1 Introduction

Managing changes in requirements is a fundamental and critical phase of the software development process. In practice, it is challenging to specify all the requirements at the initial phase of software development [1,2,3]. Several factors can cause a change in software requirements, e.g., change in market demands, customer needs, global market competition, government, and organizational policies, etc. [4]. However, managing changes in requirements is critical. In this study, we define requirements change as “the tendency of requirements to change over time in response to the evolving needs of customers, stakeholders, the organization, and the work environment” [5]. Generally, requirements reflect the needs and demands of customers and other stakeholders [6]. Requirements changes “can occur at any phase of the software development life cycle (SDLC) from requirements elicitation to system maintenance [7].”

RCM process activities are communication- and coordination-oriented [8], and they become quite challenging and complicated in the GSD environment because of geographical, temporal, and cultural boundaries [9, 10]. GSD is the most widely used software development paradigm, in which development activities are performed across geographical boundaries [8]. The economic and strategic gains motivated the software industry to adopt the concepts of GSD [11]. “A survey study conducted by the Standish Group [12] indicates that 20% of client organizations” adopt GSD practices to gain critical benefits, including proximity to the market, low development cost, module-based development across distributed sites and access to a skilled workforce. However, GSD brings additional challenges to the software industry which do not exist in a single site (co-located software development) environment [2, 11, 13]. The physical separation in the GSD environment generates a communication gap between team members that could negatively impact the coordination and control of activities [14, 15].

RCM is a collaborative process that needs frequent communication to manage the required changes effectively and adequately. A poor change management process could undermine product quality or, worse, lead to project failure [2, 16, 17]. Another “survey conducted by the Standish Group [12] shows that 18% of software projects failed due to the poor management of requirements” change activities. Moreover, it has been reported that 8 out of 10 GSD firms face critical problems due to the poor planning and management of the change management activities [18, 19]. The need for “RCM in GSD motivated us to develop requirements change management and an implementation maturity model that can assist the GSD practitioner in assessing and improving their RCM process.”

2 Background and motivation

RCM is an essential phase in the software requirements phase as it contributes to developing a quality project in line with the demands of respective stakeholders [1]. For example, Lindquist [20] “reported that 71% of projects fail due to the ineffective management of RCM activities. Similarly, Sirvio and Tihinen [21] surveyed Europe-based software development organizations and reported that 40% of software projects were unsuccessful due to the poor management of RCM activities.”

Various studies have addressed RCM issues by developing new frameworks and techniques [3, 17, 22, 23]. Niazi et al. [24] developed an RCM model to address the CMMI level-2 specific practices. The model consists of “request,” “validate,” “implement,” “verify,” and “update” phases and is based on the existing RCM literature and the empirical data collected from RCM experts. The model addresses the key RCM challenges, but no specific phrases can manage distributed teams' information sharing and coordination issues.

Bhatti et al. [3] developed an RCM model that has the following key phrases: “initiate,” “receive,” “evaluate,” “approve or disapprove,” “implement,” and “configure.” Bhatti et al.’s model missed the verification and batch phrases significant to verify the implemented changes and keep track of the batched changes. The RCM model developed by Ince [25] consists of “change request,” “rejection,” “batch,” “implementation,” and “updating” phases. Each change request is forwarded to the change control board (CCB), and the members of the CCB further evaluate it and make the final decision. This model covers all the essential aspects of RCM but does not include a testing or verification phase. Therefore, it is difficult to verify whether the changes implemented in the system work properly or not.

Similarly, Kesha et al. [26] RCM model is based on the existing RCM frameworks and an industrial empirical study. The model provides a roadmap for tackling RCM challenges, but no specific practices address communication and coordination issues. Moreover, this model addresses the RCM-related challenges in small- and medium-sized software development firms but does not explore the RCM challenges in large organizations. Khan et al. [27] and Hussain [9] argued that RCM process activities in GSD become more complicated due to physical, temporal, and socio-cultural distances across the development teams. The discussed models help address the RCM activities in a collocated software development environment, but they do not focus on RCM in the GSD context. Based on the state-of-the-art literature, no maturity model supports the RCM process in GSD projects by providing best practices and a road map.

To improve the global software development process, Khan et al. [28] proposed a software outsourcing vendor readiness model (SOVRM). The readiness levels of the SOVRM consist of critical barriers and critical success factors. The authors followed the CMMI staged representation structure and considered the essential barriers and success factors as the key process areas (KPA’s). Similarly, Niazi et al. [29] developed an implementation maturity model (IMM) using the maturity level concepts of CMM. The IMM was designed to manage the software process improvement activities in the collocated software development environment. Moreover, Khan et al. [30] developed a maturity model (i.e., SPIIMM) for software process improvement practices in the domain of GSD. The maturity levels of SPIIMM are based on the critical success factors and barriers of SPI activities [30].

There is no existing maturity model for handling RCM in a global development context based on the literature. Considering this research room, we develop a software requirement change management and implementation maturity model (SRCMIMM). In this study, we develop a requirement change management maturity model to assist GSD organizations to “assess and improve their requirements change management” process in global development projects. We presented the results of the success factors and best practices associated with RCM in GSD projects from the systematic literature review and the questionnaire survey in [31, 32]. We also presented the results of “the challenges associated with the” GSD projects from the systematic literature review in [33]. This paper is an extended version in which we present the results from our questionnaire survey study on the requirements changes management challenges in GSD projects. We identify the critical success factors and challenges associated with the requirements change management process in GSD projects. Moreover, we develop the requirements change management maturity model for GSD organizations. We also evaluate the effectiveness of the maturity model by conducting a series of case studies with GSD organizations.

3 Research question and objective

This research aims to develop the SRCMIMM to assist GSD organizations in assessing and improving their requirements change management process in global development projects. To achieve this objective, we define the following research questions:

RQ1: What are the success factors and challenges for RCM that are identified during the literature survey and the real-world study?

RQ2: What best practices are identified to address the critical success factors and challenges of RCM in GSD?

RQ3: Are there any differences between the success factors and challenges identified during the literature study and the questionnaire survey?

RQ4: Are the identified best practices suitable to address the critical success factors and challenges of RCM in GSD?

RQ5: How to develop and evaluate the effectiveness of SRCMIMM in GSD organizations?

4 Research methodology

We used three research methodologies to address the given research questions. An overview of the research design is provided in Fig. 1.

