Datasheet

c01_1 07/08/2008 14

planned IT investments based on business performance as well as emer-

gent business needs.

In addition to focusing on key IT decisions, they also described various

‘‘archetypes’’ for making these decisions, which include business organiza-

tions, IT-only organizations, cross-functional organizations, and more.

They list the archetypes as follows:

Business Monarchies. A group of business executives or individual ex-

ecutives (CxOs) make key IT decisions. This construct includes senior

business executive committees that may or may not include the Chief

Information Ofﬁcer (CIO). This does not include individual IT execu-

tives making decisions independently.

IT Monarchies. Individuals or groups of IT executives make key

decisions.

Feudal. Business unit executives, key process owners, or their delegates

make key IT decisions at the business unit, regional, or process level.

There is no shared IT decision making with a corporate headquarters

or centralized IT function.

Federal. A governance structure where decisions are coordinated be-

tween a centralized corporate IT organization and individual business

units, strategic business units (SBUs), or geographic or regional

structures.

IT Duopoly. A governance structure that involves two parties—the IT

leadership and one other organization, for example, business executives.

Weill and Ross provide a compelling and simpliﬁed overview of IT gov-

ernance and some of the fundamental decisions that must be made, by

whom, in order to drive better IT and business performance. However, IT

governance requires a deeper level of analysis than Weill and Ross provide,

and SOA governance goes far deeper, as we will see.

Weill and Ross provide an excellent basis for the key IT decisions that

must be made, and describe various organizational models to help allocate

IT decision rights to the enterprise stakeholders. However, they fall short

in providing details of how IT policies and decisions are enforced across

various processes (e.g., software development lifecycles, architecture gover-

nance processes, strategic planning, and execution processes, etc.). Further-

more, they do not develop the concept of policy or a corresponding policy

enforcement model for complete IT governance coverage vertically and hor-

izontally in an enterprise that integrates enabling technology, governance

processes, and organizational constructs as a comprehensive governance

policy enforcement model. Their emphasis is placed on the organizational

14 THE SOA GOVERNANCE IMPERATIVE