Why Software Engineering Governance Matters: Reducing Risk without Slowing down – infoq.com

 

Report on Software Engineering Governance and Sustainable Development Goals

This report outlines the principles of effective software engineering governance as a critical enabler for achieving key Sustainable Development Goals (SDGs). Based on insights from Sarah Wells at Goto Copenhagen, it repositions governance not as a bureaucratic obstacle but as a strategic framework that supports value delivery, enhances organizational performance, and contributes to sustainable and responsible technological development.

The Role of Governance in Sustainable Development

Software engineering governance, defined as the set of principles, practices, and tools for consistent and safe technical decision-making, directly supports several UN Sustainable Development Goals by ensuring that technological advancement is secure, efficient, and aligned with long-term strategic objectives.

H3: Fostering Innovation and Resilient Infrastructure (SDG 9)

Effective governance is fundamental to building resilient digital infrastructure and fostering innovation. By providing clear direction, it prevents duplicated efforts and ensures teams do not build on obsolete platforms.

• Technical Strategy: A well-communicated technical strategy aligns technology decisions across an organization, guiding teams toward building robust and sustainable systems.
• Organizational Tech Radar: This tool provides visibility into technologies that are successfully used or have previously failed, enabling teams to make informed choices that enhance system resilience and avoid known risks.
• Consistent Direction: Governance ensures that engineering efforts are cohesive, contributing to a stable and scalable software estate that forms the backbone of modern industry and infrastructure.

H3: Promoting Economic Growth and Decent Work (SDG 8)

Governance frameworks that prioritize efficiency and developer productivity contribute to sustainable economic growth and create better working conditions for engineers.

1. Value Delivery: The primary purpose of governance should be to help teams deliver value, not to hinder them. This focus directly supports business outcomes and economic performance.
2. Reducing Toil: Without proper oversight, engineers are often forced to manually address systemic issues, diverting their time from innovative feature development. Good governance automates safety and consistency, improving job quality.
3. Performance Enhancement: Aligning governance with DORA (DevOps Research and Assessment) capabilities, which are linked to high performance, boosts organizational effectiveness and productivity.

H3: Ensuring Responsible Consumption and Production (SDG 12)

A key function of governance is to ensure resources are used efficiently, which aligns directly with the principles of responsible consumption.

• Cost-Effectiveness: In cloud environments, a lack of governance leads to significant waste, with unused or oversized servers incurring unnecessary costs and consuming excess energy.
• Resource Management: Governance provides the oversight necessary to manage the entire software estate, ensuring resources are provisioned, used, and decommissioned responsibly.

Implementing Effective Governance for Sustainability

To achieve these goals, organizations must shift from traditional, restrictive governance models to enabling frameworks that integrate with engineering workflows.

H3: Leveraging DORA Capabilities for Enhanced Performance

The DORA core capabilities provide a blueprint for governance that supports high-performing, sustainable technology organizations.

• Fast Flow and Feedback: Governance processes requiring external team approvals, such as unwieldy architecture reviews, impede both fast flow and feedback, slowing down value delivery.
• Streamlined Approvals: Modern governance should adopt DORA principles like streamlining change approval and mandating version control to enhance speed and safety simultaneously.

H3: Building Integrated Guardrails and Policies

The most effective governance is built directly into the tools and processes engineers use daily, making compliance the path of least resistance.

1. Tooling over Mandates: Rather than relying on policies that must be read and manually followed, embed rules into the development pipeline.
2. Nudging Correct Behavior: An example is integrating a service catalogue with resource tagging. By requiring a unique system code from the catalogue to tag all cloud resources, engineers are naturally guided to register their services at the appropriate time.

Challenges and Recommendations

Transitioning to a modern governance model requires re-evaluating outdated practices and fostering a culture of shared responsibility, reflecting the collaborative spirit of SDG 17 (Partnerships for the Goals).

H3: Re-evaluating Traditional Governance Models

Change Advisory Boards (CABs) represent an outdated approach that provides a false sense of security while actively harming productivity.

• Ineffectiveness: Research indicates that CABs do not reduce the number of failed changes but significantly slow down release cycles.
• Hindrance to Progress: The ability to release code efficiently is critical for productivity and innovation. CABs act as a direct impediment to this, undermining progress toward SDG 9.

H3: A Collaborative Approach to Safety and Policy (SDG 17)

A successful transition involves reframing the roles of those involved in traditional governance and fostering collaboration between policy, security, and platform engineering teams.

• Shared Goals: Individuals managing processes like CABs often have the goal of keeping the organization safe. Their expertise is invaluable when redirected toward building automated, effective solutions with engineering teams.
• Reframing Roles: Instead of focusing on running a meeting, the role can be reframed as enabling organizational safety through more efficient and modern methods, thereby finding better ways to achieve the same protective outcomes without sacrificing speed.

