SOA Governance Insufficient, Survey Finds

Most organizations implement Web services without reviewing compliance, according to a survey released Monday.

The SOA Forum released survey results showing that 88% of respondents acknowledge insufficient SOA governance. Eighty-five percent of companies rely on manual reviews for achieving architectural governance during their design and development stages, while 80% of respondents said their organization is at significant risk of deploying services without effective governance, according to the survey.

The issue of SOA governance has taken higher importance as companies are lashing new Web services to older legacy software. As a natural extension of IT governance, SOA governance ensures that business processes are adhered to so that online applications perform as expected.

SOA polled all members of its forum online and received more than 500 responses. Respondents include technical professionals from Fortune 500 companies and government agencies.

Respondents reported significant dissatisfaction when registries or repositories are deployed without policy management and automated enforcement, according to SOA. Fifty-six percent of respondents said that half of their services are not reviewed for compliance at all before moving into production.

Those who had automated the governance process, said they can check at least 75% of their artifacts for compliance. One third of those with automated processes check all of their code and artifacts for compliance before implementation, according to the SOA Forum.

Vladimir Mitevski, VP of Product Management, Core Services, for Thomson Financial and a founding member of the SOA Forum, said he was surprised to hear that so many of his peers still rely on manual checking.

"It highlights an area that the SOA Forum needs to educate its members on," he said in a prepared statement.

Gregg Bjork, CEO of WebLayers, which founded the SOA Forum, said that he has seen dramatic improvements from automated governance.

"Given the repercussions of a critical service failure, and the relative ease of implementing automated governance, it's surprising that more companies aren't taking action," he said in a prepared statement.