  1. I.

    In the first step, we follow the “step-by-step guideline of the SLR approach to investigate the RCM success factors, challenges, and best practices.”

  2. II.

    In the second step, “the questionnaire survey approach is used to validate the findings of SLR and to explore the additional factors.”

  3. III.

    In the third phase, we develop the proposed model, i.e., SRCMIMM, based on the findings of the first and second phases.

  4. IV.

    Finally, we conducted a case study with four GSD firms to assess the industrial effectiveness of SRCMIMM.

Fig. 1
figure 1

Research design

Full size image

4.1 Data collection and analysis methods

Garousi et al. [34] and Kitchenham [35] highlighted that the data collection and analysis approaches should be clearly defined and justified as they play a significant role in research projects. We adopt the mixed-method research approach, consisting of an SLR, a questionnaire survey, and case study approaches to collect the required data based on the research questions. These techniques are best suited for the data used in this research project [36, 37].

4.1.1 “Systematic literature review (SLR)”

SLR is a systematic approach to analyze and explore the data in the available “literature related to a specific research area of interest” [38, 39]. We “followed the three core phases of the SLR,” i.e., “planning the review,” “conducting the review,” and “reporting the review” [38]. The results extracted using the SLR approach are thoroughly presented “in our previously published articles.” The first SLR study was conducted to reveal the key success factors of the RCM approach. This work is published in the journal of Journal of Software: Evolution and Process” [31]. The challenging factors of the RCM process were identified during the second SLR study, “and the results are published in the Journal of Software: Evolution and Process” [33]. The third SLR was conducted to report the key practices employed to manage the success factors and challenges identified during the first and second SLR studies. The results of the third SLR are published in the IEEE Access journal [32].

4.1.2 Empirical study

The empirical research method effectively collects data from real-world practitioners regarding a specific research problem. According to Kitchenham et al. [35], selecting the empirical data collection approach is based on data type, available resources, a control mechanism for the selected approach, and proper skills to manage the variables of interest. A data collection process using observational methods is complex [37]; therefore, we adopt the questionnaire and case study methods to collect the empirical data. Both approaches are discussed in the subsequent sections:

4.1.2.1 Questionnaire survey study

We performed a questionnaire survey study with RCM experts to validate the SLR findings. The following are the key steps of the questionnaire study:

4.1.2.2 Questionnaire development

We develop an online questionnaire survey to validate the findings of SLR, which have been published in our previous articles [31, 32], and identify the additional RCM factors and practices. The content of the survey questionnaire consists of (i) respondent’s information, (ii) success factors, (iii) challenges, and (iv) the best practices for critical success factors and challenges. The questionnaire also consists of an open-ended section, where the participants are requested to add new success factors, challenges, and practices that were not identified “during the SLR study. The questionnaire can be accessed at the following” link: https://tinyurl.com/yx4gxnxa.

4.1.2.3 “Pilot assessment of the questionnaire”

The questionnaire was designed based on personal research experience and the suggestions provided by the research advisor. Moreover, three external experts were invited for the pilot evaluation of the questionnaire design. The experts are affiliated with the “City University Hong Kong, Chongqing University, China” and “Griffith University”, Australia. The experts suggested some improvements related to the content and clarity of the survey items. They further mentioned that all questions should be presented in a tabular form. All suggestions were accepted to clarify the terminology and understandability of the questionnaire.

4.1.2.4 Ethics approval

Before starting the survey, we obtained ethical approval from the research supervisor and the Research Ethics Board of the “College of Computer Science and Technology, Nanjing University of Aeronautics and Astronautics, China”. After obtaining formal approval, the data collection process commenced, and the survey questionnaire was made available to the participants through the following link: https://tinyurl.com/yx4gxnxa. The survey responses were collected in the online file storage repository hosted by Google at “drive.google.com.” The survey respondents were requested to answer the survey questions according to their understanding. Each respondent participated voluntarily and anonymously, and they were informed that they could exit from the study at any phase.

4.1.2.5 Data sources

We used the snowball sampling method to approach the targeted population, i.e., RCM and GSD experts [40]. Snowballing is an effective data sampling technique with respect to time and cost as it provides easy access to the targeted population [40]. In the snowball sampling method, participants are requested to share the questionnaire with experts working in the same domain. The participants were approached using different sources, including personal email, “Facebook (www.facebook.com), LinkedIn (www.linkedIn.com), Research-Gate (www.researchgate.net),” and through their organizational contacts. “The data were collected from June 2019 to August 2019. We collected a total of 89 responses, of which 12 responses were found to be incomplete” after a manual check, leaving 77 complete responses for further analysis. We observed that the designation of the participants ranged from project manager to developer. Detailed information on the survey participants is provided in Appendix A.

4.1.2.6 Data analysis

The frequency analysis method is used to analyze the data collected during the survey study as it is considered the best data analysis approach for descriptive data [36]. We analyze the significance of the RCM success factors, challenges, and best practices based on the agreement of the survey participants. We compared the responses of the survey respondents with respect to the success and challenging factors and the practices reported in the questionnaire. The same data analysis approach is adopted by various other researchers in software engineering domains [11, 13, 30].

4.1.2.7 Case study

Case studies were conducted to empirically validate the effectiveness of the proposed SRCMIMM. The case study is considered a well-suited approach to obtain expert insights regarding the practical implications of the research project outcomes [29, 30]. The same approach was previously adopted by various researchers in different software engineering domains [28,29,30, 41]. The following assessment criteria were developed for the case study:

  1. I.

    Ease of use.

  2. II.

    User satisfaction.

  3. III.

    Structure of SRCMIMM

SRCMIMM was assessed against the given criteria to evaluate its practical implications and quality. Furthermore, the criteria were of assistance in indicating the problems or ambiguities in the proposed model.

5 Results and discussions

5.1 Success factors and associated best practices identified from SLR and questionnaire survey

A total of 25 success “factors were identified from the systematic literature review” study. The SLR-based factors were generic for the RCM process; however, we conducted the survey study to know the perceptions and opinions of the experts regarding the significance of the identified factors in the GSD environment. Moreover, the comparative analysis (Spearman correlation) was conducted “to check the similarities and difference between the findings of the SLR and the questionnaire survey study.” The results of Spearman correlation (rs = 0.566) show a moderate positive correlation between the ranks obtained from both data sets, i.e., SLR and questionnaire survey study. The detailed results are given in our published study [31].

