Choosing a Framework for a Regulated Payments Modernization
A regional payments processor with 340 staff must replace a 14-year-old settlement platform. The board has mandated compliance with a national real-time payments standard within 18 months. Two constraints dominate: the regulator requires documented traceability from business rules to technical controls, and the engineering team is small (22 developers) with no prior enterprise-architecture tooling. Leadership has narrowed candidate approaches to (a) a heavyweight, phase-gated framework with extensive artifact catalogs, (b) a lightweight agile-aligned framework emphasizing iterative architecture increments, and (c) building a bespoke method from scratch. A vendor has offered a discount on tooling tied to the heavyweight framework if signed within 60 days. The CIO asks you to recommend an approach and justify it.
1. Recommend which of the three approaches to adopt and justify it against the stated constraints.
Read the worked answer
The recommendation should be the lightweight, iterative framework, adapted rather than adopted wholesale. Reasoning chain:
- Traceability is a hard requirement, not a framework feature. Any framework can produce traceability if you define a rule-to-control matrix as a mandatory deliverable. So the regulator constraint does not by itself favor the heavyweight option.
- Capacity is the binding constraint. 22 developers and no tooling experience means a large artifact catalog will either be abandoned or consume the schedule. A phase-gated method with heavy upfront documentation risks missing the 18-month mandate.
- Iterative increments fit a regulatory deadline. Delivering settlement capabilities in slices lets you demonstrate compliance progressively and de-risk integration.
- Reject bespoke-from-scratch. Building a method consumes scarce time and lacks external validation the regulator may want to see.
- Reject the 60-day tooling discount as a decision driver. A procurement deadline is not an architectural constraint; buying tooling before the method is chosen inverts the decision order.
The answer must show the trade-off, not just name a framework.
2. The CFO argues that a phase-gated framework is safer because it produces more documentation for the regulator. Construct the counterargument.
Read the worked answer
Separate documentation volume from documentation value. The regulator asked for traceability from business rules to technical controls, which is a linkage property. A phase-gated catalog produces many documents but does not guarantee that any given rule maps to a control; that linkage must be designed deliberately regardless of framework.
Key points:
- More artifacts raise maintenance cost and drift risk: with 22 developers, stale documents become a compliance liability, not an asset.
- A phase gate can create a false sense of completeness; a document marked 'approved' does not prove the control exists in the running system.
- Propose a measurable substitute: a traceability matrix with coverage metrics (e.g., percent of business rules with an identified and tested control) reviewed each increment. This gives the regulator something auditable and current.
A strong answer acknowledges the CFO's concern is legitimate and answers it with evidence design, not dismissal.
3. Describe how you would adapt the chosen framework to satisfy the regulator without adopting the full artifact set.
Read the worked answer
Adaptation should be explicit and documented as a tailoring statement:
- Mandatory artifacts (kept): business-rule catalog, traceability matrix to controls, architecture decision records for control-relevant choices, and a current-state-to-target-state transition roadmap.
- Tailored down (lightened): phase gates replaced by increment reviews; large reference-model libraries used selectively only where they map to settlement domains.
- Added: a compliance view produced each increment showing rule-to-control coverage and test evidence.
- Governance: a tailoring register recording what was omitted and why, so the regulator sees deliberate choices rather than gaps.
The model answer should tie each retained artifact to a specific constraint (regulatory traceability, 18-month deadline, small team) rather than listing artifacts generically.