digital operations – Co-op Digital Blog

How we helped to develop a model for data ethics

December 20, 2023December 20, 2023Co-op

It’s important to us that we’re thinking about data ethically and that we’re using data in the right way.

The speed of technology and artificial intelligence development is also putting data ethics in the spotlight, and it is more important than ever that we measure our progress.

Co-op were asked by the Open Data Institute (ODI) to review and give feedback on the data ethics Maturity Model. We then used the tool to become the first organisation to independently assess our data ethics maturity and use it to improve our ethical data practice.

How the ODI Data Ethics Maturity Model works

The model can be used at any stage of an organisation’s data ethics development and is designed to encourage discussions and raise awareness of data ethics. The model covers 6 themes including governance, skills, processes and legal compliance. We use the themes to help identify opportunities to progress through the 5 levels of maturity.

We worked collaboratively to assess how to use the model

We decided to take our time to agree:

what we wanted to use the tool for
how to measure our current position
the scores that we wanted to reach

Our aim was to help drive out opportunities and training needs, and to prioritise activities within the business. We also needed an action plan to increase the data ethics maturity level across the 6 themes.

We organised workshops with participants from the Data Governance team and input from the Data Ethics Advisory Group. Carrying out the assessment annually meant that we could review actions regularly to make sure we’re making progress. We also shared all the outputs with our senior leaders, the Data Ethics Advisory Group and the ODI.

We adjusted the model to work at Co-op

The model is designed to cover all types of organisations, so sometimes the description within the assessment did not align to Co-op. We adjusted the wording so that it was more relevant to us and created some definitions. This will help us to make sure we are consistent when we do the assessment next time.

Co-op has worked on data ethics for a few years, so we baselined our scores as level 3 – ‘Defined’ initially. We then adjusted it according to the evidence we could provide to support the maturity level with a traffic light system:

Green: The activity already exists and we have evidence to support the score.
Yellow: We partially meet the criteria and have some evidence to support the score.
Red: The activity does not exist or we do not have evidence to support it.

Our Data Ethics Advisory Group reviewed our scores before we submitted our assessment to the ODI.

How the model helped us

The model has helped us to formalise our process and focus our efforts, including:

identifying some quick wins which we have detailed within our action plan
realising that maturity does not have to be at level 5 across all themes
focusing on themes that are higher priority to Co-op
understanding that data ethics is not only the responsibility of the Data Governance team and that we need to develop our relationships with other teams
using the Data Ethics Maturity Model to help Co-op fulfil our mission of being trusted with data

Tips for carrying out a data ethics assessment

If you’re thinking about creating a maturity assessment, it’s important to tailor it to help your organisation. The ODI provide help on using the tool but they do not publish scores or certify the results, so it’s about making it work for you.

It’s OK to adjust the wording within the model so it aligns with your ways of working. You can note down how you’re interpreting the scores, so that you can reflect on your progress later.

When you score each theme, it’s important to be honest. It will help when you build your action plan. It’s also OK to give yourself a half mark if you’ve only met part of a level within a theme.

Evidence to support your scores can come in all shapes and sizes, and could include presentation recordings, policies, or meeting packs. If you have little or no evidence to support your score, do not be afraid to reduce it. You can always collect evidence for your next assessment.

Be realistic when you decide what your desired score should be. We steered away from setting our desired score as level 5 – ‘Optimising’. This helped us to set realistic expectations and grow our data ethics maturity steadily over time.

Sarah-Jane Moss, Data Governance Manager, Co-op

Tricia Wheeler, Chair, Data Ethics Advisory Group, Co-op

Supported by James Maddison, Senior Consultant, ODI

18 months on: our Digital Technology Operations team

April 17, 2019April 17, 2019Michaela Kurkiewicz

It’s been just over 18 months since we first spoke about our Digital Technology Operations team so it’s time we reflected on how we’ve been helping product teams to deliver, what we’ve learnt and what’s next.

Developing our role as a ‘landlord’

In our first post we explained that our team looks after 3 things:

Service management.
Platform infrastructure.
IT security.

Another way to think of our role is as a property landlord.

