Engineering Maturity Models for Regulated Financial Services

Narrative

DORA's Accelerate State of DevOps research remains the dominant outcome-metrics framework cited by financial services technology functions, and its own decade of data shows the field is not settling into a stable consensus. The 2024 report, based on responses from more than 39,000 professionals, found the "elite" cluster stable but the high-performance cluster shrinking from 31% of respondents in 2023 to 22% in 2024, while the low-performer cluster grew from 17% to 25%, and for the first time the medium-performance cluster showed a lower change failure rate than the high-performance cluster, undercutting the assumption that DORA's four metrics move in lockstep. DORA's 2025 State of AI-assisted Software Development report replaced the four-tier elite/high/medium/low ranking with seven team archetypes and introduced a companion "AI Capabilities Model" naming seven foundational capabilities (a clear AI stance, healthy data ecosystems, AI-accessible internal data, strong version control, small batch working, user-centric focus, and quality internal platforms) that determine whether AI adoption helps or harms delivery. Two consecutive DORA reports found AI adoption correlated with reduced software delivery performance even as it lifted individual productivity, and Google Cloud's own account of the 2024 report quantified this as roughly a 1.5% throughput decrease and 7.2% stability reduction per 25% increase in AI adoption.

On governance, DORA's published capability page on "streamlining change approval" is one of the more consequential and most-cited findings for regulated firms: it reports no evidence that formal external review (CAB approval) reduces change failure rates, while such heavyweight processes correlate with larger, less frequent, higher-impact releases. The original Accelerate book (Forsgren, Humble, Kim) went further, finding organisations with formal external change approval were 2.6 times more likely to be low performers, and that external approval had no correlation with change fail rate but was negatively correlated with lead time, deployment frequency and restore time. This finding is now being explicitly reworked into banking governance literature: a Team Topologies "Expert View" piece on reconciling DORA metrics with bank governance argues for replacing CAB approval with automated, peer-review-driven controls and enablement coaching rather than abandoning governance altogether. InfoQ's coverage of the 2018 DevOps Enterprise Summit London documented Capital One, Barclays, Lloyds Banking Group, Standard Bank, ABN Amro, UBS and RBS presenting DevOps transformation experience reports, which remains one of the few multi-bank practitioner accounts of this transition, though it predates the current brief's window and should be read as a durable baseline rather than current evidence.

Test and process maturity models occupy a narrower niche than DORA in financial services. A peer-reviewed international survey of sixty financial institutions (banks, insurers, pension funds) benchmarked against TMMi found consistent motivations for test process improvement and documented benefits, giving TMMi one of the few empirically surveyed (rather than single-case) footholds in the sector, though the TMMi Foundation's own case-study library remains largely vendor/consultancy testimonial in character. On operating models, an academic case study of a large full-service bank's SAFe transformation two years in identified persistent friction around management and organisation, requirements engineering, quality assurance and systems architecture, echoing generic SAFe criticisms rather than resolving them for a regulated context, and independent practitioner critiques continue to argue SAFe creates conflicts with SRE/operations functions and encourages large-batch, top-down planning that cuts against a metrics-first DORA approach. Team Topologies' own case study library includes Alfa Financial Software (asset finance SaaS serving Santander and Mercedes-Benz among clients) and REA Group's financial services division, both citing reduced cognitive load and faster flow after restructuring into stream-aligned teams, though these are vendor-published case studies rather than independently audited outcomes.

Platform engineering and scorecarding tooling shows a maturing but contested evidence base. The CNCF TAG App Delivery Platform Engineering Maturity Model (built by the CNCF Platforms Working Group) frames maturity across investment, adoption, interfaces, operations and measurement, explicitly warning that each additional maturity level demands more funding and staff time and that reaching the top level should not be a goal in itself; the CNCF whitepaper explicitly invokes Martin Fowler's framing that a maturity assessment's value lies in the list of things to improve, not the score itself. The State of Platform Engineering Report Volume 4 (518 practitioners) found 45.5% of organisations run dedicated but reactive platform teams, only 13.1% reach an "optimised" measurement stage, and 29.6% still measure no success indicator at all, alongside evidence that well-designed golden paths drive voluntary adoption above 80% versus roughly 20% for platforms without them. Backstage-adjacent commentary is more sobering for enterprise rollouts specifically: while Spotify itself reports adoption above 90%, multiple independent sources (Cortex, Humanitec, Earthly) report that other organisations' Backstage rollouts frequently stall below 10% adoption, and a Microsoft Learn case study of an unnamed bank's platform engineering programme (120-person central engineering team, "thousands of custom tools") explicitly frames golden paths as a negotiated compromise against one-size-fits-all mandates rather than a solved problem. Martin Fowler's own bliki entry on maturity models remains the clearest published skeptical-but-constructive framing available: models are "wrong but hopefully useful," easily corrupted by certification incentives, and valuable mainly for sequencing what to learn next rather than for the score itself.