Engineering Maturity Models for Regulated Financial Services

Narrative

Independent commentary on engineering maturity in 2022 to 2026 spends less time proposing new frameworks and more time correcting the record on the frameworks vendors and consultancies already sell. The clearest example is DORA itself: RedMonk analyst Rachel Stephens, writing on her own site across the 2024 and 2025 reports, documents that the elite/high/medium/low tier structure produced results the DORA team itself no longer trusts, including medium performers beating high performers on change failure rate in 2024, and that the 2025 report replaced the tiers entirely with seven team archetypes. Any financial services programme still setting an internal target of reaching 'elite' status is benchmarking against a model DORA has retired.

On governance, Team Topologies' own blog is unusually direct for a framework vendor, stating that Change Advisory Boards in regulated banking approved over 90 percent of major changes reviewed and that some firms never rejected a single change in a year, which it uses to argue automated peer-review governance is a better fit for both compliance and delivery speed than a manual gate. This is corroborated from the framework-critique side: Agile Manifesto co-author Ron Jeffries and independent Enterprise Agility writing both argue that SAFe, the operating model most commonly paired with this kind of governance overhaul, imposes top-down process that produces partial benefit while capping how far delivery practice can actually improve, and Team Topologies co-author Matthew Skelton has publicly disputed SAFe's marketing claim that Team Topologies is integrated into SAFe rather than merely referenced in two summary slides.

A second consistent thread is skepticism of measurement itself. Hillel Wayne's Computer Things newsletter and Kent Beck's Tidy First? Substack both interrogate what happens once an engineering metric becomes a target, echoing Goodhart's law concerns that predate DORA. This skepticism extends to commercial engineering-intelligence tooling: an independent buyer evaluation on tianpan.co comparing Jellyfish, LinearB, DX and Swarmia found LinearB's headline 'AI' feature is a rule-based YAML engine unable to distinguish AI from human contribution, and that Jellyfish's AI-generated executive summaries have shallow traceability back to source data, direct evidence for treating vendor AI-measurement claims as unverified until independently checked.

On delivery mechanics, Simon Willison's newsletter and practitioner accounts from IT Revolution converge on a specific 2025 to 2026 finding: AI coding tools amplify a team's existing capability pattern rather than fixing weak ones, meaning AI adoption in an already-hygienic division compounds its advantage while AI adoption in a manual-release division risks compounding instability. Independent dojo case studies, most notably Nerd/Noir's account of Target running dojo challenges for more than 70 teams, remain the clearest documented mechanism for a central function to uplift capability without owning the teams, consistent with how law-firm analysis of PRA SS1/21 frames the underlying regulatory requirement as evidence of governed, repeatable service resilience rather than any particular delivery methodology.