SDGs Addressed in the Article

Detailed Analysis

• SDG 8: Decent Work and Economic Growth

  The article connects to SDG 8 by focusing on improving productivity and economic performance within the technology sector. It discusses how effective software engineering governance can “boost their performance” and “support value delivery.” Poor governance is cited as a factor that “slows progress and can increase costs,” directly impacting economic productivity. The emphasis on DORA capabilities, which are “linked to high performance on the DORA metrics, and enhanced business outcomes,” aligns with the goal of achieving higher levels of economic productivity.

• SDG 9: Industry, Innovation and Infrastructure

  This goal is central to the article’s theme. The discussion revolves around building better and more resilient digital infrastructure through proper governance. The article questions, “Without governance, what will prevent you from releasing code with security vulnerabilities? Will you be able to quickly and easily patch code when you need to?” This highlights the need for reliable and resilient systems (Target 9.1). Furthermore, the article promotes innovation and technological upgrading by advocating for a “technical strategy” and an “organisational tech radar” to help teams make better decisions and adopt new technologies effectively, which supports Target 9.5. The focus on cost-effectiveness, such as shutting down unused servers, also relates to increased resource-use efficiency (Target 9.4).

• SDG 12: Responsible Consumption and Production

  The article touches upon this goal through its discussion of resource efficiency. The specific example given is that without governance, “there will be servers running that should have been shut down or downsized weeks or months ago, costing you money.” This directly addresses the inefficient use of computational resources (which consume energy), linking to the principles of sustainable management and efficient use of resources.

Specific SDG Targets Identified

Detailed Analysis

1. Target 8.2: Achieve higher levels of economic productivity through diversification, technological upgrading and innovation…

   The article directly supports this target by advocating for practices and tools that enhance productivity. The mention of DORA capabilities as being “linked to high performance” and the need for a “technical strategy to align technology decisions and make better decisions” are clear examples of promoting technological upgrading and innovation to boost economic output in the software industry.

2. Target 9.1: Develop quality, reliable, sustainable and resilient infrastructure…

   The article’s definition of governance aims to help teams make “safe technical decisions” and keep the company “safe, secure, cost-effective.” The concern about being able to “quickly and easily patch code” speaks directly to the resilience and reliability of the software infrastructure being built.

3. Target 9.4: …upgrade infrastructure and retrofit industries to make them sustainable, with increased resource-use efficiency…

   This target is identified through the article’s explicit example of resource waste. The warning about servers “running that should have been shut down or downsized” is a direct call for increased resource-use efficiency in cloud infrastructure, which is a key component of modern industry.

4. Target 12.2: By 2030, achieve the sustainable management and efficient use of natural resources.

   While not about natural resources in the traditional sense, this target is relevant in the context of digital resources like computing power and energy. The article’s point about shutting down unused servers to avoid “costing you money” is a direct application of the principle of efficient resource management to the technology sector.

Indicators for Measuring Progress

Detailed Analysis

• DORA Metrics: The article explicitly mentions “DORA capabilities” and “DORA metrics” as being linked to high performance. These metrics (such as deployment frequency, lead time for changes, change failure rate, and time to restore service) can serve as direct indicators for measuring progress towards Target 8.2 by quantifying improvements in software engineering productivity and effectiveness.
• Reduction in Security Vulnerabilities: The article implies this indicator by asking, “Without governance, what will prevent you from releasing code with security vulnerabilities?” Tracking the number of security vulnerabilities identified and the time taken to patch them would be a clear indicator of progress towards building more secure and resilient infrastructure (Target 9.1).
• Cloud Computing Costs and Resource Utilization: The article implies this indicator by highlighting the financial waste from idle servers. Measuring cloud spending and the utilization rates of provisioned resources would directly track progress towards more efficient resource use, as called for in Targets 9.4 and 12.2.
• Time for Change Approval / Architecture Review: The article notes that an “unwieldy” architecture review process that “takes weeks” can slow down innovation. Measuring the time it takes for changes to be approved or for new technologies to be reviewed can serve as an indicator of how well governance processes are streamlined to support, rather than hinder, innovation (Target 8.2).

Summary Table of SDGs, Targets, and Indicators

SDGs	Targets	Indicators
SDG 8: Decent Work and Economic Growth	8.2: Achieve higher levels of economic productivity through technological upgrading and innovation.	DORA metrics (Deployment Frequency, Lead Time for Changes, etc.). Time required for change approval and architecture review processes.
SDG 9: Industry, Innovation and Infrastructure	9.1: Develop quality, reliable, sustainable and resilient infrastructure. 9.4: Upgrade infrastructure… with increased resource-use efficiency.	Number of security vulnerabilities released to production. Time to patch critical vulnerabilities. Cloud computing costs and server utilization rates.
SDG 12: Responsible Consumption and Production	12.2: Achieve the sustainable management and efficient use of natural resources.	Cost savings from optimizing cloud resource usage. Percentage of idle vs. utilized server resources.

Source: infoq.com