Page 452 - ITGC_Audit Guides

Please refer to “GTAG: Information Technology Outsourcing, 2nd
Edition” for additional guidance on third-party vendor risk management
considerations.

3.12 Data governance should be part of Data management policies and related procedures (e.g., ownership,
enterprise governance. sharing, privacy, and retention requirements, etc.) are defined,
documented, and shared.

The organization has identified a CDO or equivalent role with
responsibility for enterprise data governance.

An inventory of critical databases, tables, data elements and lineage,
and other metadata is created and maintained.

Enterprise data standards are defined and communicated to all
relevant employees as part of annual training requirements.

Data quality controls are implemented for critical data elements, with
adequate governance in place to ensure remediation of identified data
issues.

Systems of record (SOR) and authoritative data sources (ADS) have
been identified, and data is appropriately reconciled between SOR and
the data warehouse(s).

The enterprise data management team tracks and governs business
compliance with data governance and management policies.

Technology Availability and Performance Risks
When big data platforms are not scalable for the rapidly increasing amounts of structured and
unstructured data necessary for analytics, there may be degraded performance and inaccurate or
untimely analytic outputs. As more data is extracted and loaded into big data systems, analytic
model assumptions may need to be reviewed to determine whether the model and the model’s
underlying assumptions are still accurate.

The performance and availability of big data systems becomes increasingly important as the
organization’s reliance on these systems increases for key executive decision making and revenue
generation processes. Big data systems cannot provide analytic outputs when the systems or
related data feeds are unavailable. This can adversely affect the timeliness of management
decisions, create a negative customer experience, and/or lead to lost revenue. High availability
and/or disaster recovery solutions can mitigate system downtime risk, but come at an increased
cost.

Big data programs can have significantly varying data storage and retention requirements. Certain
streaming data, for example, may never need to be saved or backed up to an organization’s
systems, but might not be recoverable if the data is not processed and analyzed immediately.
Other big data applications, however, may require significant historical data to understand and
discover patterns or behaviors over extended periods of time.

33 — theiia.org