The various delivery teams are independent from us in the sense that they look after the direction and design of their digital product or service – in other words, how each household is run isn’t our concern. However, all Co-op products and services have some things in common which make up a shared digital platform. This includes firewalls, a logging and alerting platform and core templates used to build out our infrastructure. This is the part that our team is responsible for. We’ve set the ground rules and make sure all new products and services follow them (like good tenants). It helps teams keep their products and services safe and operational.

How we’ve helped

1.Putting checks in place

We’ve set up a ‘service readiness’ check that new products and features go through before we call them ‘live’. A recent example is when we launched Coop.co.uk on new infrastructure. The check includes making sure:

security testing is complete
the relevant operational teams know what’s changed
the relevant people know what to do if something goes wrong

2.Helping teams manage cost

We now provide a cost management tool for our delivery teams to help them manage their cloud infrastructure cost. Each team has a dashboard that shows their current spend and their forecasted spend. Having visibility over this gives them autonomy over how they manage their budget and lessens the likelihood that they’ll overspend.

Having a cost dashboard helped the Membership team to see that infrastructure logging was costing more than expected one month. When they investigated they found that the logging was sending data every second rather than every minute. Real-time cost reporting helped them spot the increase quickly so they could fix the configuration and incur only a few days of an increased cost.

3.Improving reliability

Over the last 18 months we haven’t changed the tools such as logging, monitoring and alerting systems, but we have worked hard to make them more reliable. For example, we’ve worked with our monitoring tool supplier to tweak how we configured it. Now it can handle more data easily.

We’ve also put efficient processes in place when there’s a problem. Teams can see the details on a status page and we alert the relevant people to fix the problem through our ‘major incident’ process.

4.Getting buy in from teams

We ask that delivery teams make sure they secure their infrastructure following our guidelines; carry out regular security and disaster recovery testing, and build products and services in line with our approved tech stack.

It’d be easy to say we just provide the tools for them to do this. But in the last 18 months we’ve done much more than that: we’ve successfully explained the importance of good technical standards to teams. We have their trust and their buy in and as a result there’s commonality and consistency between all Co-op products and services.

What’s next

Over the next 12 months we’ll be working with the rest of Co-op IT to shape some of our existing IT management processes, like disaster recovery, to make them work for the new challenges that cloud infrastructure brings. And as our digital teams start to use new technologies like containers and serverless, we’re looking at how our tools and processes can be adapted to support these as well.

Over the next few blog posts we’ll talk in more depth about how we do monitoring, how we manage our services becoming unavailable and how we onboard a new service.

Michaela Kurkiewicz
Head of Digital Technology Operations

How we’ve made release management quicker and simpler

May 30, 2017May 30, 2017Co-op2 Comments

Release management is about how we plan and schedule when we’re building software. Every digital team has its own release management process but sometimes it’s worth reassessing it to make sure it’s as slick and quick as it could be. That’s exactly what we did.

How things were

Our process on the Digital Operations team was complex and repetitive. It was very specific to the Information Technology Infrastructure Library (ITIL) framework which is used to align IT service management with business needs. Our process was also dependent on a single gatekeeper. It didn’t work for us.

The process worked like this:

A developer would email me a release note.
I’d forward it to the environment owner.
They’d give me permission over email to put the release into their environment.
I’d email the developer to say this was approved and to advise when complete.

This process would then go on for each of the 3 environments (system integration testing or ‘SIT’, pre-production and production) so testing could be started. A typical release would result in around 30 to 40 emails. It meant we wasted a lot of time and the release cycle was slow.

The recording process wasn’t much slicker either. I had to update 3 spreadsheets, make a new folder for each release note and save each one to a central location. Then I sent an email every evening to document what releases we’d made that day.

Something had to change

Frustrations were running high because it was such a tedious, long-winded process. Developers were frustrated because of the amount of emails they had to send and environment owners were frustrated because of the amount of emails they were receiving. It wasn’t practical or sustainable.

Making things simpler and quicker

We agreed what the ideal release management process should look like. We wanted something less email-intensive, more intuitive, easier to manage, something that’s always up to date.

I thought a kanban-style approach using Trello and Google Forms might work well. We still had a requirement to keep the release note part of the process so I created a Google Form that asked similar (but more simply-worded) questions. We could then convert the answers from the Google Form into a PDF using Google plug-ins, email it to the Trello board so it would be automatically converted into a card and appear on the board. At this point we’d reduced the amount of emails by between 5 and 10.

