## Intro Data governance succeeds when it produces trusted data, faster decisions, and lower risk. This guide shows how to measure that success with a practical KPI framework you can implement in weeks, not months. It is written for CTOs, CIOs, CDOs, data platform leaders, stewards, and risk owners who need a small, decision-grade set of indicators that connect governance work to business outcomes. You will learn how to choose the right KPIs, define unambiguous formulas and thresholds, set an operating rhythm, build a focused dashboard, and interpret conflicting signals. Templates and worked examples are included. ## When to use this approach (and when not) Use it when: - You have Tier-1 or critical data assets and recurring questions about ownership, quality, or access. - Stakeholders want evidence that governance investments reduce risk and enable delivery. - You can instrument your catalog, quality monitors, access workflows, and incident tickets. Do not start here if: - Basic foundations are missing (no catalog, no stewards, no incident tracking). First establish minimum viable governance: asset inventory, owners, and issue logging. - The organization seeks vanity metrics over improvement. Align on decisions each KPI will inform before instrumenting. Prerequisites: - Defined critical data elements (CDEs) and Tiering. - A single place to store KPI definitions and measurements. - Named owners for each KPI and for each Tier-1 asset. Limitations: - KPIs are proxies. Pair quantitative measures with periodic qualitative reviews. - Over-optimization can create perverse incentives. Use anti-gaming controls. ## A simple KPI framework for data governance Categorize metrics so leaders see both work done and outcomes achieved: - Governance activity metrics (leading): Are we doing the work? Examples: ownership coverage, glossary curation throughput. - Control effectiveness metrics (diagnostic/guardrail): Are controls operating as intended? Examples: access-review completion, retention enforcement. - Data quality and reliability metrics (lagging/diagnostic): Are products healthy? Examples: CDE quality score, freshness SLO attainment, incident recurrence. - Adoption and value metrics (lagging): Is governed data used? Examples: glossary adoption, governed asset usage. - Risk and exposure metrics (guardrail/lagging): Is risk trending down? Examples: policy exceptions rate, data incident severity index. - Business outcome metrics (lagging): Does governance accelerate delivery and decisions? Examples: time-to-insight for priority use cases, audit finding closures. Metric types to combine: - Leading indicators: early signals (e.g., ownership coverage). - Lagging indicators: realized outcomes (e.g., repeat-incident rate). - Diagnostic indicators: explain why results look the way they do (e.g., lineage coverage driving MTTD). - Guardrail indicators: prevent unsafe outcomes (e.g., retention compliance). - Vanity indicators: activity without impact; avoid or pair with outcomes (e.g., glossary entries created without adoption). Adapt by maturity: - Early: prioritize coverage and control activation (ownership, access reviews, lineage coverage for Tier-1). - Mid: add quality, adoption, and remediation SLAs. - Advanced: include business outcomes and cost-to-serve; prune vanity metrics. ## KPI design template (use for every metric) For each KPI, document: - Purpose: what decision it informs. - Formula: exact calculation and scope. - Numerator / Denominator: defined and auditable. - Data source(s): systems, tables, queries. - Owner: accountable role. - Cadence: collection and review frequency. - Target & thresholds: green/yellow/red. - Limitations: known gaps or biases. - Anti-gaming controls: balancing measures and audits. ## Core governance KPI set (precise definitions) Below is a concise, implementable set. Adjust thresholds to your risk appetite. ### 1) Ownership coverage (leading) - Purpose: ensure every Tier-1 dataset has accountable ownership. - Formula: 100 * (Tier-1 datasets with named owner AND steward) / (Tier-1 datasets). - Numerator/Denominator: counts of Tier-1 assets from catalog. - Data sources: data catalog; domain registry. - Owner: Head of Data Governance. - Cadence: weekly. - Target & thresholds: Green >= 100%; Yellow 95–99%; Red < 95%. - Limitations: documentation may not reflect reality. - Anti-gaming: quarterly owner confirmations; pair with Issue remediation SLA and decision turnaround for changes. ### 2) CDE quality score (lagging/diagnostic) - Purpose: quantify reliability of critical data elements. - Formula: 100 * (sum of passed check weights across CDEs) / (sum of applicable check weights across CDEs). - Numerator/Denominator: weighted checks over defined CDE list. - Data sources: data quality monitor, observability platform. - Owner: Data Product Owners. - Cadence: daily collection; monthly review. - Target & thresholds: Green >= 97%; Yellow 94–96.9%; Red < 94%. - Limitations: incomplete check coverage biases results. - Anti-gaming: change control for disabling checks; track check coverage and incident trends alongside score. ### 3) Lineage coverage (diagnostic) - Purpose: speed impact analysis and root cause detection. - Formula: 100 * (Tier-1 assets with lineage one hop upstream and downstream) / (Tier-1 assets). - Data sources: lineage tool, ETL orchestration. - Owner: Data Platform Lead. - Cadence: bi-weekly. - Target & thresholds: Green >= 95%; Yellow 85–94.9%; Red < 85%. - Limitations: automated lineage can miss dynamic queries. - Anti-gaming: monthly spot-checks; correlate with MTTD/MTTR. ### 4) Glossary adoption (lagging) - Purpose: drive consistent definitions in analytics and models. - Formula (option A): 100 * (BI queries referencing approved glossary terms/metrics) / (total BI queries on Tier-1 datasets). - Formula (option B): 100 * (Tier-1 datasets mapped to at least one approved term) / (Tier-1 datasets). - Data sources: business glossary, BI query logs, catalog mappings. - Owner: Stewardship Lead. - Cadence: monthly. - Target & thresholds: Green >= 90%; Yellow 75–89.9%; Red < 75%. - Limitations: synonyms and free-text fields. - Anti-gaming: focus on usage in production dashboards; review term deprecations. ### 5) Access-review completion (guardrail) - Purpose: ensure least-privilege through periodic recertification. - Formula: 100 * (user-role pairs reviewed within policy window) / (user-role pairs due). - Data sources: IAM/GRC tool, HR system. - Owner: Security or Privacy Officer. - Cadence: quarterly. - Target & thresholds: Green = 100% by due date; Yellow 95–99.9%; Red < 95%. - Limitations: reviewer fatigue. - Anti-gaming: random sampling of entitlements; deprovisioning time KPI. ### 6) Policy exceptions rate (risk) - Purpose: track reliance on temporary exceptions. - Formula: 1000 * (approved exceptions active) / (total access decisions in period). - Data sources: GRC workflow; access approval logs. - Owner: CISO or DPO (Data Protection Officer). - Cadence: monthly. - Target & thresholds: set a baseline; drive a 25–50% reduction over 2–3 quarters; Red if rising for 2 consecutive months. - Limitations: context-specific justifications. - Anti-gaming: auto-expiry and mandatory owner for each exception; track average exception age. ### 7) Issue remediation SLA attainment (diagnostic) - Purpose: close data issues at the speed risk warrants. - Formula: 100 * (issues closed within SLA by severity) / (issues closed in period), reported by severity band. - Data sources: incident/issue tracker (e.g., Jira, ServiceNow). - Owner: Data Platform Lead. - Cadence: weekly. - Target & thresholds: P1 >= 90%, P2 >= 85%, P3 >= 80%. - Limitations: severity gaming. - Anti-gaming: severity review board; monitor reopen rate and median time to resolve (MTTR). ### 8) Retention compliance (guardrail) - Purpose: enforce data retention and deletion policies. - Formula: 100 * (Tier-1 datasets with enforceable retention configured and last test pass) / (Tier-1 datasets with a retention requirement). - Data sources: storage lifecycle configs, data lake/warehouse policies, DLP logs. - Owner: Privacy Lead with Engineering. - Cadence: monthly. - Target & thresholds: Green = 100%; Yellow 95–99.9%; Red < 95%. - Limitations: partial copies and ad-hoc exports. - Anti-gaming: sample restore-and-verify deletion tests; track shadow copies found. ### 9) Data incident trends (lagging) - Purpose: track harm from data failures. - Formula (primary): incidents per 1,000 pipeline runs; severity-weighted incident index; 30-day recurrence rate. - Data sources: incident tickets, pipeline metadata. - Owner: Incident Manager for Data. - Cadence: weekly rollup; monthly review. - Target & thresholds: downward trend QoQ; recurrence < 10%. - Limitations: detection bias if monitoring is weak. - Anti-gaming: require root-cause analysis quality checks; track detection coverage. ## Sample dashboard (executive view) - Coverage and controls - Ownership coverage: 98% (Yellow) - Lineage coverage: 