE, SQE is capable of forwarding the information.

Jennifer Bonine: They'll get information to you.

Griffin Jones: Absolutely.

Jennifer Bonine: Personally, you, if there's questions I didn't ask that people want to know about, your experiences in this space, agile related to this, how can they contact you?

Griffin Jones: Sure. First name, Griffin, the numeric 0, Jones, at gmail.com, or griffinjones@congruentcompliance.

Jennifer Bonine: Perfect.

Griffin Jones: You can also Google me. I'm fairly high up the list.

Jennifer Bonine: I always say ...

Griffin Jones: A unique name helps.

Jennifer Bonine: Yeah, Google yourself and you'll find something, but if you Google you, you will find you.

Griffin Jones: Yes.

Jennifer Bonine: Perfect.

Griffin Jones: Cool.

Jennifer Bonine: Time goes so fast.

Griffin Jones: I know.

Jennifer Bonine: Thanks, Griffin, for being here.

Griffin Jones: Thank you very much. I really appreciate it.

Jennifer Bonine: Appreciate it.

An agile tester, trainer, and coach, Griffin Jones provides consulting on context-driven software testing and regulatory compliance to companies in regulated and unregulated industries. Recently, he was the director of quality and regulatory compliance at iCardiac Technologies which provides core lab services for the pharmaceutical industry to evaluate the safety of their potential new drugs. Griffin was responsible for all matters relating to quality and FDA regulatory compliance including presenting the verification and validation (testing) results to external regulatory auditors. He is currently a host of the Workshop on Regulated Software Testing (WREST). Reach Griffin at [email protected].