Similarly, the best practices related to the successful implementation of RCM activities in the GSD context were identified from the literature using a systematic literature review study. Moreover, the questionnaire survey approach was used to get feedback from the industry practitioners with reference to the identified best practices from the literature. We have identified the best practices by using the systematic literature review methodology to address the success factors and challenges. All the identified best practices were mapped against respective challenges and success factors. The mapping of the best practices with challenges and success factors is given in Appendix B. A comparison [Spearman’s rank-order correlation (rs = 0.522)] of the best practices identified in SLR and questionnaire survey indicates that there is a moderate positive relationship between “the rankings obtained from both data sets (i.e., ‘‘SLR and empirical’’).” The detailed results are given in our published study [32].

5.2 Challenges and associated best practices identified from SLR and questionnaire survey

A total of 30 associated challenging factors were identified by conducting the systematic literature review study. The details of the systematic literature review results are given in [33]. In this section, we provided the findings of the survey study conducted with the RCM and GSD experts. The survey study is conducted based on the SLR results published in [29]. The survey aimed to get feedback on the identified challenging factors, specifically in the domain of GSD. Furthermore, in this section, we also conduct a comparative analysis (Spearman correlation) “to check the similarities and differences between the findings of the SLR and the questionnaire survey study.”

The questionnaire survey data were collected from 77 survey respondents, and their frequency of occurrence is provided in Table 1. The ranking of each challenging factor is calculated based on their frequency in both data sets (i.e., SLR and empirical) (Table 1). For example, the unclear scope of requested changes (CH8) is the top-ranked factor in the data collected during the empirical study because 94% of the survey respondents consider it a challenge for the RCM process. Similarly, an average rank is calculated based on the SLR and survey study rankings. The challenging factor, the unclear scope of requested changes (CH8), has an average rank of 7 because its ranking is 13 in the SLR, and it has a ranking of 1 in the empirical study. The frequency-based comparative analysis of both SLR and the empirical study is graphically presented in Fig. 2.

Table 1 Ranks of RCM challenging factors
Full size table
Fig. 2
figure 2

Comparison of the investigated challenges with respect to both data sets

Full size image

Moreover, “the results of the Spearman’s correlation coefficient is rs = 0.561, which shows a positive correlation between the rankings of both data sets. The value of p = 0.001 indicates that the correlation between both the data sets is statistically significant. The results are given in Table 2, and the scatter plot of the rankings is shown in Fig. 3. We further applied the independent t-tests to measure the mean differences of both data sets (Table 3), where t = 1.065 and p = 0.759 < 0.0.5. These results highlight that there are more similarities between the rankings of the SLR and the empirical study. The detailed results of the t-test and group statistics are presented in Tables 3 and 4, respectively.”

Table 2 Correlation (rank order) of both data sets
Full size table
Fig. 3
figure 3

Scatterplot of the challenges with respect to the rankings of both data sets

Full size image
Table 3 Independent sample t-tests
Full size table
Table 4 Group statistics
Full size table

5.3 Critical factors

Critical factors are the key areas to which organizations need to pay significant attention [42]. Project managers should consider the critical factors before project initiation [42]. Caralli [43] reported that the proper management of critical factors could positively impact the overall business organization. Various research studies have discussed the significance of the critical factors. For example, Niazi et al. [44] highlighted the importance of the critical factors for software process improvement. They argued that to execute software process improvement activities successfully, it is important to consider the critical factors on a priority basis. Similarly, Khan et al. [13] identified the critical factors for the success and progression of software process improvement in the domain of geographically distributed software development. The following criteria were used to find the criticality of a specific factor:

  • “If a factor has a frequency ≥ 50%, then that specific factor is considered as critical.”

The same criteria were previously adopted in various software engineering studies [13, 41, 45,46,47]. We consider the given criteria to identify the critical success factors and critical challenges based on the results discussed in Sects. 5.1 and 5.2. Total 25 success factors (Sect. 5.1) and 30 challenging factors (Sect. 5.2) were reported for the RCM process in the GSD environment. Using the given critical factors criteria, we identified that six success factors are the most critical factors because their frequency of occurrence is ≥ 50% [31]. Similarly, eight challenging factors are considered the most critical challenges for RCM activities in the GSD domain. The list of the identified critical success factors and critical challenges is provided in Table 5. The aim of identifying the critical success factors and critical challenges was to develop the maturity levels component of SRCMIMM.

Table 5 Identified critical factors
Full size table

5.4 Structure of SRCMIMM

The core components of SRCMIMM are based on the existing maturity models, i.e. CMMI [48], IMM [29], SPIIMM [30] and SOVRM [28]. The preliminary structure of SRCMIMM was presented for a student research competition and published as a research proposal [49].

The structure of the model consists of three core components: factors component, maturity level component, and practices component. The investigated critical success factors and critical challenges (Sect. 5.3, Table 5) are used to design the factors and maturity level components of SRCMIMM. Figure 4 shows the structure of SRCMIMM. These three components of SRCMIMM are discussed as follows:

Fig. 4
figure 4

Structure of the SRCMIMM

Full size image

Various maturity models in the software engineering domain have been developed using CMM and CMMI models [28, 29]. For example, Khan et al. [28] proposed a software outsourcing vendor readiness model (SOVRM). The readiness levels of the SOVRM consist of critical barriers and critical success factors. The authors followed the CMMI staged representation structure and considered the critical barriers and success factors as the key process areas (KPA’s). Similarly, Niazi et al. [29] developed an implementation maturity model (IMM) using the maturity level concepts of CMM. The IMM was developed to manage the software process improvement activities in the collocated software development environment. Moreover, Khan et al. [30] developed a maturity model (i.e., SPIIMM) for software process improvement practices in the domain of GSD. The maturity levels of SPIIMM are based on the critical success factors and barriers of SPI activities [30].

Therefore, based on the existing maturity models in different other domains motivated us to structure the proposed SRCMIMM model based on CMMI components. We used the reported critical success factors (CSFs) and critical challenges (CHs) to develop the factors component of SRCMIMM. The identified CSFs and CCHs are mapped into the five maturity levels of SRCMIMM by adapting the levels concepts defined in CMMI, as shown in Fig. 5 and Table 6.

