Introduction

Governance is essential for a successful Data Management Program. It involves formalizing oversight and coordination of all DCAM capabilities by setting control guidelines, approval processes, and evaluating adherence to policies, standards, and processes. Accountability is ensured by designating owners and stakeholders to uphold this framework. Data Management requires aspects of governance across the full spectrum of the data development life cycle. To fully understand the scope of Data Governance across the data life cycle, key considerations must include (but are not limited to):

• Data Requirements – curating requirements based on the business needs and objectives, with review and approval consistent with the organization’s data governance practices.
• Data Architecture – establishing consistent definition, design, standards, models, terminology, and formatting rules for data.
• Data Ownership and Stewardship - clearly defining responsibilities for managing specific data assets within the organization.
• Data Quality – ensuring data is accurate, complete, consistent, reliable, and validated for intended purpose.
• Data Privacy – complying with privacy regulations such as GDPR and CCPA.
• Data Security – safeguarding data from unauthorized access, breaches, and misuse.
• Data Access and Use – regulating data access and usage based on roles and permissions.
• Data Ethics – ensuring that data management, usage, and collaboration practices align with the organization's values and ethical standards.
• Data Development Life Cycle – managing data throughout its entire life cycle, from creation to disposal, including archiving and retention practices.
• Regulatory Compliance – aligning Data Management practices with applicable industry regulations and laws.

The goal is to ensure that the data of the organization, based on requirements, is accurate, reliable, accessible, protected, adheres to policies and standards, and is used consistently and appropriately. Appropriate usage is based on an understanding of who is using data and the purpose for which it is being used. The Data Governance Approach and Plan must be aligned with the Data & Data Management Strategies which are established and maintained based on the ongoing needs and objectives of the business.

Definition

The Governance – Data & Data Management Program component is a set of capabilities that codify the structure, lines of authority, roles and responsibilities, escalation protocol, policy and standards, compliance, and routines for managing and facilitating processes across Data Management functions. This ensures authoritative decision-making at all levels of the organization.

Scope

• Establish a Data Governance function.
• Design and implement sustainable business-as-usual processes and tools for Data Governance.
• Define clear roles, responsibilities, and accountabilities for Data Governance resources.
• Establish a Data Governance structure with clear authority, decision-making responsibilities, stakeholder engagement, oversight, and ethical data use and outcomes.
• Monitor issue management (data issues, Data Governance issues, Data Management issues).
• Create and maintain Data Management policies, standards, rules, and procedures.
• Monitor adherence to policies, standards, rules, and procedures.
• Ensure that Data Governance aligns and collaborates with other relevant Data Management functions.

Value Proposition

Organizations that establish, clearly communicate, and enforce Data Management policies and standards minimize data management risks while ensuring data is effective for business decision-making.

Overview

Data Governance is the key to successful, sustained data management. The approach, and its effective implementation, establishes lines of authority and ensures that the principles of Data Management can and will be implemented. It establishes the mechanisms for stakeholder collaboration and defines the organizational structure by which the Data Management initiative will be governed. The governance structure determines where the initiative resides in the corporate hierarchy, helps manage stakeholder expectations, aligns policies and standards to the organization’s mission and values, ensures the adoption of policies and standards, articulates the mechanism for conflict resolution, provides for governance over allocated funding, and sets the methodology for measuring Data Management progress. Governance over the Data Management initiative is multidimensional and includes activities related to each DCAM component. While the most appropriate structure for any individual organization will vary, a clear mission meeting business needs is essential for long-term success. For example, domain councils might exist to oversee the intersection of business, data, and technology functions. Governing boards might be created to establish business data priorities and resolve conflicts. Tactical groups might exist to manage workflow, perform data reconciliation, address the quality of critical data elements, perform business analysis, and provide triage to resolve issues with defective data or outcomes that violate the organization’s ethical standards. Some organizations may elicit all these types of structures as part of their overall governance framework to successfully embed Data Management concepts into the organization's culture. After the initial implementation, the governance framework must be periodically evaluated, monitored, and adjusted based on business reality to ensure it is effectively integrated into business-as-usual processes.

Core Questions

• Has the Data Governance Approach and operating model been defined and adopted?
• Have the Data Governance Structure, policies and standards, roles and responsibilities, and processes been defined and implemented?
• Have Data Issues and Exception Processes been defined, implemented, and managed?
• Are data domains governed?
• Are the appropriate executives identified and engaged?
• Has the methodology to ensure compliance with established policies, standards and processes across the full data development life cycle been defined?
• Have Data Governance metrics been validated by stakeholder criteria, aligned with business objectives and are they being collected in a timely manner?

