Inside Applied Data Governance: Expert Perspectives from the ADGP Program Episode 5: Policies, Standards, and Risk Management in Practice with Jimm Johnson

What does it look like in an organization? And let's think about it early in its governance maturity.

I think this is going to resonate with a lot of people.

So it's not sophisticated algorithms and formal cadences and compliance dashboards and predictive modeling on things are going to go bad.

That's the advanced world, right? If you are in an environment where everything is manual or semimanual, it's reactive, it's defensive and conversational, constant firefighting or being behind the eight ball.

This is immature risk management early in the process.

If you don't even have a risk management department and you're not talking risk in your strategic plan or in your projects or other areas of operations, that's also a sign of immaturity.

In organizations like that, you tend to operate on tribal knowledge, you got to know who to call, how to get things done.

And now it's the phone a friend network or the no guy network.

Those are single point of failures and bottlenecks.

It silos data and risk to people and departments and lines of business don't understand how their data practices affect other areas.

So while this area is concerned about SSN, I not Okay, well, that's risk to the enterprise, right? And if you're not looking at this from an enterprise standpoint, you're actually contributing to the risk.

And people are doing this all day long, saving files on file shares, for example.

I worked at a company where somebody took a picture of sensitive data on a screen and then emailed it because they couldn't export the data to email the data.

So they emailed a picture instead.

I mean, people find creative ways of getting around this.

So how does it manifest? Otherwise, you'll see errors in reports that people are complaining about, variation in reports, accidental discovery of problems because now the risks have manifested as issues.

Audit findings oftentimes surface risk.

When you don't fulfill the audit requirements or your regulatory submissions, you get failed repeatedly.

Gut checks, red, yellow, green kinds of things on executive dashboards that don't have real data behind them.

Shadow IT and analytics, absolute risk.

Compliance blind spots.

I mentioned SSN earlier.

Why are we talking about all the sensitive and confidential data sets at the organization? Every industry I've ever been in has focused on probably a number of data outlets I could count on one hand.

And then one organization, you know, you got a policy that mentions a couple dozen.

Why aren't we looking at all of them, right? So what do you do? I think we need guardrails in plain English that people can understand things like never email a spreadsheet with personal information in it or get approval to share data with external parties.