SOA governance

SOA governance is a concept used for activities related to exercising control over services in a service-oriented architecture (SOA). One viewpoint is that SOA governance can be seen as a subset of IT governance which itself is a subset of corporate governance. The implicit assumption in this view is that SOA is just one more IT asset in need of governance. A contrasting viewpoint, expressed by blogger Dave Oliver () and others, is that service orientation provides a broad organising principle for all aspects of IT in an organisation — including IT governance. Hence SOA governance is nothing but IT governance informed by SOA principles.

The focus is on those resources to be leveraged for SOA to deliver value to the business. SOA requires a number of IT support processes as well as organizational processes that will also involve the business leaders. SOA needs a solid foundation that is based on standards and includes policies, contracts, and service level agreements. The business is expected to be able to use services to build and change the organization's business process quickly. To do so, a degree of granularity in the services available will be required. Consequently a SOA increases the need for good governance as it will help assign decision-making authorities, roles, and responsibilities and bring focus to the organizational capabilities needed to be successful.

Definition

The definitions of SOA governance agree in its purpose of exercising control, but differ in the responsibilities it should have. Some narrow definitions focus on imposing policies and monitoring services, while other definitions use a broader business-oriented perspective.

Anne Thomas Manes defines governance as: “The processes that an enterprise puts in place to ensure that things are done [...] in accordance with best practices, architectural principles, government regulations, laws, and other determining factors. SOA governance refers to the processes used to govern adoption and implementation of SOA.”

The specific focus of SOA governance is on the development of services that add value to the business, effective SOA governance must cover the people, processes, and technologies involved in the entire SOA life cycle from business point of view and connectivity and reuse from IT point of view, thus aligning business with IT.

To quote Anne Thomas Manes again: “SOA is about behavior, not something you build or buy. You have to change behavior to make it effective.”

Gartner defines SOA Governance as “Ensuring and validating that assets and artifacts within the architecture are acting as expected and maintaining a certain level of quality.”

ISO 38500 describes a framework with six guiding principles for corporate governance of information technology and a model for directors to govern IT with three main tasks: evaluate, direct and control. ISO 38500 differentiates between "Governance", "Management" and "Control".

Scope of SOA governance

Some typical governance issues that are likely to emerge in a SOA are:

• Delivering value to the stakeholders: investments are expected to return a benefit to the stakeholders - this is equally true for SOA.
• Compliance to standards or laws: IT systems require auditing to prove their compliance to regulations like the Sarbanes–Oxley Act. In a SOA, service behavior is often unknown.
• Change management: changing a service often has unforeseen consequences as the service consumers are unknown to the service providers. This makes an impact analysis for changing a service more difficult than usual.
• Ensuring quality of services: The flexibility of SOA to add new services requires extra attention for the quality of these services. This concerns both the quality of design and the quality of service. As services often call upon other services, one malfunctioning service can cause damage in many applications.

Some key activities that are often mentioned as being part of SOA governance are:

• Managing the portfolio of services: planning development of new services and updating current services
• Managing the service lifecycle: meant to ensure that updates of services do not disturb current service consumers
• Using policies to restrict behavior: rules can be created to which all services must conform, ensuring consistency of services
• Monitoring performance of services: because of service composition, the consequences of service downtime or underperformance can be severe. By monitoring service performance and availability, action can be taken instantly when a problem occurs.
• Managing how and by whom services are used