Six reasons HERMES documents fail review, and how to make them audit-ready

What HERMES 2022 expects

HERMES is the project management method of the Swiss federal administration. The Federal Chancellery publishes it as an open standard, recognised by the eCH association as eCH-0054, and many cantons, communes, educational institutions and companies use it as well.

Three features of the method decide how your documents are judged:

• Results are at the centre. HERMES describes a project through its results. A set of minimum required documents serves project governance and cannot be removed by tailoring.
• Decisions structure the project. Releases such as the project initiation release, the execution release and the phase releases are decisions taken on the basis of documents, mostly by the project's client, the Auftraggeber. In the agile approach, an optional release decision per release can be added.
• Tailoring is allowed, but must be deliberate. HERMES 2022 offers standard scenarios such as IT development and IT adaptation, and allows modules, results and tasks to be removed or added, apart from the minimum required documents. The tailoring itself has to be recorded.

The classic approach runs through the phases initiation, concept, realisation, deployment and closure; the agile approach through initiation, implementation and closure.

Six patterns that send documents back

1. The study has only one option. A study that describes the preferred solution in detail gives the steering body nothing to decide. Reviewers expect real alternatives, including doing nothing, compared on the same criteria.

2. Requirements cannot be tested. "User-friendly", "performant" and "secure" cannot be accepted or rejected. Each requirement needs a criterion that a test can check, or it will come back at acceptance as a dispute.

3. Documents contradict each other. The study assumes one architecture, the concept another, and the tender a third. Each document reads well on its own, which is why the contradiction is often found only in an audit.

4. The plan has no acceptance. Milestones without acceptance criteria and responsibilities turn every acceptance into a negotiation. HERMES provides for acceptance and, where useful, a preliminary acceptance; the criteria belong in the plan, not in the last week.

5. Risks are listed, not managed. A risk register without owners, measures and dates is an inventory, not risk management. HERMES expects quality and risk to be reported to the steering body, and reviewers check whether measures have actually been taken.

6. Tailoring is not documented. A missing result is acceptable if the tailoring decision is recorded and justified. Without that record, the same gap looks like an omission.

Practices that make documents audit-ready

• Write for the decision. Open each document with the decision it supports, the options and the recommendation, on one page.
• Trace requirements. Give requirements identifiers and follow them from the study to the tender, the concept and the tests.
• Keep one source of truth. Terms, figures and assumptions belong in one place that every document refers to.
• Record tailoring in the project management plan, with a short reason for each change.
• Review across documents, not only within them. Most findings sit between documents.
• Involve the business representative. In HERMES, the user representative carries the business responsibility for the solution; their sign-off of content carries weight with reviewers.

One more change is worth knowing: from 1 January 2027, SAQ takes over HERMES certification from TÜV SÜD.

If a phase release is coming up, a HERMES quick check reviews one document against HERMES 2022 and your reviewers' criteria in five working days.