Core Artifacts

The following are the core artifacts required to execute an effective Data Governance capability:

• Data Governance Approach & Operating Model
• Charter(s) for required governing bodies
• Data Management Policy
• Data Management Principles
• Data Management Standards
• Data Governance Standards and Processes

The Data Governance model is inclusive of the Approach. The governance organization structure must be defined and approved by stakeholders and executive management. Roles and responsibilities across the stakeholders must be established with operational processes in place.

Description

The approach to Data Governance must be defined and reflect the related vision and objectives of the Data Management Strategy.

Objectives

• Formally establish the Data Governance Approach within the organization.
• Gain approval and authority for the Data Governance Approach from stakeholders and Executive Management.
• Ensure alignment of stakeholder plans and roadmaps with the Data Governance Approach.
• Communicate the role of Data Governance across the organization through formal organizational channels.
• Confirm the Data Governance authority is supported through policy.

Advice

Data Governance emphasizes the organizational requirements necessary to successfully implement the objectives of the Data Management Strategy. It is essential for the organization to understand the concept of governance and the practical considerations involved in preparing stakeholders to adopt required practices for establishing a sustainable governance model. Leading with governance concepts, not details, is recommended to ensure leadership understands the vision. Data Governance begins with the establishment of the Data Management Strategy, considering the organization’s business priorities and data objectives. Strategically, the primary goal is to ensure that executive leadership acknowledges that Data Governance is mandatory for effective Data Management. This will change and challenge current operational practices. Early and interactive engagement with stakeholders will help reinforce buy-in. Think of this as crafting the governance deal with an appropriate balance between the concepts of governance (clarity on need), the value of governance (coordination and predictability) and the impact of governance (operational and cultural implications). Data ethics activities, if not fully integrated with the Data Management initiative, should at the very least be integrated into the Data Governance function. The Data Governance Approach and Plan must be aligned to the Data Management Strategy and regularly reviewed and updated.

Questions

• Is there a Data Governance Approach and Plan in place?
• Is the Data Governance Approach and Plan aligned to the Data Management Strategy?
• Have the Data Governance Approach & Plan been formally communicated to business, technology, operations, finance and risk?
• Has the Data Governance function been granted authority to implement the Approach?
• Has authority been communicated to stakeholders?

Artifacts

• Data Governance Approach & Plan

Scoring

Description

The Data Governance Structure must align with the operating levels of the organization. In addition to defining governance at the enterprise level, individuals must be appointed within the various operating units and given responsibility for Data Governance within those verticals. The Structure must be endorsed by senior management and communicated to all stakeholders.

Objectives

• Document the Data Governance structure and share with relevant stakeholders.
• Implement the Data Governance Structure.
• Establish the Data Governance Committee(s), defined within the Governance Structure, with written and approved charters.

Advice

There is no single correct way to define a Data Governance Structure. Amongst other factors, it must consider the size and complexity of the organization, the scope of the organization’s activities, the skill of the staff, the degree of regulation in the industry, and the culture of the organization. Developing a new Data Governance program will likely require new skill sets. Collaboration with HR and senior business stakeholders to define, recruit, and hire individuals with these skills will help facilitate implementation. Structured training in data management and data governance will facilitate a clear understanding of responsibilities associated with assigned roles and can have a positive effect on sourcing the roles internally. The Data Governance Structure establishes a system for making authoritative decisions regarding data and Data Management initiatives. Designated stakeholders should be appointed at the enterprise level to lead and coordinate these efforts across the organization. It's crucial to ensure that decisions are made at the appropriate level while also incorporating the necessary subject matter expertise. When forming governing bodies, their oversight should be confined to the areas of expertise of the participants. Avoid overcomplicating the process and ensure that governance is viewed as a control function rather than a judicial one.

Questions

• Has the governance structure been defined and socialized to make sure it is appropriate for the organization?
• Have the key roles been identified?
• Has a data education curriculum been established to encourage Data Governance understanding for all impacted stakeholders and participants?
• Has a Data Governance structure been formally established?

Artifacts

• Data Governance Structure (organization charts and roles)
• Charter(s) for required governing bodies
• Bi-directional communication such as stakeholder rosters, internal memos, and meeting minutes

Scoring

Description

Data Governance roles and responsibilities must be established. The responsibilities of the key roles are defined and adopted by stakeholders (e.g., data executives, data stewards, data custodians).

Objectives

• Define and communicate a comprehensive list of Data Governance roles and associated responsibilities.
• Ensure that the Data Governance roles and responsibilities are properly reflected in governing documents (e.g., charter, policy and standards).
• Hold individuals accountable for their assigned responsibilities.

