Data Management Capability Assessment Model Intersection of data management best practice and the reality of financial services operations Synthesis of research and analysis among practitioners since formation of EDM Council (case studies, regulatory pressure, collaborative research) Socratic method to ensure that DCAM is practical and in line with the core principles of data management (philosophy meets practical reality) Aligns with organizational mandate (practical, works in real world, understandable by non-specialists, based on collaboration, structured for continual improvement) Standard criteria for evaluation of capability … linked to benchmarking … providing evidence of adoption of control environment Created based on practical experience Capabilities orientation: Not done; In process (low, medium, high); Capability achieved; Capability enhanced Each Category is defined by a set of Capabilities and Sub-Capabilities Each Sub-capability is evidenced by a series of capability objectives Component (8) Capability (36) Sub-Capability (112) Objectives (306)

DCAM Construction Data Management Capability Assessment Model Sub-Capability Objectives Artifacts Required Capability Type Data-related (identification, common language, classification, data quality, lineage, compounding process) Organization-related (governance, funding, data management program) Ecosystem-related (IT, operations, security, privacy, finance) Organizational Purpose Statement (what is and why important) Management Context (definition and introduction) Elaboration Specific Goals Core Questions Informative

DCAM Scoring

Data Management Capability Assessment Model Data Governance Component Capability Data governance structure is created. Content governance is defined Policy/standards are written and approved Program governance controls are in place Technology governance is aligned Cross-organizational enterprise data governance is aligned Program governance is operational Policy and standards have been reviewed and approved by senior executive governing bodies Policy and standards have been reviewed and approved by relevant program stakeholders Policy and standards are written and complete Objectives Sub- Capability Policy/standards are developed in collaboration with (business, technology and operations) Policy and standards are complete and verified Policy and standards are in alignment with Data Management Strategy Policy and standards have been shared and reviewed by relevant stakeholders. Feedback from stakeholders incorporated into the final version of the policy and standards Policy and standards have been validated and approved Policy/standards submitted to the organizational governance mechanism for evaluation Policy and Standards have been approved Sample Artifacts Documented policy and standards (cross-border, privacy, data acquisition, entitlement, access, data retention, quality control process, training, data content, data format) Sample Artifacts Distribution lists, e-mail thread (stakeholders and governance committee), stakeholder approvals, meeting notices and minutes, governance committee approval, internal memos

DCAM Applied Components Advice from an Audit Perspective Sub-Capability Statement Essential Questions DCAM Description and Objectives Required Artifacts as Evidence of Adherence Scoring Guidance

Data Management Capability Assessment Model (DCAM) DCAM is structured to define and measure capability (i.e. the definition of precisely what is required to develop, implement, govern and sustain data management). It has been organized into eight categories, 36 capability areas, 112 sub-capabilities and 306 objectives: Data Management Strategy: defines the framework for the data management program including the goals, objectives and scope; why it is important; how it will be organized, funded, governed and practically implemented Data Architecture: focuses on the core concepts of “data as meaning” and how data is defined, described and related; the identification of logical domains of data; identification of the underlying physical repositories; and the governance procedures necessary to ensure the control and appropriate use of data Business Case & Funding Model: provides the justification for the data management program including the rationale for the investment; the costs, benefits, risks and expected outcomes; the mechanism used to ensure sufficient allocation of resources; and the approach used to measure costs and contributions from implementation of the data management program Technology Architecture: addresses the relationship of data with the physical IT infrastructure needed for operational deployment including how data is acquired, stored, distributed and integrated across the organization Data Quality: establishes the concept of fit-for-purpose data; defines the processes associated with establishing data control; and addresses the implementation of governance mechanisms for management of the data manufacturing chain of supply Data Management Program: identifies the organizational requirements needed to stand up a sustainable data management program including the operational framework to ensure sustainability and authority as well as the mechanisms to establish and confirm stakeholder engagement related to program implementation Control Environment: defines the data lifecycle process and how data content management is integrated into the overall organizational “ecosystem” Data Governance: defines the rules of engagement necessary for program implementation including the definition of policies, procedures and standards as the mechanisms for alignment among stakeholders

Organizational: Data Management Strategy Blueprint defining the goals of the data management program and how the organization will approach implementation Establish the framework for the data management program including how it will be defined, organized, funded and governed Clearly define the goals, objectives and scope of the program to ensure alignment and commitment from the critical stakeholders Articulate how the program will be practically implemented including how it aligns with business value and organizational objectives

Organizational: Data Management Business Case & Funding Model The justification for the data management program including how it is funded and evaluated Rationale for the investment in data management including the costs, benefits, risks and expected outcomes Mechanism to ensure allocation of sufficient capital and methodology for cost allocation Approach used to measure costs and contributions from the data management program

Organizational: Data Management Program Establish the data management function and ensure that it operates effectively within the culture of your organization Establish and confirm stakeholder engagement along with the process to ensure that the data management program is implemented Clear understanding of the meaning of data “content” management and why it is essential to the operations of the organization Establish an operational framework to ensure sustainability and authority of the data management program