Fig. 5
figure 5

SRCMIMM and CMMI maturity levels

Full size image
Table 6 CSFs and CCHs with respect to SRCMIMM Maturity levels
Full size table

The first two authors of this paper initially map the identified CSFs and CCHs into five maturity levels of SRCMIMM. After completing the mapping process, the third author (external research coordinator) is invited to verify the mapped CSFs and CCHs of five maturity levels. By discussing the impact of each CSF and CCH, we made some essential changes and finalized the maturity levels.

We further performed an “inter-rater reliability test” [50] to check the biasness of the mapping team. We invited two external experts from the empirical research lab to perform the “inter-rater reliability test.” They performed all the steps of mapping the CSFs and CCHs into five maturity levels. Using the mapping results of study authors and external experts, we calculated the “non-parametric Kendall's coefficient of concordance (w)” [51]; where W = 1 and W = 0 show complete agreement and disagreement, respectively. The analyzed results (W = 0.94, W = 0.002) show a strong agreement between the mapping results of study authors and the external team.

Level-1 (Initial): Level-1 is the initial level of SRCMIMM. At this level, the deployment process of RCM is ad-hoc, and few processes are defined. This level has no CSF and CCH.

Level-2 (Managed): Level 2 is the managed level of SRCMIMM. This level consists of a complete set of practices used to identify and monitor the progress of the project. Hence, one CSF and two CCHs are considered in the managed level of SRCMIMM.

Level-3 (Change management control): Level 3 is the change management control level of SRCMIMM. This level assesses the control over change management activities as it is significant to keep track of the requirements changes to take an immediate control action. We mapped two CSFs and CCHs to level-3 related to the change management control process.

Level-4 (Defined): At this level, all the processes of RCM implementation are reported and standardized to achieve the performance and organizational objectives. This level has two CSFs and one challenge.

Level-5 (Optimizing): Level 5 is the final maturity level of SRCMIMM. To reach this level, the organization has developed a structure for continuous improvement. This level consists of one CSF and two CCHs.

The maturity levels of SRCMIMM with their respective factors are given in Table 6.

We identified the best practices using the SLR and the survey questionnaire [32]. The identified best practices are used to address the CSFs and CHs of the factor components (Appendix B). The mapping process of the identified practices for CSFs and CHs is conducted by the authors of this study and two independent external practitioners from AMAZON India and Tata Consultancy Services, India. After categorizing the best practices across the CSFs and CCHs, we conducted an online questionnaire survey with experts to validate the findings of the SLR and the categorization process (as discussed in Sect. 4.1.2). Based on the mapping process, we find that all the best practices and their mappings are significant to address the CSFs and CCHs.

The building block units (success factors and challenges) cover the three aspects: process, people, and tools. For example, SF1(“Change management engineering”) and SF3(“Governess and control of RCM activities”) covers the process aspect, CH7(“Lack of RCM process training”) and SF6(“Change management process awareness”), people prospective, and CH4(“Unavailability of RCM standards”) refers to the tool’s aspect.

5.5 Critical success factors

“Change management engineering” is an important factor that positively impacts the implementation of the RCM process in the GSD context. Change management engineering refers to documentation of requirements changes in terms of change source, change risk, impact analysis and change implementation plan [52]. In GSD projects, teams are geographically distributed with different time zones. Hence, it is important to have a well-established change documentation process to avoid any potential communication and knowledge sharing issues that can impact the successful completion of a GSD project [53]. “Accountability of change management activities” is another critical success factor that indicates that the requirements change management process in GSD projects needs to have a clear policy about assigning change ownership to respective team(s) [54]. This is critical to the success of a GSD project because teams are located across the globe and need to have clear ownership of the changes [55]. “Governess and control for RCM activities” is another critical success factor. In GSD, projects are managed in different management structures ranging from a centralized project management approach to a distributed structure with local site coordinators. Hence, it is important to have a governess and control plan for each requirement change request and how these changes will be approved for implementation in a GSD project [56]. “Advance and uniform RCM infrastructure at GSD sites” is another critical success factor as RCM activities are carried out on different overseas GSD sites simultaneously, and potential differences in infrastructure across sites might lead to compatibility issues [57]. Yos and Caslon [58] suggested that the GSD sites adopt advanced and uniform infrastructure while executing the RCM process in GSD projects.

A typical GSD project must manage the communication and coordination issues due to lack of face-to-face meetings and lack of trust due to cultural barriers between distributed teams. Requirements change management is team-based activity. Hence, it requires good communication, coordination, and trust between teams involved in implementing a change request. Therefore, there is a need to arrange team-building activities to increase trust among GSD teams and help them overcome communication and coordination challenges which will impact the successful completion of a GSD project. “Change management process awareness” is an important success factor for successfully implementing RCM activities. Lai and Naveed [22] highlighted that organizational management must provide training and certification opportunities to RCM team members working at GSD sites. To successfully deploy the RCM practices in GSD projects, it is vital to conduct workshops and seminars to inform and motivate the overseas practitioners; regarding the impact of demanded change and participating in the RCM program [59]. Moreover, Hanisch and Brian [60] underlined the significance of GSD practitioners’ awareness about the RCM process activities.

5.6 Critical challenging factors

“Time and budget constraints for RCM process” is a critical challenge for successfully executing the RCM process in the GSD paradigm. There is uncertainty regarding the RCM process in software development as it is hard to predict the frequency of changes and their respective scope [60]. So, there is a minor slot of time and budget for change management activities. As communication and coordination is a big issue in GSD that causes the delay in response between the overseas GSD; thought, there is a high risk involved due to the lack of pre-planning concerning RCM activities [59]. CH2 (“Unavailability of RCM standards”) was a critical challenge for RCM activities in the GSD environment. Ramzan and Ikram [19] and Jayatilleke et al. [5] highlighted the significance of RCM standards and models for GSD projects. They suggested a need for RCM standards that can assist the GSD organizations in assessing their existing RCM capabilities at overseas sites and providing best practices for further improvements. Kamal et al. [61] also mention that the standards\model is significant to adopted uniform infrastructure and practices for change management process in GSD sites. “Lack of 3C's (communication, coordination and control)” is another critical challenge for implementing RCM activities in GSD. For example, Khan et al. [10] argued that communication and coordination are key attributes to build trust and confidence among the globally distributed team members.

