Why Governance Matters: The Key to Reducing Risk Without Slowing Down

Summary

Disclaimer: This summary has been generated by AI. It is experimental, and feedback is welcomed. Please reach out to info@qconlondon.com with any comments or concerns.

The presentation covers the significance of effective governance in reducing technical risk and maintaining speed in software development.

Key points discussed in the presentation include:

  • Governance Image Problem: Governance is often viewed as bureaucratic, but when done right, it aligns teams and reduces risk without slowing the organization down.
  • Principles and Practices: Governance should consist of principles, practices, and tools that enable informed and safe technical decisions.
  • Traditional Governance Barriers: Sarah critiques the use of Change Advisory Boards (CABs), which are often seen as obstacles that do not improve system stability or efficiency.
  • Foundations, Choices, and Guardrails:
    • Foundations: Knowing your software estate is essential for effective governance.
    • Choices: Making smart technological choices can prevent chaos and promote consistency.
    • Guardrails: Automating policies into checks helps embed governance into everyday processes.
  • Automation and Self-correction: Implementing automated governance helps teams correct course easily and ensures policies are followed without reducing speed.
  • Clarity and Alignment: Effective governance provides clarity on organizational goals and keeps teams aligned.
  • Challenges in Governance: The presentation mentions challenges such as the bottleneck of code reviews and AI's poor security code writing but also highlights that AI can help address some existing challenges by automating mundane tasks.
  • Continuous Improvement: Automating guardrails and encouraging visibility of good practices are central to continuous improvement in governance.
  • Handling Older Projects: A balance is needed in applying new governance practices to existing projects without overwhelming development teams.

Overall, Sarah Wells emphasizes the value of redefining governance to enhance clarity, consistency, and alignment across teams, advocating for governance systems that accelerate rather than impede development processes .

This is the end of the AI-generated content.


Abstract

When you hear “governance,” you might think of red tape, bureaucracy, or someone telling you what you can’t do. But real governance is about alignment and reducing technical risk. And that matters more than ever.

In most cases, engineers aren’t deliberately making risky decisions—they just don’t have clear expectations. That’s where good governance comes in. It ensures everyone understands what “good” looks like, gives teams the autonomy to move fast while staying on course, and provides built-in mechanisms to self-correct before small missteps become big problems.

In this talk, I’ll break down how to implement governance that actually helps, not hinders, including:

  • Understanding what’s in your software estate
  • Making smart technology choices - and why “boring” is often best
  • Turning policies into automated steps on the way to production

If you want to reduce risk, improve decision-making, and keep your organization running smoothly—without slowing your teams down—this session is for you.


Speaker

Sarah Wells

Independent Consultant and Author

Sarah is a technology leader, consultant and conference speaker with a focus on engineering effectiveness, microservices, incident management, platform engineering, optimising for flow and technical strategy. She has over 20 years’ experience as a developer, principal engineer and tech director across product, platform, SRE and DevOps teams.

She spent over a decade working at the Financial Times, as it transformed from 12 releases a year to more than 20,000, embracing autonomous empowered teams and adopting microservices, DevOps, containers and platform engineering.

She is the author of the O’Reilly book Enabling Microservice Success: Managing Technical, Organizational and Cultural Challenges.

Read more
Find Sarah Wells at:

Date

Tuesday Mar 17 / 10:35AM GMT ( 50 minutes )

Location

Mountbatten (6th Fl.)

Topics

security Platform Engineering risk governance

Share

From the same track

Session Kernel

Building on Bedrock: A Security Philosophy from Bootloader to Runtime

Tuesday Mar 17 / 11:45AM GMT

In Minecraft, every world is built from blocks. At the very bottom lies bedrock: an unbreakable foundation that everything else rests on. Above it sit layers of stone, dirt, sand, and other materials.

Speaker image - Alex Zenla

Alex Zenla

Founder & CTO @Edera

Session SBOMs

From Chaos to Clarity: Modern SBOM Practices That Actually Work

Tuesday Mar 17 / 01:35PM GMT

In this talk, Viktor will walk you through everything you need to know to build a practical and future ready SBOM strategy.

Speaker image - Viktor Petersson

Viktor Petersson

Founder of sbomify, Co-founder & CEO of Screenly, Host of Nerding Out with Viktor

Session security

Exploding GPUs

Tuesday Mar 17 / 03:55PM GMT

AI workloads on Kubernetes inherit every cloud native vulnerability.

Speaker image - Andrew Martin

Andrew Martin

Founder and CEO @ControlPlane, CISO OpenUK, CNCF Security Advisory Group

Session security

Adopting Memory-Safety and Fine-Grained Compartmentalisation With CHERI

Tuesday Mar 17 / 05:05PM GMT

This talk will describe how CHERI achieves memory safety for existing code with just a recompile and how that non-bypassable memory safety can be used as a building block for higher-level security abstractions.

Speaker image - David Chisnall

David Chisnall

Director of System Architecture @SCI Semiconductor, OS, Compiler, and Computer-Architecture Expert, Maintainer of the CHERIoT Platform

Session

Unconference: Software Security & Risk Management

Tuesday Mar 17 / 02:45PM GMT