Advice

Think carefully about how the governance process will work in the real world. It is important to evaluate roles and responsibilities from all perspectives including that of sponsors with executive authority, owners and other accountable parties. Both business stewards who manage data content and technology stewards who handle technical implementation have roles and responsibilities in data governance that need to be defined. In addition, clarity on responsibilities can be supported with the use of RACI or RASCI charts (Responsible, Accountable, Supported, Consulted, Informed). In some cases, there may be people already fulfilling some aspects of the role. Identifying these key subject matter experts may decrease adoption time.

Questions

• Have the roles and responsibilities of Data Governance been fully defined, documented, in collaboration with the impacted business?
• Do Data Governance roles have proper responsibilities and authority to be effective?
• Is Data Governance appropriately staffed?
• Have the assigned stakeholder responsibilities been socialized with impacted business stakeholders?
• Is there a succession plan in place for key stakeholders?
• Are the assigned roles regularly evaluated to determine if additional training/skills are required for the stakeholders to be successful?

Artifacts

• Evidence of stakeholder role assignment
• RASCI matrix or other evidence of accountability assignment
• Documentation of the roles and responsibilities in key governing documents
• Assessment of staff qualifications and identification of skill gaps

Scoring

Description

Formal processes must be established for the key Data Governance activities. These Data Governance processes align with the Data Management policy and standards of the organization. The processes are required for steady-state operations.

Objectives

• Establish formal Data Governance processes in alignment with the Data Management policy and standards.
• Integrate the Data Governance processes into the overall end-to-end processes of the Data Management initiative and align them with the data development life cycle.
• Identify, schedule, and maintain Data Governance routines, meetings, and working sessions required for operational support.

Advice

Data Governance subject matter experts should work with relevant teams to create and standardize Data Governance processes, ensuring they align with the entire Data Management initiative. Consistency in practices related to authority, policy, and control is crucial. It is important to address challenging organizational issues related to how data governance will affect change in the organization. Don’t underestimate the difficulties associated with, or minimize the importance of, getting agreement on essential concepts like authority, policy, and control. The Data Governance team should work with the organizations change management experts to manage change impact in the organization. Data Governance is an ongoing effort vital for achieving the organization's data and business objectives. The goal is to ensure that Data Governance becomes adopted as business-as-usual across the organization.

Questions

• Are formal Data Governance processes defined and operational?
• Are specific procedures, tools and routines in place for support processes?
• Are standard processes being followed?
• Are there meetings, planning sessions and regular communications about Data Governance initiatives?

Artifacts

• Data Governance Process documentation
• Process performance and compliance metric reports
• Meeting minutes, status reports, and Data Governance communications

Scoring

Governing the Data Management program includes the administration of data management policies and standards, funding, program and project management, and issue management.

Description

Policy and standards must reflect the basic principles of Data Management. Data Management policies and standards must be established for the organization and adopted by stakeholders and executive governing bodies. The policies and standards must align with relevant cross-organizational policies and standards, be clearly documented, and align with the Data Management Strategy and business priorities. They must address how data is acquired, managed, maintained and delivered throughout an organization.

Objectives

• Develop policies and standards in collaboration with business, technology, and operations stakeholders.
• Align policies and standards with the Data Management Strategy.
• Coordinate, reference and align with cross-organizational policies and standards.
• Engage with stakeholders to communicate policies and standards.

Advice

Developing and implementing policies and standards turn the Data Management initiative from a good idea into a functioning reality. They constitute the rules for how data will be managed to ensure that data is trusted and meaningful. They must be based on core principles, linked to the Data Management Strategy, and integrated into normal business processes. Policies and standards must be objectively actionable and measured consistently to monitor progress against Data Management Strategy & Business Case. Although they can vary, most policies and standards will contain rules and guidelines pertaining to data ownership, data definition, data lineage, metadata, data quality, data access, permissible use, data sourcing, and controls. Policies and standards drive business procedures and behaviors. Ensuring adequate communication with all stakeholders is paramount to ensure that all understand how the policies and standards impact their business and functional roles. Consider validating that coverage and adherence are adequately measured to meet business priorities. Data Governance leaders should work with all cross-organizational control functions to identify the intersection of data-related mandates that may impact other control objectives. Likewise, other policies and standards should reference the Data Governance policies and standards, when appropriate. Establish the necessary review and approval processes along the data life cycle to ensure that decisions about the acquisition, use and distribution of data adhere to the appropriate policy and standards.