Adding in audits

We ran this new process past environment owners who thought a series of checklists on the Trello cards would be useful. This way we could include evidence that testing had been done and that we’d released in the correct order through the environments. When the Change Advice Board (CAB) reviewed releases they had the evidence there already and this would save time.

Trello also lets you assign tasks to people and they’ll get a notification when something’s been completed. So developers could release without having to wait for an email because the testing team had given approval which triggered a notification for the developer. This saved another 5 to 10 emails.

Testing things out

At this point we held demo sessions before putting the Google Form live. After a week we evaluated where we were at. The feedback was positive: releases didn’t get stuck at any approval points, there were far fewer emails and there was a live version of the status and position of releases at all times. The whole thing was much easier and it was self-managing.

Going from good to great

We kept improving the process and after 6 months we’d changed the way we labelled releases as well as the automation of release checklists when a new release is added. I was now only spending around an hour a day making sure things were flowing correctly.

We’re now coming up to a year since we started doing things differently and the process is down to minutes per day. It’s now totally self-managed by the developer, testers and product managers which gives us more time to work on what we’re actually here for: solving bigger problems.

Steven Allcock
Digital service manager

Introducing the Digital Operations team

May 10, 2017April 8, 2019Michaela Kurkiewicz

On the Co-op Digital blog we’ve spoken a lot about the products and services we’re working on like Membership, our new coop.co.uk site and location finder. We’ve spoken less about the Digital Operations team and the work it does before those products and services can be made available to the world.

Time for an intro?

We recently did a show and tell over in Federation but for those who couldn’t make it, here’s what we spoke about.

The Digital Operations team’s responsibilities

The Digital Operations team looks after 3 things:

Service management.
Platform infrastructure.
IT security.

The role we play differs for each area of work. For example, for Membership our role is to run the live service and its infrastructure, whereas for location finder we’re supporting the team while they run things themselves. Sometimes, our role is more about helping teams who are designing new services to think about how they’ll be operated and made secure during their life cycle, right from the early idea through to being live.

How we support teams

The Digital Operations team doesn’t take on development, support or responsibility for running new services. These things fall under a product or service team’s remit and we advise them. When teams need platform or operations engineers to build and run something, we help them find the people and resources they need.

We help Digital and Group work together

Co-op Digital is only one part of the Co-op, so it’s important that the work we do is in line with the wider policies. We help digital and non-digital people work together by translating Group policies into something accessible for digital teams to work from, and by helping Group colleagues understand how agile ways of working can support the policies.

Saving teams time by creating patterns

A really important part of our role is to build a set of patterns and ways of working that will help teams build things that are secure, reliable and scalable and perform well. We’re still in the early stages but the plan is that using the patterns will help teams make sure their product or service has security controls, disaster recovery, monitoring, alerting, a way for users to tell us about issues, and a support route to get those bugs to the developers.

The patterns are being built around Co-op policies such as our security and data protection policy, which means that if a team uses one to build they will have ticked most of the security policy checkboxes.

Ready for public consumption?

We’re also the keepers of the ‘readiness checklists’ – a list of things that need to be in place before teams make something new publicly available. Points on the checklist includes whether an alpha is publicly accessible; whether it captures colleague, member or customer data and if it integrates with any internal Co-op systems. The checklists aren’t a hoop to jump through just before a service goes live – teams need to start thinking about being production-ready right from alpha phase.

Working on something new? Tell us all about it!

Our big message to teams at our show and tell was: if you’re working on something new, involve us as early as possible. This way we can share any patterns and technology that might help you work more efficiently. There’s no reason to reinvent the wheel each time we build something new. If we’ve got something that works – your team can just reuse it.

Coming to us early usually means we can pick up any problems and point out anything on our checklist that your product or service might not meet much earlier. That’ll mean we won’t have to delay anything.

Another place we can help is if you’re thinking of subscribing to an online service or purchasing a product. Maybe you are thinking of starting a new blog, creating a wiki, using a productivity tool or anything else that will help you with your job – you should make sure you speak to us to find out if it needs review or if there is a suitable product already available.

Come and say hi

We have a regular ‘surgery’ on the sixth floor in Federation House at 11am on Tuesdays. We also have a Slack channel or drop us an email on digitaloperations@coopdigital.co.uk

Michaela Kurkiewicz
Principal service manager