96% (Green) - Access-review completion: 100% (Green) - Retention compliance: 92% (Red) - Data health - CDE quality score: 97.8% (Green) - Incident index: 0.42 per 1k runs (Yellow); recurrence 8% (Green) - Adoption and risk - Glossary adoption: 82% (Yellow) - Policy exceptions rate: 11 per 1k decisions, avg age 46 days (Red) Traffic lights link to owners and last actions. A one-page pre-read includes trend spark-lines and the top three decisions required this month. ## Worked example: interpreting conflicting signals Situation (hypothetical): - CDE quality score is Green (98.5%). - Incident index is Yellow and rising for two months. - Lineage coverage is Green (97%). - Policy exceptions rate is Red and rising; exception age increasing. Interpretation: - High quality score with rising incidents implies gaps in check coverage or scope. Diagnostics: check coverage by CDE, compare incident root causes to missing checks, review freshness SLO adherence. - Rising exception rate suggests process pressure (e.g., teams bypassing normal access for urgent launches), raising exposure. Decisions this month: - Freeze new exceptions over 30 days old; enforce auto-expiry at 60 days; require senior approval to renew. - Add or re-enable checks addressing top-two recurring root causes; lock catalog changes to checks without steward approval. - Increase glossary adoption by targeting top 10 dashboards missing approved terms; assign product owners and a 30-day fix window. Expected outcomes: - Incident index stabilizes within 1–2 cycles; exception age drops; adoption improves where analytics risk is concentrated. ## Operating rhythm - Weekly (30 minutes): review leading and guardrail KPIs for Tier-1 (ownership coverage, lineage coverage, access-review completion), plus any Red items. Assign 1–2 corrective actions. - Monthly (60 minutes): assess outcomes and risks (CDE quality, incidents, retention, exceptions). Approve policy/process adjustments; reset thresholds if warranted and documented. - Quarterly (90 minutes): evaluate business impact (time-to-insight for priority use cases, audit closure rates). Retire low-signal KPIs; expand scope cautiously. Rules of engagement: - One accountable owner per KPI and per Tier-1 dataset. - Unambiguous formulas and scopes, version-controlled. - Balanced measures to reduce gaming (e.g., pair quality score with incident recurrence and check coverage). ## End-to-end example: a 90-day pilot Context (hypothetical): A SaaS company with a product analytics platform has unclear ownership, recurring freshness issues, and slow, exception-heavy access. Tier-1 assets: billing tables, customer master, product events. Pilot scope and owners: - Governance activity: Ownership coverage (Head of Data Gov). - Controls: Access-review completion, Retention compliance (Security and Privacy leads). - Quality: CDE quality score (Data Product Owners). - Diagnostic: Lineage coverage, Issue remediation SLA (Data Platform Lead). - Adoption/risk: Glossary adoption, Policy exceptions rate (Stewardship Lead, CISO). - Outcome: Data incident trends (Incident Manager for Data). Targets (illustrative): Ownership 100%; CDE quality >= 97%; Lineage >= 95%; Access-review = 100% on time; Retention = 100%; Glossary adoption >= 85%; Exceptions <= 8 per 1k decisions with avg age < 30 days; P1 SLA attainment >= 90%; Incident recurrence < 10%. Cadence and decisions: - Weeks 1–2: Baseline all KPIs; fix missing owners; set thresholds. - Weeks 3–6: Close Red items (retention gaps, aged exceptions). Add missing CDE checks and lineage for top event pipelines. - Weeks 7–10: Drive glossary adoption in top dashboards; tighten exception approval levels. - Weeks 11–13: Re-baseline; compare trends; decide whether to scale scope to finance and marketing domains. Risks and mitigations: - Metric overload: limit to nine KPIs; park the rest. - Tool limits: use manual sampling where automation is not ready. - Local optimization: reinforce balanced measures in pre-reads and reviews. ## Conclusion Start with a balanced set of nine KPIs across activity, control effectiveness, data quality, adoption, risk, and outcomes. Define each with clear formulas, owners, cadences, targets, thresholds, limitations, and anti-gaming controls. Review weekly and monthly, and use a single-page dashboard to focus decisions. After a 90-day pilot on Tier-1 assets, scale what works and retire what does not. The payoff: clearer accountability, fewer surprises, faster decisions, and safer data use.