At Citi, software delivery is not just about speed, it’s about doing things right in one of the world’s most regulated industries.
Jason Morris, Head of Developer Pipelines for Securities Markets and Banking at Citi, is the creator of Lightspeed, the firm’s flagship CI/CD platform.
Supporting more than 2,500 applications across the enterprise, Lightspeed has become a benchmark for how large financial institutions can balance speed, compliance, and quality.
Speaking at the annual QA Financial & E-Commerce Forum in London on September 18th, Morris discussed the challenges and opportunities of building pipelines at scale.
Financial institutions often face what looks like an impossible trade-off: delivering software faster while maintaining rigorous compliance. But for Morris, that’s a false dichotomy.
“So it’s not as hard as it sounds actually because really they’re not competing demands. They’re actually quite complementary if you do it the right way. They’re really just two sides of the same coin,” he explained to delegates.
“To achieve high frequency of delivery, you really need a high degree of automation. And in terms of compliance, well, we have to capture all the evidence of all the things that have gone into that process. And of course, our automation just captures that for you. So actually you get to go faster on the compliance front, but at the same time, you actually get a higher degree of compliance, a higher level of compliance because you take out a lot of the human error.”
For Morris, automation transforms compliance from a bottleneck into a business enabler.
“If you take the right approach, and that’s a very highly automated approach, then actually the process becomes very lightweight and frictionless, and everyone’s a winner.”
Scaling CI/CD
Citi’s technology stack is vast and complex, spanning everything from mainframes to AI. That breadth creates a unique challenge for Lightspeed.
“So this one will sound like it’s competing. So it’s a combination of managing diversity and consistency,” Morris said. “We have a huge technology estate. It’s built up over decades. You name it, if it was in fashion in the last 50 years, we’ve got it somewhere.”
The solution, he argued, lies in strong, enforced standards: “If you can establish really clear standards about how to do things and enforce those standards, you need to give people some flexibility… but consistency is key. One of the things that Lightspeed does is we have automation not just in the execution of your delivery pipelines, but also the provisioning. They are automatically set up for you in a consistent way.”
That consistency is transformative: “We also have maintenance function as well, whereby if I need to change the standard pattern or inject something new or swap out a tool or whatever we need to do, then we can manage that centrally and can just give it to everybody. And that’s honestly, that’s completely game changing versus the more traditional approach of giving people a bunch of tools and then begging them to change things whenever you need anything done.”
“There’s no room for snowflakes. There’s no room for flaky tests that pass sometimes and don’t pass other times.”
– Jason Morris
Measuring success
When it comes to benchmarking software quality, Citi relies on well-established indicators.
“I’ll be honest, there’s no magic here. Dora, right? You know, we are a big Dora metrics shop. And those four headline metrics, lead time, deployment frequency, change failure rate and time to recover, really work just as well in a regulated financial environment as they do anywhere else,” said Morris.
“In fact, they’re almost more applicable. What we want from a business perspective is to increase deployment frequency and reduce feature lead time so that our time to market is quicker. But of course, you have to balance that against safety and security. If your deployment frequency goes up but your change failure rate goes up, you get shut down pretty fast.”
Consistency, once again, is the safeguard: “The more consistent patterns that we do, the better trodden path it is, the more well battle-tested these things are. Every developer thinks they know how to do it best… but actually from the firm’s perspective, consistency is king. That has paid dividends for us.”
Developer productivity, Morris argued, is inseparable from testing.
“I don’t think I would be shocking anybody to say that the biggest single productivity boost in that space is automated testing, automated testing and integrated into your delivery pipelines so that it just runs, runs, runs again and again and again,” he told delegates in London.
But Morris does make a distinction between test automation and test engineering.
“It needs real engineering. There’s no room for snowflakes. There’s no room for flaky tests that pass sometimes and don’t pass other times. There’s no room for tests which take four hours to run one test. It’s got to be fast. It’s got to be completely reliable because you’re just getting a binary answer: good, bad. And if it’s bad, it goes back to the dev. If it’s good, it can go out the door.”
Looking ahead, Morris is clear: the challenge isn’t discovering new ideas, it’s adopting the ones already proven in the wider software industry.
“The short answer is actually just catch up and keep up. These things are not new… test automation, pipeline automation — these are not new concepts. They’ve been around for almost 30 years. But the key is actually doing it,” he said.
Financial firms, Morris added, must shake off their overreliance on manual processes: “There’s a lot of conservative voices. They tend to over-rely on people and humans. What you don’t want is people doing all of the boilerplate boring, repetitive stuff. What you want is people doing the high value things.”
And new tooling, including AI, could make adoption easier, he argued.
“With the advent of new tooling and there’s a lot of AI stuff, actually achieving that may be easier now. Retrofitting tests to an existing system, building new tests quickly, these things are becoming more and more accessible. There’s no excuse, just go do it,” Morris concluded.
QA FINANCIAL PODCASTS
Listen to Sudeepta Guchhait on Nasdaq’s new Mimic AI testing platform
QA Financial sits down with Sudeepta Guchhait, Senior Director of Product Framework & Quality Engineering at Nasdaq
——–
Listen to Wesley Scheffel and Robin Rain on Schroders’ DevOps strategy
We catch up with Wesley Scheffel, Head of Cloud Platform and Product Engineering at Schroders, and Robin Rain, Head of Cloud Platform Architecture
——–
Listen to Citi’s Jason Morris on Lightspeed and the future of continuous delivery
Jason Morris, Head of Developer Pipelines for Securities Markets and Banking at Citi, talks about Lightspeed
THIS NOVEMBER
Why not become a QA Financial subscriber?
It’s entirely FREE
* Receive our weekly newsletter every Wednesday * Get priority invitations to our Forum events *
REGULATION & COMPLIANCE
Looking for more news on regulations and compliance requirements driving developments in software quality engineering at financial firms? Visit our dedicated Regulation & Compliance page here.
READ MORE
- Why real-time monitoring and scenario testing are becoming core QA disciplines
- BankDhofar takes an automated approach to strengthen QA
- Banks warned AI still fails on real-world software testing tasks
- SEC’s AI emphasis drives new QA and testing imperatives for US banks
- Inside the chaos: The new reliability discipline reshaping banking QA
WATCH NOW