“Requirements tracking and control issues” is another critical challenge for implementing RCM activities in the GSD environment as development activities are carried out in geographically distributed locations across the globe. Hence, in a GSD project, there is a lack of face-to-face interaction between teams located in different time zones, which can lead to requirement changes, request tracking, and control issues [27]. Similarly, “Geographically distributed change control board (CCB)” is important to address the demanded requirements changes in the GSD context. The GSD organizations could develop a CCB that comprises individuals representing their respective overseas sites [5]. CCB should be the autonomous body that will make the final decision for each change request the stakeholders make. Kumar and Kumar [62] highlighted the importance of geographically distributed CCB in the GSD environment. They also highlighted that the lack of CCB causes the delay in effective decision-making, ultimately affecting the development process carried out on GSD sites.

“Lack of change impact analysis in distributed sites” is also a significant challenge for successfully implementing an RCM program in GSD. The impact analysis of a specific change request is important to estimate the required time, costs, and impact associated with it. Lack of change impact analysis can lead to ineffectiveness of the RCM process, and it may cause the project to fail. For example, Fu et al. [63] underlined the importance of change impact analysis at all the GSD sites. It assists in better managing the RCM activities in geographically distributed development sites.

Similarly, The RCM process implementation might not be successful if the GSD organizations do not offer the necessary training to RCM professionals [64]. The lack of specific RCM training causes inconsistencies between the geographically distributed development teams. It may be noteworthy for the RCM professionals to have robust understandings of RCM process implementation principles, structures, and methods such as CMM, CMMI [62]. Lack of organizational support is also a critical challenge for the change management process in the GSD context. Organizational support refers to how the management of a GSD organization supports and finances the RCM activities. For example, Minhas et al. [18] underlined that the commitment and contribution of management are important for the successful implementation of the RCM process. Moreover, they indicated that GSD teams could not implement an RCM program without proper organizational support and involvement in overseas sites. Ali and Lai [54] suggested that insufficient management support to the GSD sites primarily results in the lack of awareness regarding the impact of demanded requirements changes at overseas development sites.

5.7 SRCMIMM assessment method

The Motorola assessment tool [65] was used to evaluate the effectiveness of an organization concerning the RCM process in GSD organizations using SRCMIMM. Other researchers have previously used the Motorola assessment tool for assessment purposes [28, 30, 41]. It is normative and has been tried and tested by Motorola. The assessment tool can assist in identifying the weak areas of an organization with respect to the specific assessment model [66]. The following is the evaluation criteria for the Motorola assessment tool:

  • Approach: This criterion is used to assess the organizational management commitment and capability to implement specific practices.

  • Deployment: This criterion is used to evaluate the consistency of the implemented practices in all areas of the project.

  • Results: This criterion is used to measure the positive implications of the implemented practices with respect to time in all areas of the project.

The Motorola assessment tool uses score ranges from 0 to 10 to evaluate the key components of SRCMIMM [65]. The scoring criteria of the Motorola assessment tool are discussed in [65]. The following are the core steps in using the Motorola tool:

Phase-1: Compute the score for each practice against the three dimensions of assessment criteria, i.e., approach, deployment, and results.

Phase-2: Add the score for each practice against the assessment criteria and calculate the average.

Phase-3: Round the average score to the nearest whole number.

Phase-4: Repeat phase-2 and phase-3 for each practice of CSFs and CCHs.

Phase-5: If the calculated average score of the best practices for each factor is ≥ 7, then that particular CSF or CCH is successfully implemented; otherwise, it is not [65].

Phase-6: All the CSFs and CCHs “should be addressed to achieve a specific maturity level” of SRCMIMM. An example of the Motorola assessment tool is given in Table 7.

Table 7 Example of Motorola assessment tool application
Full size table

The results shown in Table 7 illustrate that the overall average score of the best practices investigated for change management engineering (CSF1) is 6. According to the Motorola assessment tool, if the average score is less than 7, this indicates the weak implementation of that factor. We further noted that from the total of 12 best practices of CSF1, P2-CSF1 (Define knowledge management criteria), P4-CSF1 (Performance measurement and continuous improvement), P5-CSF1 (Deploy Advanced “tools and technologies for requirements engineering process), P7-CSF1 (Use different techniques to conduct meetings with the clients, e.g., one to one, one to many, many to many, many to one), P9-CSF1 (Employ effective team members to manage the resistance of the client organization), and P12-CSF1 (Communicate the need for change, the impact on employees and the benefits to the employee)” have a score of 7. This highlights that the organization has successfully implemented P2-CSF1, P4-CSF1, P5-CSF1, P7-CSF1, P9-CSF1, and P12-CSF1. However, the overall average score of a specific factor must be ≥ 7. By applying the same criteria, we evaluate an organization's capabilities and maturity level related to the RCM process.

6 Assessment of SRCMIMM

6.1 The Motorola assessment tool is used to assess the robustness of SRCMIMM in the GSD industry by conducting case studies. The case study approach provides an opportunity to collect data from the real-world GSD environment and evaluate the industrial implications of SRCMIMM.

6.1 Evaluation criteria of SRCMIMM

To analyze the usefulness of SRCMIMM, the following criteria were developed [30, 65]:

  • Ease of use: How easily can the GSD industry implement SRCMIMM?

  • User satisfaction: What is the degree of practitioner satisfaction with the results of SRCMIMM.

  • Structure of SRCMIMM: What are the evaluation results of the architecture of SRCMIMM, including the key components, their relationship, and the classification of CSFs and CCHs across the maturity levels.

6.2 Case study-based assessment of SRCMIMM

We select software development firms that provide a detailed description of the RCM process and agree to publish the case study results. In this regard, we explored the Pakistan Software Export Board (http://www.pseb.org.pk) and the social media network, i.e., LinkedIn (https://www.linkedin.com). A formal invitation was sent to 43 organizations shortlisted for the case study. The invitation letter can be accessed at the following link: https://tinyurl.com/s6q7pz8. We received a confirmation response from three GSD firms that showed great interest in participating in the case study. Initially, we sent the guidelines to the participants via their email addresses. We arranged Skype meetings to explain the objective of the case study and provide details regarding the case study process. An example of the guideline document is provided at https://tinyurl.com/wbphhmq. A meeting was held with one participant from each company who further contacted other change control board members during the evaluation process. We asked the participants to provide assessment data based on their skills and experience in previous projects. The selected participants evaluated the effectiveness and the capability of their organization with respect to the maturity levels of SRCMIMM. Once the participants agreed and understood the case study process, we provided all the case study documents that can be accessed at https://tinyurl.com/rxdskl9. The assessment form “can be accessed at the following link: https://tinyurl.com/syy5cgn.

