Big data governance as a corporate governance imperative
9 likes3,163 views
The document emphasizes the critical importance of data governance as a key aspect of corporate governance, particularly in managing reputation risk and ensuring accountability at the board level. It outlines the significant financial impacts of poor data management and the prevalence of data breaches, highlighting the necessity for integrated governance strategies. The conclusion stresses that boards must be proactive in overseeing data risks, utilizing diagnostics to strengthen governance frameworks and mitigate potential risks.
Big data governance as a corporate governance imperative
- 1. Big Data Governance as a Corporate Governance Imperative A guide for Boards of Directors and the C-Suite Guy Pearce REData Performance Consulting guyp@redata.ca (SlideShare Version) National Privacy & Data Governance Congress Calgary, 16 October 2014 © REData Performance Consulting 2014
- 2. Accountable to shareholders for performance, risk and sustainability Introduction: Organizational Scope Accountable to the board of directors for performance, risk and sustainability Accountable to the CEO for functional performance, risk and sustainability Board of Directors CEO C-Suite Operational Executives Organizational Governance © REData Performance Consulting 2014
- 3. Introduction: Big Data - a different class of data to operational data Sensor data (incl wearables) Customer Data “Small” structured ext data Data Lake (Hadoop) ODS / DW Operations (RDBMS) Conceptual, integrated data architecture Social media Reporting & Analytics Decisioning Big Data Analytics Business Organize Processes Analyze Operationalize Insights Organize Data fusion and/or integration between big data and regular operational data Basic corporate operational data cycle Unstructured int & ext data Big Data © REData Performance Consulting 2014
- 4. Corporate Business Model Corporate Operating Model Introduction: Selected operational data risk drivers 5. Quality Data Governance Landscape (ex big data) © REData Performance Consulting 2014
- 5. Corporate Business Model Corporate Operating Model Introduction: Selected big data risk drivers Unstructured int & ext data Organize Data Lake (Hadoop) ? Social media Sensor data (incl wearables) Operations Decisioning Big Data Analytics Data Governance Landscape (big data) © REData Performance Consulting 2014
- 6. Reputation risk concerns threats to the good name or standing of an entity. It is the number one risk on the board’s agenda. Deloitte Firms are vulnerable to reputation damage because: • Firms with good reputations are perceived as providing more value, which results in more loyal customers buying a broader ranges of products and services, often at a premium • The market believes they deliver sustained earnings & growth, resulting in higher PEs, market caps and lower costs of capital • 70% to 80% of market cap comes from intangible assets HBR It takes 20 years to build a reputation and 5 minutes to ruin it. If you think about that, you'll do things differently. Warren Buffett Let’s see how poor data governance affects reputation risk
- 7. 3.1 trillion reasons Why Data Governance (Quality)? Annual dollar cost to the US economy of poor quality. Of this, $600 billion is the cost of poor data quality to companies
- 8. 589 million reasons Why Data Governance (Breach)? The financial cost to date of the Target data breach (lost profit and corrective action)
- 9. Data-Stealing Malware Stolen Credentials Backdoor Malware RAM Scraping Phishing How do data breaches happen (Access)?
- 10. 669 million reasons Why Data Governance (Privacy)? The number of private records compromised in data breaches in the US since 2005
- 11. Why Data Governance? Five key big data privacy and data protection challenges Dr Waël Hassan
- 12. • 97% of data breaches are avoidable Information Systems Audit and Control Association (ISACA) • 94% of breaches are detected by a 3rd party, an average of 416 days after the event How do most data breaches occur? HP
- 13. Who is accountable? BMO as but one example
- 14. Trends in Corporate Governance: Cybersecurity • Expect lawsuits targeting boards for data breach and investor loss • Expect greater risk regulation and spends for financial service companies and non-banks • Expect lawsuits and increasing regulation for risk management laggards Yes, the board is accountable Dr R Leblanc; Associate Professor; Law, Governance & Ethics; York University. Canadian Lawyer Magazine; Feb 3 2014
- 15. Quality Data Governance Security and Access Privacy Lifecycle Management Because of overlaps, good data governance means integrated data governance © REData Performance Consulting 2014
- 16. Governance (Corporate, IT, Data) IT Governance is an element of Corporate Governance Data Governance is an element of IT Governance Risk (IT, Data) Security is one type of risk. So is privacy and compliance Compliance (Data) A u d i t Privacy is one element of Compliance Data governance in a GRC context © REData Performance Consulting 2014
- 17. Poor data governance increases the likelihood of • a negative impact on brand equity • Specifically security, privacy and quality • a negative impact on market capitalization • Specifically security, compliance (regulatory fines & penalties) • a negative impact on credit rating, • All aspects of data governance as operating risk mitigation all of which are the outcomes of reputation risk, which is the top risk on the board’s agenda Data governance is a corporate governance imperative because it’s about reputation risk
- 18. • Lack of board or senior executive ERM leadership, 30% • Competing priorities, chosen by 51% of respondents • Perception ERM adds bureaucracy, 33% • Lack of perceived value, 41% • Insufficient resources, 43% Reward must be considered in a risk-return context. Poor alignment between strategy and risk is a reason for most perceived barriers to effective risk management Barriers to effective risk management CGMA survey 2014, n=446
- 19. • No control over the source and its sustainability • Slow-to-mature legislative context Impossible to mature given continued explosive growth? • Quality is an unknown • IoT (incl. wearables) • Data fusion • Cloud How does Data Governance change in the presence of Big Data? © REData Performance Consulting 2014
- 20. COBIT / ISO38500 Diagnostics How to identify data governance weaknesses: Step 1
- 21. REData IT Governance and Data Governance Diagnostics Perspective Scope Enterprise CObIT version 4.0 © REData Performance Consulting 2014 Governance diagnostics expose weaknesses Diagnostics hot spots often reinforce each other, for example, inconsistencies in sections 2, 5 and 8 dealing with Outsourcing, Security and Incidents
- 22. Business Process Analysis Diagnostics directs which processes to prioritize for BPR, and for integrated data governance How to identify data governance weaknesses: Step 2
- 23. How to identify data governance weaknesses: Step 2 Processes improvements generate cost savings that can be used to improve lifecycle management, quality, security and privacy. Improved processes also reduce risk by minimizing the number of points where quality, security and privacy risks can manifest An example of risk reduction by BPR Example from www.gerke.com
- 24. • Data governance is risk management • Poor data governance incurs reputation risk, which means data governance has corporate governance implications • Full scope data governance = ƒ(security, privacy, quality, data lifecycle management) • It is unacceptable for the Board to be ignorant of its accountability for data risk, given its fiduciary duty of risk oversight • Diagnostic tools can help identify weak spots and improve end-to-end data governance, while BPR conducted with data governance in mind can significantly reduce risk Conclusion