Skip to main content

FINOS

Ten Factor Governance

A shared vocabulary for operable governance: activity-centred, machine-readable, continuous, and owned.

Explore the factorsBrowse governance artifactsBrowse tools

Modern software increasingly operates in environments where trust, accountability and compliance are not optional—they are fundamental requirements. Whether building systems for financial services, healthcare, critical infrastructure or government, organisations are expected to demonstrate not only that their software works, but that it is secure, resilient, auditable and governed throughout its lifecycle.

Ten Factor Governance provides a practical architectural blueprint for building systems that can meet these expectations by design.

The Factors

Each factor in Ten Factor Governance names a property of operable governance that scales with modern platforms.

  1. Govern Sensitive Activities

    Attach governance to the activities that create risk.

  2. Build a Governance Twin

    For every sensitive activity, maintain a Governance Twin that defines how it is governed alongside how it is implemented.

  3. Governance is Version Controlled

    Treat governance like code: versioned, reviewed, tested and promoted through environments.

  4. Govern the Factory and the Product Separately

    Govern how software is built separately from how the running product behaves—they are related but different sensitive activities.

  5. Context In, Decisions Out

    Governance decisions are explicit functions over context that returns a deterministic, inspectable decision result.

  6. Evidence by Default

    Every sensitive activity should emit evidence as a normal consequence of work—not as a special exercise for auditors.

  7. Continuous Governance

    Develop, test, promote and verify governance continuously alongside the systems it governs.

  8. Govern Dependencies

    Follow dependency relationships so governance decisions reflect the full supply chain of trust—not only the local activity.

  9. Governance Is Composable

    Compose governance from reusable, versioned artefacts rather than rewriting it for every product, project or organisation.

  10. Governance Has Owners

    Every governed activity needs accountability.