Moreover, a feedback session was conducted with the case study participants to check the usability of SRCMIMM based on the criteria discussed in Sect. 6.1. A questionnaire was designed to obtain feedback from the participants.” The questionnaire can be accessed at https://tinyurl.com/ua8kol5. The questionnaire consists of three sections, i.e., A, B, and C. Section A asks for the demographic details of the participants, Section B has all the details of the evaluation criteria and asks the participants to rate SRCMIMM based on ease of use; user satisfaction and structure (Sect. 6.1). In Section C, the survey participants were asked to suggest changes to the current best practices for the identified CSFs and CCHs.

The case studies were conducted in two rounds in three organizations. In the first round, we assessed SRCMIMM with organizations A and B. The participants of the first round of case studies suggested several modifications. We updated the model and conducted the second round of the case study with organization B (which suggested the modification) and organization C.

6.3 Profiles of the selected organizations

The organizations that agreed to participate in the case studies are labeled A, B, and C. The names of the organizations are not disclosed due to privacy reasons.

6.3.1 Profile of organization A

Organization A is a large software development firm with 900 + employees. Organization A consists of 16 overseas sites across several countries. The key business of organization A is to provide consultancy services to develop and manage software systems. The case study participant from organization A currently works as the project manager and has more than five years’ experience in requirements engineering and management processes. The key business areas of organization A are as follows:

  • Needs analysis/requirements specifications

  • Software development, customization, and implementation

  • Process improvement for software organizations

  • Quality assurance and testing

  • Transition to agile development

  • Preparation of computer installation sites.

  • Selection and evaluation of software, hardware, operating systems, etc.

  • Legacy system solutions

  • Management consultant

  • IOS App development

  • IT business communications services

6.3.2 Profile of organization B

Organization B is a medium-size organization with approximately 500 employees, and they provide software development and management services. Organization B has seven overseas sites in different countries, and the head office is in China. The participant from Organization B is a project quality controller in head office. The participant's profile is very strong, especially relating to the analysis and testing perspective. The major business areas of this organization include:

  • Banking and finance services

  • Feasibility studies/ Technical advisory services

  • Bespoke business applications

  • Customized ICT training

  • Medical software products

  • Hardware maintenance

  • Web sites and portal design and development.

  • Provide services to the electronics industry

  • Marketing transformation

6.4 Case study assessment results of round-1

This section comprises the results of the case studies with organizations A and B. We only present the summarized results of the case studies in the paper; however, the detailed results are provided in Appendix C.

6.4.1 Case study results with organization A

The Motorola assessment tool [65] was used to evaluate the effectiveness of SRCMIMM. The participant from Organization A assessed the organization's maturity level using the SRCMIMM. The case study results of Organization-A are presented in Table 8.

Table 8 Case study results of organization A
Full size table

The results presented in Table 8 illustrate that Organization A does not meet the criteria of any maturity level as the respective factors of each level have a score < 7. This shows that the best practices for RCM in Organization A are not fully implemented. Hence, Organization A is assessed at level 1 of the SRCMIMM.

Organization A can improve the requirements change management process in GSD projects and move to the following advanced maturity level (i.e., level 2) of the SRCMIMM by implementing the best practices associated with SF5, CH3, and CH4, respectively (Table 9). This indicates that organization-A needs to receive an average score of ≥ 7 for all the given three factors of level 2. For example, organization A received scores 5,5,6 for the associated best practices of SF5, as shown in Table 9. It means that Organization-A has not fulfilled the given criteria of scoring ≥ 7 for SF5. Therefore, they should adopt the four best practices of SF5 as an implementation guideline. The same goes for all the other factors of level-2, where the average implementation score is less than 7. Similarly, if the organization is planning to move from level-2 to level-3, it should implement all the best practices associated with maturity level 3 success factors (SF2, SF3) and challenges (CH1, CH2, CH6).

Table 9 Organization-A level 2 score
Full size table

6.4.2 Case study results with organization B

The summarized case study findings for Organization B are given in Table 10. The results demonstrate that the practices adopted by Organization B are also weak as Organization B does not satisfy the criteria of a score ≥ 7 for the factors of a specific maturity level. We further note that the best practices for only two factors, i.e., CH4 (Unavailability of RCM standards) and SF4 (Advance and uniform RCM infrastructure at GSD sites), are implemented in Organization B. However, it is significant for Organization B to successfully address the key factors of the SRCMIMM maturity levels to manage the RCM process properly.

Table 10 Case study results of organization B
Full size table

6.5 Respondent’s feedback about SRCMIMM

The participants of all three organizations were requested to evaluate SRCMIMM concerning the evaluation criteria discussed in Sects. 5.5 and 6.1. To obtain the opinions of the case study participants, a questionnaire was developed, and the participants were requested to evaluate the SRCMIMM against the given criteria:

  • Ease of use

  • User satisfaction

  • Structure of SRCMIMM.

6.5.1 Ease of use

Based on the results for ease of use (Table 11), we conclude that the participants of Organizations A and B are satisfied with the use of SRCMIMM. The participants positively agreed with the questions regarding the ease of use of SRCMIMM, which shows that it is easy for any GSD organization to adopt SRCMIMM to manage requirement changes. No response was given in the negative or neutral categories (Table 11).

Table 11 SRCMIMM feedback results on ease of use from the participants of organizations A and B
Full size table

6.5.2 User satisfaction

The results given in Table 12 show that the participants from Organization A and B would consider SRCMIMM for the RCM process in the GSD industry. The participants gave positive responses to all the questions asked to assess the degree of satisfaction. The respondents strongly agree that the proposed SRCMIMM is generic and can be used for the RCM process in any GSD organization.

Table 12 SRCMIMM feedback results on user satisfaction from the participants of organizations A and B
Full size table

6.5.3 Feedback regarding the structure of SRCMIMM

The participants were asked to give feedback regarding the structure and key components of the model. The summarized results show that the participants positively agree with the core components and maturity levels (Table 13).

Table 13 SRCMIMM feedback results on the structure of SRCMIMM from the participants of organizations A and B
Full size table

However, as part of the feedback, we received only one suggestion. The participant from organization B suggested that as the process of requirements collection and management needs rich communication and coordination, these challenges between overseas teams should be addressed in the early phases. Hence, the participant recommended moving CH6 [Lack of 3C's (communication, coordination, and control)] from Level 3 (Change management control) to Level 2 (Managed).

