Proven with Industry Leaders
What our data governance consulting produces
Six deliverables, each with a record behind it. A governance program that cannot produce the record is a policy, not a control.
| Deliverable | What it is | The evidence it produces |
|---|---|---|
| Operating framework | Owners, stewards, policies, and decision rights | Named accountability for each critical data domain |
| Data catalog | Collibra, Alation, or Atlas on Cloudera | An inventory of data assets with owners and definitions |
| Access model | Access policy enforced in the platform, such as Ranger policies | Policy definitions and the access logs they produce |
| Data lineage | Source to report, with Octopai or Atlas | Lineage for the data elements reviewers ask about |
| Data quality rules | Rules per critical data element, measured and alerted | Quality scores and a record of each exception and its fix |
| Evidence pack | What examiners and auditors ask to see | A pack mapped to the rules you answer to |
An operating model people actually follow
Most governance programs stall because they try to govern everything at once. Ours starts narrow, with the data that feeds regulatory reports, risk models, and AI, and grows from there.
How we set it up
- Start with the critical data elements that feed regulatory reports, risk models, and AI, not the whole estate
- Name an owner and a steward for each domain, with decision rights written down
- Write policies short enough that people follow them, and enforce them in the platform
- Review the model on a fixed cycle, so it changes when the business does
Data governance for BCBS 239 and HIPAA
The deliverables are the same in every industry. What changes is the rule the evidence is mapped to and who reviews it.
The Basel Committee’s principles for risk data aggregation and risk reporting cover governance, data architecture, aggregation capabilities, and reporting practices. They are required of global systemically important banks, and the Committee asks national supervisors to apply them to domestic systemically important banks. Lineage, data quality rules, and named ownership are how a bank shows it meets them.
Financial servicesThe HIPAA Security Rule requires access controls and audit controls on systems that hold electronic protected health information. An access model enforced in the platform, and the logs it produces, turn those requirements into records a compliance team can review.
HealthcareCompliance and legal decisions have their owners: your risk, legal, and compliance teams. We design the architecture that makes their position demonstrable. We are integrators, not counsel.
Data quality rules with owners
A quality rule is useful only if someone owns the exception. Each rule we define has a threshold, a measurement, an alert, and a named owner, and the pipeline checks it where data enters and where it changes. The pipelines themselves are the work of data engineering consulting.
The foundation for governed AI
A model or an agent is only as defensible as the data underneath it. Lineage and quality records are the first thing a risk committee asks for when an AI use case comes up for approval. Governing the AI systems themselves is covered in AI governance consulting.
Data governance, answered plainly.
Data governance consulting
What is data governance consulting?
Data governance consulting sets up how an organization owns, controls, and proves the state of its data. The work produces an operating framework of owners and stewards, a data catalog, an access model enforced in the platform, data lineage, data quality rules, and the evidence regulators and auditors ask for.
How long does a data governance framework take?
A governance framework typically takes 8 to 12 weeks. Catalog, lineage, and access work is sized to the estate after an AI Readiness Assessment, and usually starts with the critical data elements rather than everything at once.
Which data governance tools do you work with?
Collibra and Alation for the catalog, Octopai and Atlas for lineage, and Atlas and Ranger on Cloudera for metadata and access policy.
What is the difference between data governance and AI governance?
Data governance covers the data itself: who owns it, who can access it, where it came from, and whether it is accurate. AI governance covers the AI systems that use that data: inventory, validation, evidence, and runtime controls on agents. AI governance depends on data governance, because a model is only as defensible as the data underneath it.
Regulation and evidence
What is BCBS 239?
BCBS 239 is the Basel Committee’s set of 14 principles for effective risk data aggregation and risk reporting, grouped into governance and infrastructure, aggregation capabilities, reporting practices, and supervisory review. They are required of global systemically important banks and recommended for domestic systemically important banks.
How does data governance support HIPAA compliance?
The HIPAA Security Rule requires access controls and audit controls on systems holding electronic protected health information. Data governance puts an access model in the platform and keeps the records it produces. Compliance and legal decisions stay with your own teams; we build the architecture that makes their position demonstrable.
Engagements
What does data governance consulting cost?
It depends on scope. Engagements start with an AI Readiness Assessment, a fixed-scope review that takes 2 to 4 weeks. A governance framework typically takes 8 to 12 weeks after that, and catalog and lineage work is sized to the estate.
Who keeps governance running after the framework is in place?
Your data office and stewards own it. We can carry the operation of the catalog, access policies, and quality rules as support and managed services, or provide an outsourced team, if you would rather not staff it.
Part of our data and AI consulting practice. For governance at a bank, see also KYC and AML technology consulting.