Transcription
Proceedings of the MIT 2007 Information Quality Industry SymposiumDesigning a Data GovernanceFramework to Enable andInfluence IQ StrategyElizabeth M. PierceUniversity of Arkansas at Little RockPG 135
Overview of Corporate and Key AssetGovernance (Reproduced from 2003MIT Sloan School CISR)Proceedings of the MIT 2007 Information Quality Industry rsSenior Executive TeamStrategyDesirable BehaviorKey Assets – Every Asset Requires Governance Mechanisms (committees,planning, policies, programs, budgets, measures, etc.)PG Data
Proceedings of the MIT 2007 Information Quality Industry SymposiumGovernance of Data Assets For most companies, financial and physicalassets are the best governed Information assets are often the worstgoverned, least understood, and most poorlyutilized key asset in most firms because data PG 137Is increasingly easy to collect and digitizeHas increasing importance in products and servicesIs very hard to value or priceHas a decreasing half-lifeHas increasing security and privacy risk exposureIs a significant expense in most enterprises
Proceedings of the MIT 2007 Information Quality Industry SymposiumWhat is Data Governance? Data Governance is about specifying the decisionrights and accountability framework to encouragedesirable behaviors in the use of Data Data Governance design lays out the decisionmaking structures, alignment processes, andcommunication approaches that enables thestrategic objectives for data and its quality to beimplemented and to monitor how well thesestrategic objectives are being achieved Note: Governance is about determining whoinputs and makes the decisions and how.Management is the process of making andimplementing the decisionsPG 138
Proceedings of the MIT 2007 Information Quality Industry SymposiumGovernance vs. ManagementGovernanceCorporateDetermine how firm isGovernancedirected and controlled(Top Mgmt, BOD, SH)IT GovernanceManagementPG 139 Data GovernanceProvide Oversight,Design GovernanceFramework andArrangements topromote good behaviors(Master orEnterprise) DataManagementDevelop and SupportData per GoverningPolicies and StandardsData Requirements & ModelingData AdministrationMetadata ManagementData Quality (Enterprise and Local)Privacy and Security
Proceedings of the MIT 2007 Information Quality Industry SymposiumLinking IQ Strategy with the DataGovernance FrameworkEnterprise IQStrategy irableBehaviorsfor DataPG 140Data Governance ArrangementsDecision rights via monarchies, federal, feudal,duopolies, etc.Data GovernanceMechanisms(Committees, budgets, etc.)Key Data Decisions Strategy and Principles ArchitectureInfrastructure & TechnologyApplications & ProcessesInvestmentBusinessPerformanceGoalsData MetricsandAccountabilities
Proceedings of the MIT 2007 Information Quality Industry SymposiumSteps in Establishing DataGovernance to Enable IQ Strategy1. Identify Key Enterprise Data Processes2. Articulate a Governance Structure for theseProcessesA. Who will be responsible, accountable, consultedand/or informed for decisions regarding thesekey enterprise data processes?B. How will these decisions be made andmonitored?3. Track achievement of data objectives, dataprocess performance, and data process capabilityPG 141
Proceedings of the MIT 2007 Information Quality Industry SymposiumStep 1- Identify Your KeyEnterprise Data Processes Business DataRequirements Info architecture/DataModels/SoA/SoR Data (Quality)Management & Admin Structured Data Issues Data SynchronizationMeta DataData Retention/Archiving/Aging Data Security/ID Mgmt Data PrivacyPG 142 Application Processes Data Origination /AuthorizationControls Data Input Controls Data ProcessingControls Data Output Controls Boundary Controls Unstructured DataIssues Document Repository Email
Proceedings of the MIT 2007 Information Quality Industry SymposiumWhere in Your Organization are YourKey Data Processes and Players?ITMonitor &EvaluateAcquire BusinessUnit(s)InformationArchitectPlan andOrganizeDeliver &SupportBI / ETLSupportBus. DataStewardsData Czaror DirectorDataMgmtData Req’ts& ModelingDataAdmin.Other KeySupportAreasBusinessSMEsBus. Req’ts& NeedsData AnalystData Administrator, CDIData vacy &SecurityData SecurityManagerOther KeyAreasDataQualityPG 143Data Quality ManagerBusinessAnalyst
Proceedings of the MIT 2007 Information Quality Industry SymposiumStep 2 – Identify your GovernanceArrangements and MechanismsA. Who has Decision and/or Input Rightsfor the Decisions that must be madeconcerning your Key Data Processes?B. What will be the Data GovernanceMechanisms (i.e. How will Decisions beMade and Monitored)? Decision-Making Structures Alignment Processes Communication ApproachesPG 144
Proceedings of the MIT 2007 Information Quality Industry SymposiumStep 2 Cont.: Forming a DataGovernance Council Its members come from multipleorganizations from both IT and businessareas It meets on a regular basis Key lines of business are represented There is a list of sanctioned standards thatserve as operating principles for handlingexceptions, conflicts, investments, metricsand reporting regarding data and its quality The council communicates to executivemanagement, data stewards, projectmanagers, and other stakeholdersPG 145
Proceedings of the MIT 2007 Information Quality Industry SymposiumStep 2 Cont.: Data GovernanceCouncil Objectives To provide common processes and policiesfor information on behalf of the company To enforce the adoption of data standardson every IT project To guide the management of enterprisedata across subject areas To reduce scrap and rework associated withpoor, missing, inaccurate, unavailable, orhard to find data, and to measure thatreductionPG 146
Proceedings of the MIT 2007 Information Quality Industry SymposiumStep 2 Cont.: Additional DataGovernance Council Objectives To be accountable for the ongoingimprovement of the quality and valueof the corporate data asset To support individual project teams inthe access and use of commoncorporate data To establish a common vocabularyand culture around the deployment ofcompany dataPG 147