Organizational: Data Governance Rules of engagement necessary for implementation of the data management program Establish the structure and operating model needed to establish lines of authority and integrate the DMP into the corporate hierarchy Define, implement and enforce data management policies, procedures, guidelines and standards Measure and monitor the effectiveness of the data management program and ensure sufficient resources have been allocated

Data Content: Data Architecture Design, management, implementation and maintenance of the precise meaning of the information Governance procedures to ensure the maintenance, control and appropriate use of data and its harmonization to business meaning Identification of (and agreement on) the logical domains of data as well as location of the underlying physical repositories Definition of the precise contractual meaning of all data attributes including how they relate to one another and their expression as metadata

Data Content: Integration into Technology Architecture Physical architecture and how data is acquired, stored, distributed and integrated across the organization Strategy, architecture, roadmaps and governance on the physical IT infrastructure needed to support data management objectives Definition of the allowable tool stacks (i.e. BI, ETL, storage) needed to support implementation of the data management strategy Strategies and approaches to address operational risk, business continuity and disaster recovery

Data Content: Data Quality Program Approach to ensure that data consumers trust and have confidence in the data as fit for their intended purpose Create a profile of the current state of data quality, identify areas that need remediation and cleanse against approved business rules Implement data quality governance mechanisms and processes for management of the data manufacturing chain of supply Establish the goals, approaches, dimensions and plans of action to ensure data content supports the objectives of the organization

Ecosystem Coordination: Data Control Environment Coordination of the components of the data lifecycle across the data ecosystem of the organization Identification and documentation of the end-to-end data flows and reverse engineering of data compounding processes (formulas, derived calculations, etc.) Integration of data management into the organizational “ecosystem” and alignment with other enterprise control functions Objectives and capabilities of the data management program are embraced and adopted throughout the organization – creating a control environment

EDM Council’s 20 Rules of Data Management Copyright © 2015 EDM Council Inc. EDM Council’s 20 Rules of Data Management Confidence Rule: We have an endorsed data management strategy that is meaningful to business users Owner Rule: We have a senior executive (with authority) in charge of the data management program Alignment Rule: Stakeholders understand (and buy into) the need for the data management program Communication Rule: We do a good job communicating the value proposition and operational implications of the data management program Business Case Rule: The business case and funding model for the data management program is established and operational Metrics Rule: We do a good job of measuring the costs and benefits of the data management program Policy Rule: The data management program has the authority to enforce adherence to policy Resources Rule: The data management program has enough resources to be sustainable Accountability Rule: The data management governance and accountability structures are operational Responsibility Rule: The roles and responsibilities of data “owners” and “stewards” are assigned Enforcement Rule: Data policies and standards are implemented and enforced Ontology Rule: The business meaning of data is defined, governed and harmonized across repositories CDE Rule: Critical data elements are identified, verified and managed Data Domains Rule: Logical categories of data have been defined and catalogued Capability Rule: The data management program is aligned with technical and operational capabilities Profiling Rule: Data in existing repositories has been profiled, analyzed and graded DQ Control Rule: Data quality control procedures, business rules and measurement criteria are operational Root Cause Rule: The root cause of data quality problems are identified and corrected Lineage Rule: End-to-end data lineage has been identified across the full data lifecycle Ecosystem Rule: Data management collaborates with existing enterprise control functions

Six Areas of Excellence All Data has been Profiled, Analyzed and Graded (fit-for-purpose) Critical Data Elements are Identified and Managed Resources Needed for Sustainability Approved and Acquired Logical Data Domains have been Declared and Sanctioned Data Quality Control Points and Business Rules are Implemented IT Governance is Aligned with the Objectives of the Data Program The Data Program is Aligned with IT and Operational Capabilities ODM is Effectively Collaborating with other Control Functions Owners & Stewards are in Place with Defined Roles and Responsibilities End Users are Adhering to the Policies and Standards Stakeholders Understand the Need for the Data Management Program Business Meaning of Data is Defined, Harmonized & Governed Policies & Standards are Documented, Implemented and Enforced Endorsed Strategy and Meaningful to Business Users Selling the Value Proposition & Operational Implications Funding Model Established and Sanctioned Costs & Benefits are Measured and Reported Governance Structure & Authority is Implemented and Communicated Root Cause Analysis is Performed and Corrected Program Established with Authority to Enforce Adherence End-to-End Lineage is Defined Across the Full Data Lifecycle Stakeholder Commitment Governance Implementation Content Infrastructure Data Quality Control Working With IT Data Management Program Eco-system S T R A T E G Y C O M M U N I C A T I O N A U T H O R I T Y A L I G N M E N T F U N D I N G M E T R I C S R E S O U R C E S E C O S Y S T E M O R G A N I Z A T I O N S T E W A R D S P O L I C Y A D H E R E N C E M E A N I N G C D E D O M A I N S L I N E A G E P R O F I L I N G C O N T R O L R O O T – C A U S E A L I G N M E N T C A P A B I L I T Y