Questions

• Have the Data Management policies and standards been created, published, and aligned with the Data Management Strategy?
• Have they been developed and verified in collaboration with stakeholders, including Internal Audit and executive management?
• Are the policies and standards complete and harmonized with cross-organization control functions (e.g., cross-border issues, security, privacy, ethics), data acquisition processes (e.g., legal contracts, entitlements), data usage (e.g., authorizations, redistribution), data retention (e.g., records, archiving, minimization, historical), quality control (e.g., business rules, logic checks, transformations), data meaning (e.g., identifiers, definitions, classifications), formats and messaging (e.g., schemas, metadata, ISO standards)?
• If required, are the mechanisms to support coordination with regulators defined and operational?

Artifacts

• Data Management Policies and Standards with history of reviews and approvals
• Policies and standards communication

Scoring

Description

To achieve budget authority, alignment must exist between the Data Management initiative funding governance, the Data Management governance structure and the organization-wide Funding Model and process.

Objectives

• Incorporate oversight of the Data Management initiative funding for projects into the governance processes.
• Align the governance structure with the Data Management project management framework to ensure oversight, reporting, and awareness of project funding compared to project expenditure.

Advice

Aligning the Data Management governance capabilities with the Data Management Project Management Office capabilities is crucial for the effective oversight and management of funding for Data Management initiatives and associated projects. These teams must collaborate to establish common processes that leverage the governance structure, ensuring thorough review and reporting around project funding and expenditure.

Questions

• Does the Data Management Organization have the authority to spend?
• Are the Funding Model governance process and governing body authorized by the organization?

Artifacts

• Reporting and Records of spending on Data Management initiatives

Scoring

Description

Data Management project oversight must be established via checkpoints, formal review mechanisms, and organizational approval boards. Data and data management requirements must be included in the organization’s data development life cycle and project management process to ensure that all new development, as well as data access, usage, and transmission of data, adhere to established Data Management policies and standards.

Objectives

• Communicate to stakeholders the review and approval processes as well as the responsibilities for data-related projects.
• Establish the review and approval processes, such as approval to build, approval to access, approval to use, and approval to send.
• Integrate the review and approval of data and ethical management of data into the organization’s Data Development Life Cycle and align with technology development and SDLC processes.
• Align the review and approval processes with the control mechanisms of other cross-organizational control functions.

Advice

Establish the review and approval processes as checkpoints along the Data Management/Data Development Life Cycle to ensure that decisions about acquisition, use, sharing, and distribution adhere to policies and standards. The implementation of program or project tollgates requires balance. They must be strong enough to be effective without being bureaucratic and burdensome. The objective is to facilitate business and enable data hygiene. If an approval request is denied, it is in the best interest of the Data Management initiative to help resolve the reason for denial.

Questions

• Are the appropriate tollgates in place at critical project decision points, relative to the Data Development Life Cycle?
• Are the review and approval processes structured to support business-as-usual processes?
• Are the criteria for tollgates transparent and easy to understand?
• Are project review and approval processes done collaboratively with other control functions?
• Have data control reviews been incorporated into Data Development Life Cycle and aligned with the SDLC process?

Artifacts

• Project Management Process and Procedures
• Data Development Life Cycle
• Project Management RACSI

Scoring

Description

Issue management processes encompass activities such as identifying issues, prioritizing them, tracking their resolution, and escalating them when necessary. The governance model for issues management must facilitate the resolution of both Data Management initiative challenges and data-related problems while utilizing the established Data Governance structure. A critical aspect of issue governance is the escalation process required when agreement cannot be achieved, and conflict resolution is required.

Objectives

• Issue management processes are documented, approved, and operational.
• Escalation procedures are aligned with the organizational governance structure.
• Data Management and data governance structures provide facilitation and oversight of all data and Data Management identified issues.

Advice

Issue management should be integrated with the Data Management initiative data governance structure. Issue management is required for both issues from the practice of Data Management and the governance of the data. Formality of how issues are managed is essential for both operational integrity and audit requirements. Make sure escalation processes are reviewed by Internal Audit as well as endorsed and supported by executive management. An established escalation process is necessary to resolve conflicts, reconcile priorities and ensure efficient operations. This process must be formalized and integrated with the governance structure and include clearly established roles and responsibilities and a well-defined escalation path. Many organizations have a technology solution available for capturing and managing issues. It is recommended that the Data Management team work with the technology team to leverage existing solutions for this purpose.

Questions

• Are there defined processes for issue management?
• Do the processes include escalation for Data Management and data issues?
• Are the right people with the appropriate levels of authority involved in the decision-making process?
• Have issue management and escalation policies and procedures been reviewed and accepted by Internal Audit and senior management?
• Is issue management for the Data Management initiative being managed using the organization issue management platform?

Artifacts

• Issue management process documentation, procedure guides and published routines
• Issue log, Key Risk Indicators and other performance metrics
• Escalation process(es) with defined escalation path(s)

Scoring