6.5.4 Feedback regarding the generalizability and novelty of SRCMIMM

In addition, we also get feedback from case study participants, and the results (Table 14) show that both companies' participants are agreed as the SRCMIMM is novel and generalizable.

Table 14 Feedback results for generalizability and novelty of SRCMIMM from the participants of organizations A and B
Full size table

6.6 Updated maturity levels of SRCMIMM

The structure of SRCMIMM was revised based on the recommendations provided by the survey participants. (Table 15). We moved CH6 [Lack of 3C's (communication, coordination, and control)] from Level 3 (Change management control) to Level 2 (Managed). It is important to tackle communication and coordination issues early when the project is being developed in a GSD environment. Therefore, CH6 is considered at Level 2 because an organization can only move to Advance levels once they have mitigated the communication and coordination challenges across the distributed sites.

Table 15 Updated maturity level of SRCMIMM
Full size table

6.7 Case study assessment results of round-2

After revising the structure of SRCMIMM, we again contacted the participant of Organization B to evaluate the revised SRCMIMM. Furthermore, we obtained feedback from the participant of Organization C. The second phase of the case study is conducted two months after the first phase. The key aims for conducting the second phase of the case studies are: (i) to assess the updated structure of the SRCMIMM with Organization C and (ii) to check the improvements in Organization B with respect to their RCM process. Organization C was selected after sending them an invitation and obtaining their feedback. Moreover, Organization A and Organization B are large- and medium-sized organizations, respectively; therefore, we chose Organization C because it is a small-sized GSD organization. The assessment of SRCMIMM by three organizations of different sizes gives us the confidence to generalize its industrial implications.

6.7.1 Profile of organization C

Profile of Organization C is a small-size CMMI-level 3 software development organization. The team consists of more than 200 software engineers, creative designers, and technology consultants. This organization is a pioneer in mobile application development, real-time applications, IOTs, and bot development. The head office of this organization is located in the United Arab Emirates (UAE), with sub-offices in England and Pakistan. The key business areas of Organization C include:

  • Custom software development

  • Software prototyping

  • SaaS product development

  • Mobile and tablet app development

  • Software reengineering and modernization

  • Application hosting and support

  • Cloud development

  • Maintenance and support

  • Software delivery optimization

  • IT outsourcing services

6.8 Case study assessment results of round-2

The case study results of the updated SRCMIMM assessment are presented in this section. The details of the results are given in Appendix C, and the summarized results are discussed in the subsequent sections.

6.8.1 Case study results of organization B with the revised SRMIMM

The results in Table 16 illustrate that Organization B still did not achieve the specific maturity level of SRCMIMM; however, they improved their overall results by addressing the different factors of the maturity levels.

Table 16 Analyzed results of the updated SRCMIMM with organization B
Full size table

For example, in the first case study, the implementation results for SF5 (RCM team motivation) were weak (score < 7), but in the second case study, it is improved (score = 7). This shows that Organization B has adopted significant practices to manage factor SF5. Similarly, other factors are also addressed, and their final assessment score improved, i.e., “SF3 (Governess and control of RCM activities), CH2 [Geographically distributed CCB (change control board)]” of Level-3 CH5 (Lack of change impact analysis in distributed sites) of Level-4 (Defined); and CH8 (Lack of organizational support) of Level-5 (Optimized). These improved results highlight that Organization B has successfully adopted the best practices designed for the given factors. However, they still need to focus on all the given factors to achieve the specific maturity level of SRCMIMM.

6.8.2 Case study results of organization C (with the updated SRCMIMM)

Organization C’s case study results are given in Table 17. These results illustrate that Organization C is at maturity level-1 of SRCMIMM as most factors have an assessment score < 7. The results further reveal that except for CH3 (Time and budget constraints for RCM process) and CH6 [Lack of 3C's (communication, coordination, and control)] of Level-2 (Managed), all the other factors are weakly addressed. In summary, Organization C needs to expend much more effort to improve their RCM capabilities based on SRCMIMM. If so, they will be able to achieve the desired results after considering the given best practices for the specific factors.

Table 17 Analyzed results of the updated SRCMIMM with organization C
Full size table

6.9 Feedback of the case study participants in round-2

The feedback session was also conducted in the second round of the case study. The aim of acquiring feedback from the survey respondents is to check the usability and applicability of the revised SRCMIMM. The results of the assessment for SRCMIMM with respect to the criteria, i.e., ease of use, user satisfaction, structure of the model and generalisability are respectively provided in Tables 18, 19, 20 and 21. We found that both the participants in the second case study strongly agreed with the parameters of the SRCMIMM assessment criteria. No response fell into the negative or neutral category. We also did not receive any suggestions or recommendations from Organizations B and C participants. This shows that the updated SRCMIMM is generic and can be implemented in any organization, i.e., small, medium or large.

Table 18 Feedback results of the updated SRCMIMM on ease of use
Full size table
Table 19 Feedback results of the updated SRCMIMM on user satisfaction
Full size table
Table 20 Feedback results of the updated SRCMIMM on the structure of SRCMIMM
Full size table
Table 21 Feedback results of the updated SRCMIMM on the structure of SRCMIMM
Full size table

According to the feedback results regarding generalizability and novelty of the updated model, both the participants are strongly agreed the SRCIMM is novel and can be used in any type and size of organization.

7 Summary results of the case studies conducted at organizations A, B, and C

This section summarizes the four case studies conducted in three organizations in two rounds (i.e., round-1 with organizations A and B; round-2 with organizations B and C) to assess their maturity levels with respect to SRCMIMM. The summarized results in Table 22 highlight the classification of the factors for the maturity levels of SRCMIMM. The results confirm that in Organization A, only one factor in level-3 is completely addressed, i.e., CSF3 (Governess and control of RCM activities).

Table 22 Summary of results of organizations A, B, and C
Full size table

We conducted two rounds of case studies with Organization B. In the first round, the participants from Organization B suggested specific changes with respect to the structure of the SRCMIMM. After two months, we updated the model accordingly and conducted the second case study. We compared the first and second case study results of Organization B (Table 14) and found that the RCM process in Organization B is much improved after successfully addressing the critical factors.

The case study results conducted in Organization C confirm that only two factors of level-2, i.e., CH3 (Time and budget constraints for RCM process) and SF2 (Accountability of change management activities), are addressed. Hence, Organization C needs to address all the remaining factors of the maturity levels using the given best practices to manage their RCM activities using SRCMIMM properly.

