Master Data Management, Risk and Governance

Transcription

1 Master Data Management, Risk and Governance Look for more expanded versions of this and more material in EIM for Business Managing Information as an Asset, in May 2010 by Morgan Kaufman Publishing, Elsevier Inc. 0

2 Problem Statement What types of risks can we identify that will urge the organization towards managing information more effectively, specifically via MDM? How does risk management fit into MDM delivery? 1

3 Key Terms Enterprise Information Management - EIM is the program that manages enterprise information asset to support the business and improve value. EIM manages the plans, policies, principles, frameworks, technologies, organizations, people and processes in an enterprise towards the goal of maximizing the investment in data and content MDM - Authoritative, reliable foundation for data used across many applications & constituencies with goal to provide single view of truth no matter where it lies DG - Data governance is the organization and implementation of policies, procedures, structure, roles, and responsibilities which outline and enforce rules of engagement, decision rights, and accountabilities for the effective management of information assets 2

4 Agenda Understanding the risks and benefits you may be overlooking Identifying and classifying risk areas within MDM Leveraging governance and compliance within MDM 3

5 Understanding the risks and benefits you may be overlooking 4

6 * Top 5 Drivers for MDM Initiatives Customer cross sell Item / Product management Compliance & regulatory reporting Legacy system integration & augmentation Mergers and acquisitions * Source: MDM Institute, 2009 Risk management? 5

7 The nature of EIM Business cases Managed, Actionable Enterprise Information And Knowledge 6 Benefits from Risk Avoidance (e.g. Sarbanes-Oxley Act, information privacy, data quality, etc. )

8 Example where is the risk here? Industry Std, New Industry Std New Industry Std Industry Std,, ACCT NO ACCT NO Client ID Apply Approve Disapprove Marketing Interim License Services Client Service Bill Settle Clear Authorize Industry Std Client Information Touch points Notify Final Approval Maintain License Terminate License Maintain Relationships (Parent Child) Industry and really really old system Industry and really really old system and Client ID Industry Std again ACCT NO, Industry and really really old system Client Id 7

9 Compelling scenarios Clay layers You start coding, and (fill in the blank) 8

10 Clay layers CIO saw MDM as needed technology Applications area spent high 7 figures on tool and consolidating known customer data Results Passive resistance Direct resistance Counter projects Loss of market share for product line that did use MDM application MDM product and project terminated 9

11 You start coding, and. MDM recommended as approach to mitigate failed DW project (customer data was awful) Vendor consultants turned product into an enterprise event hub The new and old applications MDM was to support ignored attempts to gather requirements After one year, technology seemed ineffective, and resistance levels insurmountable Part of recovery effort was risk based business case, based on market share recovery and regulatory short falls 10

12 Identifying and classifying risk areas within MDM 11

13 Business Value MDM candidates for EIM prioritizing High Notional View - Balancing Risk and reward by information content type Product Customer Promotion Finance Employee Employee Supplier Transac'n Dist. Channel Agreements 12 Low Low Risk High

14 Review Basic Business Case Steps Understand business benefits Isolate information usage enablers Identify business benefits that are possible Describe specific benefits, costs and/or at risk quantifiers Define relevant EIM benefit categories - Risk, business, project, regulatory Identify potential cash flows 13

15 Origins of Risk Benefits for EIM 14

16 Identify Touch Points 15 Processes where information can be used to improve a process, accomplish a goal, change a strategy, manage risk Opportunities where data and information affect outcomes Data quality Consistent usage Timely action Avoid penalty Reduce exposure

17 Example: Touch point risks for MDM element 16

18 Summary for the EIM Risk-based Business Case Look for scenarios where: using data or information directly supports an aforementioned goal or objective increases the value of some component of the balance sheet Decreases the reserve, contingency or cost being accounted for Requires formal analysis - not all of your business objectives will lend themselves to EIM inspired governance There must be some exercise similar to this before the MDM function is established Data that is not used has no value. If usage is not monitored, you have no idea of its value. If not used, why are you messing with it? Remember, EIM (MDM and DG) exists to ensure information assets add value 17

19 Leveraging Governance and Compliance MDM Governance Compliance 18

20 MDM and Data Governance 19 MDM champions Data Governance and vice versa Data Governance is mandatory for MDM Interaction with Data Governance area needs to be constant and consistent Observed issues Business user education Metrics Risk-related efforts make Data Governance mandatory

21 20 Data Governance and Risk Management Privacy Legal penalties (tip of the iceberg) Civil actions Fines Credibility Lower stock price, valuations Fraud Lost credibility Lower stock price, valuations Credit Risk / Exposure Transparency R O I Lower stock price, valuations Poor business decisions NO business decisions

22 Compliance Role in MDM Define where line of authority sits Mechanism to report problems Support to implement scans and audits within MDM processing Policy-based interaction with data quality areas 21

23 Compliance Regulatory Risks HIPAA Regulation Gramm-Leach-Bliley Act SEC Rule 17A-4 Impact on EIM Forces encryption, rigid rules on individual record keeping Requires accurate name. address, and opt-out processes Forces policies for structured and unstructured data Sarbanes-Oxley Section 302 Section 404 Section 409 Pressures company s chief financial officer and chief executive to ensure data is correct, and no one can "game the system" via reporting Forces controls for data movement and traceability of usage Forces greater awareness of business status and lowers latency of reporting FISMA BASEL II Justification for government bodies to improve information management Forced reporting and accuracy standards on large banks 22

24 DG Organizations - Playing with others Data Governance Oversight Body Legal IT Compliance DG Councils Legal Compliance IT Governance Data Governance Separate area Standardized processes, policies, rules, usage, models Enterprise content and processes 23

25 MDM features based on Governance Tactics Assess data quality with an eye to errors impacts Document existing controls Define performance metrics for key processes at risk Monitor the content of all unstructured data by key words Monitor direct and indirect interactions of individuals that access documents, dialogues or s in a systematic manner Develop dashboard reports that monitor audit data on all data and content Develop data and content retention guidelines and archival processes Define Federalist information governance road map Localized Info. Elements C2 C4 M1 M4 D2 Global information Elements C1 C3 M2 M5 D3 24

26 Summary Risk Management is an integral part of a business case MDM can be reinforced by examining all Risk areas A Risk-based MDM effort is also a keystone EIM effort MDM and Data Governance must deploy together, but Compliance makes that easier Regulators already have a content management mindset, while companies. 25

27 Building Value Through Information Asset Management