SOA governance falls short at most large enterprises

Nearly nine out of 10 large enterprises have insufficient governance over service-oriented architecture deployments, a new survey has found.

Most SOA services go into production without governance, even though IT executives realize this puts them at significant risk, according to the survey results.

The survey involved 1,300 members of the SOA Forum, an industry consortium for IT executives, mainly from Fortune 500 companies, large enterprises and government agencies. The forum was founded and is coordinated by WebLayers, a vendor that sells automated SOA governance products.

“SOA success requires a SOA governance strategy, which entails adherence to corporate and industry policies,” the SOA Forum report states. “The acceptance and adherence to these new policies and requirements demands new processes, procedures and guidelines that can impact the way multiple teams and individuals do their jobs.”

SOA governance must oversee design, development, deployment and operations of any new services, and ensure that all independent efforts come together to meet a business’s SOA requirements, according to WebLayers.

Among survey respondents, 88% said their current approach to SOA governance is insufficient, and that organization and cultural change was the top roadblock preventing good governance.

Not surprisingly, WebLayers says the survey results demonstrate a need for increased reliance on automated review to replace “inconsistent or undocumented manual processes.”

About 85% of companies depend on manual reviews in the design and development stages, and 45% rely on manual policy enforcement checks prior to adding services to their registries. Four out of five respondents believe their organizations suffer from a measurable or large risk because they place services into production without effective governance.

Companies that have deployed a registry and repository are typically unsatisfied unless they also have policy management and automated enforcement in place, the survey found. Companies with manual enforcement processes are far less likely to review code for compliance before putting services into production.

One major source of irritation that results is a lack of interoperability among SOA services.