At Securosis, we recommend a two-pronged attack, one hard (involving technical controls) and the other softer (process and communication).

Don't underestimate the old-fashioned, non-technical controls that have served financial institutions well: separation of duties, forcing employees to take vacations, dual-control systems, etc.

The COE is a new entity that controls the technical development of the SOA and provides expertise to the rest of the organization.