Governance, roles and responsibilities in a SIAM ecosystem
Domain 5 tests who decides, who is accountable and who executes - the most common source of lost marks and of failed SIAM ecosystems.
Governance
Accountability to the business stays with the customer organisation; governance is the mechanism that makes this real. Typical structure: a SIAM governance board (strategic direction, policy, provider onboarding and exit, risk acceptance, improvement funding), tactical service or performance review forums, a change advisory board, a technical design authority for design decisions, and documented escalation routes with timescales. Decision rights must be written down: who approves changes, who accepts risk, who signs off new or changed services.
Roles by layer
- Customer and retained: SIAM sponsor (executive), service owner (end-to-end accountability to the business), business relationship manager, enterprise or technical architect, contract and sourcing manager, security and compliance.
- Service integrator: SIAM owner or lead, process owners for the integration processes, performance and reporting analysts, service desk and major incident management, tooling and configuration specialists.
- Providers: service delivery managers, technical resolver groups and their own process performers.
Worked example
After a six-hour outage the review stalls: the provider's delivery manager says the integrator owned communications, the integrator says the provider owned root cause analysis, and the service owner says nobody told the business. Reasoning: three distinct accountabilities had been blurred. Resolution: the integrator owns the major incident process and business communication; provider A owns root cause and remediation of its component; the service owner accepts business risk and signs off the improvement plan; the governance board funds redundancy. Each role is single-accountable for one thing.
Traps that cost marks
- Two roles marked accountable in a RACI; ambiguity becomes escalation deadlock.
- Using the governance board for operational decisions.
- Assuming provider staff take line-management direction from the customer - direction flows through contract and process.
- Confusing service owner (accountable for the service) with process owner (accountable for the process across all providers).
- Leaving escalation paths and timescales undefined.