8 Research contributions

The research presented in this paper contributes to the existing body of knowledge in the following four ways:

  • “There are no previous studies that address RCM process implementation challenges by developing software requirements change management and implementation maturity model in the domain of GSD.”

  • “This work provides a comprehensive analysis of software requirements change management in the domain of global software development with the help of a mixed-method approach (SLR, questionnaire survey, case study).”

  • SRCMIMM is designed and developed to assist GSD organizations in successfully executing RCM activities.

  • The empirical evaluation of SRCMIMM ensures that it is theoretically and practically robust in measuring and improving the maturity levels of the organization for RCM process implementation.

8.1 Implications for research

This research study has significant implications for academic research in the following ways.

  • Regarding the problem definition, we thoroughly investigated the challenges of software requirements change management in global software development.

  • Regarding the solution and presenting SRCMIMM, we systematically studied and analyzed the existing literature on RCM for GSD. It was helpful for this research study to confirm that the successful execution of RCM activities does lead to organizational success.

  • This study provides a consolidated knowledge base of software requirements change management and global software development, which has not been done before.

8.2 Implications for industry

Practitioners can use the results of our study in several ways. Practitioners can use the list of identified challenges and success factors as a knowledge base to plan RCM activities in a GSD project. Organizations can use the enlisted challenges and success factors to enhance their project management capabilities by developing training opportunities to target areas where further skill development is needed. Practitioners will also find it helpful to focus on the list of six critical success factors and eight critical challenges reported in the study (Table 5) to better plan RCM activity in a GSD project. Organizations can use the list of critical success factors and challenges as an indicator to hire software engineers with these specific skills as a risk mitigation strategy for GSD projects. The study findings provide GSD organizations with the ability to measure their maturity of the RCM process (Table 15). SRCMIMM provides software practitioners with the ability to understand their current GSD projects' RCM related strengths and weaknesses. Improvements to weak RCM related GSD processes can be better planned and managed rationally and targeted using insights provided by SRCMIMM. Ultimately, SRCMIMM will help place GSD organizations better positioned to deliver quality software.

9 Limitations

We adopted SLR and mixed-method (questionnaire survey, case study) approaches to develop SRCMIMM. The SLR identified the success factors and challenges impacting the RCM process. We also extracted the best practices to address the success factors and challenges identified by the SLR approach. A sample of 131 studies was selected to extract the data regarding the factors. “With the large number of research articles on RCM, this research study may have missed some related research papers. However, this is not a systematic omission like other researchers of SLR [13, 67,68,69,70,71].”

Internal “validity shows the overall evaluation of the study results. As the results of this study are extracted from the extensible literature review and the opinion of the experts, the pilot study gives an acceptable level of internal validity. The external validity indicates the generalization of the study results for all other domains [72]. In this research work, the data were collected from RCM experts across the world, and we believe that the results of this study can be generalized because there are no significant differences between the data collected from different countries; the results are presented in our published papers [31,32,33].”

Similarly, there is a threat to the adaptability of the proposed model in organizations of different sizes. We assessed the proposed model with organizations of three sizes, i.e., small, medium, and large, and the results demonstrate that SRCMIMM is applicable for GSD organizations of all sizes.

The given case study sample (n = 4) might not be strong enough for all GSD organizations. Each case study focused on a single representative, and that individual's feedback might not represent the entire population of RCM practitioners. To address this threat, it was decided that the case study participants should consult with other team members during the evaluation process to make the results more generalizable. Similarly, other research studies consider the case study sample size in the same range of [28, 30, 41].

10 Conclusion and future work

This “study developed the software requirements change management and implementation maturity model (SRCMIMM) which can help GSD firms assess and improve their RCM process. We adopted an SLR approach to review the existing literature and extracted the success factors, challenges, and best practices of the RCM process. The SLR results are published in our previous studies [31,32,33]. Using the SLR, we identified 25 success factors and 30 challenges. Of the 25 success factors, six were ranked as most critical based on the criteria of the factors with a frequency of occurrence ≥ 50% in both the SLR and the empirical study. By applying the same criteria, eight challenges were considered critical for the RCM process in the domain of GSD. To address the CSFs and CCHs, 72 best practices were designed using the SRL approach. The identified factors and their practices were further validated using the empirical study conducted with the RCM experts. The results of the empirical study demonstrate that the majority of experts agreed with the findings of the SLR, and they positively considered the investigated CSFs and CCHs and the best practices for the RCM process.

The SRCMIMM was designed based on the findings of the SRL, empirical study, and the concepts of the existing maturity models in other software engineering domains. The investigated CSFs, CCHs, and the best practices were mapped to the five maturity levels of SRCMIMM. To validate the proposed SRCMIMM, we conducted two-phase case studies with three GSD organizations. Case studies were conducted with two GSD organizations (Organizations A and B) in the first phase. The first-phase case study results show that the participant from Organization A agreed with the assessment criteria; however, the participant from Organization B suggested several modifications in the maturity level of the factors of SRCMIMM. We addressed the suggestions from Organization B, and to validate the updated SRCMIMM, we conducted round 2 of the case studies with two GSD organizations involved, Organization B (which suggested modifications in the first round) and a new organization, Organization C. The results of the second round of case studies with the updated SRCMIMM demonstrated that SRCMIMM is an effective model to assess and improve the RCM process in GSD organizations.

The study findings provide GSD organizations with the ability to measure their maturity of the RCM process. SRCMIMM provides software practitioners with the ability to understand their current GSD projects' RCM related strengths and weaknesses. Organizations can use the list of critical success factors and challenges as an indicator to hire software engineers with these specific skills as a risk mitigation strategy for GSD projects. Moreover, we believe that SRCMIMM will help place GSD organizations better positioned to deliver quality software.

In the future, the SRCMIMM can be extended in the form of software tools to assist GSD firms in assessing and improving their RCM process implementation capabilities. This is because the survey participants agreed that a tool should be developed based on the architecture of SRCMIMM to assist RCM practitioners in evaluating and assessing their RCM activities. This tool should be capable of identifying the RCM maturity level of a firm by assessing the CSFs and CCHs. It should also identify each maturity level's weak and strong factors and then present the best practices to address the weak factors. It will assist the organization in moving to the next maturity level. This tool will help increase the visibility of processes, identify the weakness, and enhance the understanding of RCM processes.