Proceedings of the MIT 2007 Information Quality Industry SymposiumStep 3: Track Data Metrics andthe Value of Data to the Business Business Data Measures: These measures definewhat the business expects from its dataprocesses (i.e. outcomes) and what the businesswould use to determine if its data needs arebeing met Data Process Measures: These measures gaugethe efficiency and effectiveness of theperformance (i.e. execution) of the data process Benchmark Measures: These measures assessthe data process capability expressed asmaturity models, derived from the SoftwareEngineering Institute’s Capability Maturity ModelPG 148
Proceedings of the MIT 2007 Information Quality Industry SymposiumStep 3 Cont.: Devising aBalanced Data Quality ScorecardPG 149
Proceedings of the MIT 2007 Information Quality Industry SymposiumStep 3 Cont.: Benchmarking ProcessCapability against a Maturity Model PG 1500 Non-existent: Complete lack of any recognizable processes. The enterprise has noteven recognized that there is an issue to be addressed1 Initial: There is evidence that the enterprise has recognized that the issues existand need to be addressed. There are; however, no standardized processes; insteadthere are ad hoc approaches that tend to be applied on an individual or case-by-casebasis. The overall approach to management is disorganized2 Repeatable: Procedures have developed to the stage where similar procedures arefollowed by different people undertaking the same task. There is no formal training orcommunication of standard procedures, and responsibility is left to the individual.There is a high degree of reliance on the knowledge of individuals and, therefore,errors are likely3 Defined: Procedures have been standardized and documented, and communicatedthrough training. It is; however, left to the individual to follow these processes, and itis unlikely that deviations will be detected. The procedures themselves are notsophisticated but are the formalization of existing practices4 Managed: It is possible to monitor and measure compliance with procedures and totake action where processes appear not to be working effectively. Processes are underconstant improvement and provide good practice. Automation and tools are used in alimited or fragmented way5 Optimized: Processes have been refined to a level of best practice, based on theresults of continuous improvement and maturity modeling with other enterprises. It isused in an integrated way to automate the workflow, providing tools to improvequality and effectiveness, making the enterprise quick to adapt
Proceedings of the MIT 2007 Information Quality Industry SymposiumReferences COBIT 4.1 published by the IT GovernanceInstitute. Available at www.isaca.org/cobit IT Governance: How Top PerformersManage IT Decision Rights for SuperiorResults by Peter Weill and Jeanne Ross(Harvard Business School Press, 2004) Concepts in Strategic Management andBusiness Policy by Thomas Wheelen and J.David Hunger (Pearson/Prentice Hall, 2006) Customer Data Integration: Reaching aSingle Version of the Truth by Jill Dycheand Evan Levy (John Wiley & Sons, 2006)PG 151
Proceedings of the MIT 2007 Information Quality Industry SymposiumAppendix: COBIT-IT Processes areOrganized into 4 Categories PG 152Plan and Organize: This domain covers strategy andtactics, and concerns the identification of the way IT canbest contribute to the achievement of the businessobjectivesAcquire and Implement: To realize the IT strategy, ITsolutions need to be identified, developed, or acquired, aswell as implemented and integrated into the businessprocessDeliver and Support: This domain is concerned with theactual delivery of required services, which includes servicedelivery, management of security and continuity, servicesupport for users, and management of data and theoperational facilitiesMonitor and Evaluate: All IT processes need to beregularly assessed over time for their quality andcompliance with control requirements
Proceedings of the MIT 2007 Information Quality Industry SymposiumPlan and Organize Processes PG 153PO1: Define a strategic IT planPO2: Define the information architecturePO3: Determine technological directionPO4: Define the IT processes, organization andrelationshipsPO5: Manage the IT investmentPO6: Communicate management aims and directionsPO7: Manage IT human resourcesPO8: Manage qualityPO9: Assess and manage IT risksPO10: Manage projects
Proceedings of the MIT 2007 Information Quality Industry SymposiumAcquire and Implement Processes AI1: Identify automated solutions AI2: Acquire and maintain applicationsoftware AI3: Acquire and maintain technologyinfrastructure AI4: Enable operation and use AI5: Procure IT resources AI6: Manage changes AI7: Install and accredit solutions andchangesPG 154
Proceedings of the MIT 2007 Information Quality Industry SymposiumDeliver and Support Processes PG 155DS1: Define and manage service levelsDS2: Manage third-party servicesDS3: Manage performance and capacityDS4: Ensure continuous serviceDS5: Ensure systems securityDS6: Identify and allocate costsDS7: Educate and train usersDS8: Manage service desk and incidentsDS9: Manage the configurationDS10: Manage problemsDS11: Manage dataDS12: Manage the physical environmentDS13: Manage operations
Proceedings of the MIT 2007 Information Quality Industry SymposiumMonitor and Evaluate Processes ME1: Monitor and evaluate ITperformance ME2: Monitor and evaluate internalcontrol ME3: Ensure regulatory compliance ME4: Provide IT governancePG 156
Governance to Enable IQ Strategy 1. Identify Key Enterprise Data Processes 2. Articulate a Governance Structure for these Processes A. Who will be responsible, accountable, consulted and/or informed for decisions regarding these key enterprise data processes? B. How will these decisions be made and monitored? 3. Track achievement of data .
