Decide Who Owns Your Company's Data and Plan How to Manage It Better

## Decide Why and How Far the Company Manages Its Data Treat data as a managed business asset rather than a by-product of systems. Begin by stating why the organization manages data, which outcomes matter, and where the mandate begins and ends. - Identify the decisions, services, risks, and obligations the operating model must support. - Define the data domains, business units, platforms, and lifecycle stages in scope. - Separate strategic governance, delivery work, and recurring operations so accountability is visible. - Record assumptions, exclusions, dependencies, and unresolved questions. - Use consistent terms for capabilities, activities, roles, deliverables, controls, and measures. - Do not claim enterprise coverage when evidence is limited to a team, system, or sample. ## Name Who Decides on and Who Looks After Each Kind of Data Make shared responsibility explicit. Business representatives remain accountable for meaning, acceptable use, and priorities, while technical specialists remain accountable for reliable implementation and custody. - Name an executive sponsor for authority, funding, and cross-functional escalation. - Assign accountable owners for data domains, policies, services, and major controls. - Define business stewardship for definitions, quality expectations, and issue decisions. - Define technical stewardship for architecture, access, operations, lineage, and implementation. - Document who proposes, reviews, approves, implements, monitors, and is informed. - Provide a route for resolving ownership gaps, policy conflicts, and risk acceptance. - Review assignments when reorganizations, platforms, regulations, or critical uses change. ## List All the Data Work the Company Needs to Cover Create a capability map before choosing projects or tools. Organize work by enduring responsibility, not by the current organization chart or a vendor's product boundaries. - Cover strategy and governance, architecture, solution delivery, and data operations. - Include security, privacy, continuity, retention, and appropriate access. - Include shared reference data, master data, metadata, definitions, and lineage. - Include analytical data delivery, reporting enablement, documents, records, and content. - Include data quality definition, measurement, issue management, and improvement. - Show where capabilities depend on or provide services to one another. - Preserve important overlaps, but assign one accountable owner for each decision. ## Describe Each Area of Data Work with the Same Set of Questions Use the same descriptive lenses for every capability so gaps and dependencies can be compared without forcing every capability into an identical process. - Outcomes and principles: the value sought and rules that guide decisions. - Activities: recurring work, project work, controls, and decision points. - Deliverables: required records, models, policies, services, datasets, and evidence. - Roles and responsibilities: accountable, responsible, consulted, and informed parties. - Practices and procedures: approved methods, conventions, exceptions, and escalation paths. - Technology and standards: needed tool classes, protocols, interoperability, and selection criteria. - Organization and culture: skills, incentives, funding, authority, collaboration, and change readiness. - Mark a lens as not applicable only with a reason; do not silently omit it. ## Rate Today's Data Management from Real Records, Not Reputation Assess current capability using verifiable evidence rather than reputation or tool ownership. Apply one documented scale across the portfolio and distinguish missing evidence from weak performance. - Review policies, ownership records, models, catalogs, workflows, controls, and service records. - Sample operational evidence such as incidents, access reviews, quality results, lineage, and change history. - Interview business and technical participants to test whether documented practices are actually used. - Score capability, adoption, control effectiveness, and outcome performance separately. - Record evidence, confidence, scope, exceptions, and the date of each finding. - Identify root causes and dependencies instead of listing symptoms as independent gaps. - Do not infer maturity from a purchased platform, a single successful project, or undocumented claims. ## Rank Improvements by Value and Risk, Building Foundations First Turn findings into a sequenced portfolio based on business value, risk reduction, dependencies, and delivery readiness. A long list of disconnected initiatives is not a strategy. - Link every initiative to a documented finding, accountable outcome, and measurable benefit. - Rank work by impact, urgency, exposure, effort, dependency, and confidence in the evidence. - Establish enabling foundations before dependent automation, analytics, or scale-out work. - Define scope, owner, decision gates, resources, milestones, and acceptance measures. - Identify quick improvements without allowing them to displace critical foundational work. - Escalate changes to policy, ownership, funding, or risk acceptance to the accountable authority. - Do not begin irreversible or production-affecting work without explicit approval and rollback planning. ## Set Rules for Data from Creation to Disposal Apply controls from acquisition and creation through use, sharing, retention, archival, and disposition. Coordinate project delivery with operational ownership so controls survive deployment. - Capture information requirements, definitions, classifications, and quality rules before design. - Review models, interfaces, access paths, retention needs, and recovery requirements before release. - Use representative test data safely and validate migrations, transformations, and reconciliations. - Version data models, schemas, rules, mappings, and control evidence with traceable approvals. - Monitor availability, performance, access behavior, change outcomes, and recovery readiness. - Require authorized decisions for production access, destructive changes, retention exceptions, and disposition. - Preserve audit evidence and test rollback or recovery paths before high-impact changes. ## Keep Shared Terms and Official Data Sources Consistent Reduce ambiguity by managing authoritative definitions, reference values, master entities, metadata, taxonomies, and lineage as connected services. - Assign owners and approval rules for shared terms, identifiers, code sets, and hierarchies. - Identify authoritative sources and document where replicas or derived values are permitted. - Record lineage from source through transformation to important uses and reports. - Keep business definitions connected to technical schemas, controls, and accountable owners. - Integrate metadata across platforms while preserving provenance and update responsibility. - Manage documents and records with classification, indexing, access, retention, and retrieval controls. - Do not label a source authoritative until ownership, quality, update, and conflict rules are explicit. ## Check Data Quality Against How Reports and Decisions Will Use It Manage quality and analytical enablement against declared uses. A dataset can be technically valid yet unfit for a decision, report, model, or operational process. - Define measurable rules for accuracy, completeness, consistency, timeliness, validity, and uniqueness as relevant. - Set thresholds and service levels with the people accountable for the business use. - Profile and test data before relying on it, then monitor drift and recurring defects. - Trace defects to source processes, controls, transformations, or unclear ownership. - Provide curated analytical data, reporting services, and documented semantic definitions. - Separate responsibility for reliable analytical data from responsibility for interpreting business results. - Reconcile critical outputs and communicate limitations, freshness, and known quality risks. ## Review Measures Regularly and Close Issues Only When They Are Fixed Operate the model as a continuous management cycle. Reviews should lead to decisions, remediation, and updated priorities rather than becoming a reporting ritual. - Maintain a small set of measures for value, risk, quality, service, adoption, cost, and control effectiveness. - Review capability health, incidents, exceptions, overdue decisions, and initiative outcomes on a defined cadence. - Assign each issue an owner, severity, due date, escalation route, and closure evidence. - Verify that remediation changes the measured condition before closing a finding. - Communicate decisions, rationale, dependencies, and residual risk to affected parties. - Update policies, capability descriptions, roadmaps, and ownership when evidence or context changes. - Periodically reassess whether the operating model remains proportionate to business needs and risk.