Building the data governance operating model

What an operating model actually is

A data governancedata governanceData governance is the set of policies, roles, and processes that ensure data is accurate, secure, well-defined, and used responsibly across an organization.View full definition → operating model is the answer to four questions:

• Who owns each dataset? (accountability)
• Who maintains its quality day to day? (execution)
• Where do disputes and changes get decided? (forums)
• Who can approve what? (decision rights)

Notice none of that is technology. Tooling comes later. First you assign people.

The three core roles

Data Owner. A senior accountable person, usually a business lead. The Owner does not clean data. The Owner is answerable for it. For NAV feeds, the Owner might be the Head of Fund Accounting. For fee schedules, the Head of Product or Client Servicing.

Data Steward. The hands-on custodian. Stewards define what "correct" means for a field, run checks, and triage exceptions. A benchmark steward knows that the S&P 500 rebalances quarterly and that a constituent add/drop must flow into the portfolio system before the next rebalance date.

Data Custodian. Usually IT or a platform team. Custodians run the pipelines and storage. They keep the data flowing and secure but do not decide business meaning.

Split them cleanly. When the Owner, Steward and Custodian collapse into one overworked person, accountability dies the moment that person leaves.

Assign owners to real datasets, not to "data"

"We own dataown dataData collected directly from your own customers and prospects through your own channels: your most reliable and privacy-compliant source.View full definition → quality" means nothing. Assign at the dataset level. Below is a starter accountability mapmapUsing software to automate repetitive marketing tasks and campaigns, enabling personalisation at scale across channels like email, web, and social.View full definition → for a mid-size asset manager.

| Dataset | Example content | Owner (role) | Steward (role) |

|---|---|---|---|

| Benchmark constituents | Index members, weights, rebalance dates | Head of Investment Data | Index Data StewardData StewardA business-side owner responsible for the quality, consistency and appropriate use of data in their domain.View full definition → |

| Fee schedules | Management fees, performance fees, breakpoints | Head of Product | Product Data StewardData StewardA business-side owner responsible for the quality, consistency and appropriate use of data in their domain.View full definition → |

| NAV feeds | Daily fund prices from the fund accountant/administrator | Head of Fund Accounting | Fund Ops Steward |

| Security master | Instrument identifiers (ISIN, CUSIP), asset class | COO Data function | Reference Data StewardData StewardA business-side owner responsible for the quality, consistency and appropriate use of data in their domain.View full definition → |

| Client/investor records | Beneficial owner, jurisdiction, KYC status | Head of Client Servicing | Client Data StewardData StewardA business-side owner responsible for the quality, consistency and appropriate use of data in their domain.View full definition → |

Two definitions for the non-technical:

• ISIN (International Securities Identification Number): the 12-character global ID for a security.
• KYC (Know Your Client): the regulatory checks confirming who an investor actually is.

The mapmapUsing software to automate repetitive marketing tasks and campaigns, enabling personalisation at scale across channels like email, web, and social.View full definition → is the artifact you keep current. When someone resigns, you reassign the role, not rebuild the knowledge.

Build the forums

Roles without forums drift. You need standing decision bodies with clear scope.

Data Governance Council. Meets monthly or quarterly. Chaired by a senior sponsor (often the COO or a Chief Data Officer). It approves policy, arbitrates cross-team disputes, and signs off major changes (new data vendor, new golden source).

Data Quality Working Group. Meets weekly or biweekly. Stewards and custodians review open exceptions, aging issues, and upcoming events (index rebalances, fee changes, fund launches).

Change Advisory. Reviews proposed changes to critical datasets before they go live. A fee schedule change that hits client billing should never reachreachThe number of unique people exposed to your message in a given period. Unlike impressions, reach counts each person once, no matter how often they see it.View full definition → production without a documented approver.

Keep minutes. Regulators and auditors ask "who decided this and when." Minutes are your answer.

Decision rights: the RACI you actually use

Write down who is Responsible, Accountable, Consulted and Informed for each decision type. Example for a fee schedule change:

• Responsible: Product Data StewardData StewardA business-side owner responsible for the quality, consistency and appropriate use of data in their domain.View full definition → (makes the change)
• Accountable: Head of Product (owns the outcome)
• Consulted: Fund Accounting, Compliance, Client Servicing
• Informed: Data GovernanceData GovernanceData governance is the set of policies, roles, and processes that ensure data is accurate, secure, well-defined, and used responsibly across an organization.View full definition → Council

The single rule that saves you: exactly one Accountable per decision. Two Accountable parties means zero.

Governance meets regulation

This is asset management, so the operating model must mapmapUsing software to automate repetitive marketing tasks and campaigns, enabling personalisation at scale across channels like email, web, and social.View full definition → to real rules. Name them, so your roles trace to obligations.

• GDPR (General Data Protection Regulation, EU): governs personal data, including investor records. Requires a lawful basis, retention limits, and data subject rights. A firm serving EU investors typically needs a Data Protection Officer (DPO) and a record of processing activities.
• UK GDPR + Data Protection Act 2018: the UK equivalent post-Brexit, enforced by the Information Commissioner's Office (ICO).
• SEC and the Investment Advisers Act (US): US registered advisers must keep accurate books and records (the "books and records rule"). Poor NAV or fee data is a records problem, not just an ops problem.
• MiFID II (EU) / MiFIR: transaction reporting rules that depend on clean instrument and counterparty reference data. Bad ISIN or LEI data breaks reporting.
• LEI (Legal Entity Identifier): the 20-character global ID for legal entities in financial transactions.

MapMapUsing software to automate repetitive marketing tasks and campaigns, enabling personalisation at scale across channels like email, web, and social.View full definition → each dataset to its regulatory hooks. Client records touch GDPR. NAV and fee data touch SEC/FCA records rules. Transaction reference data touches MiFIR reporting. Now your Owner knows why their dataset matters beyond "it should be right."

Wire quality checks to owners

The operating model becomes real when each dataset carries automated checks that flag to its steward. A simple daily NAV sanity check, expressed as pseudo-SQLSQLSales Qualified Lead: a prospect the sales team has validated as ready for direct outreach and a proposal, having passed clear qualification criteria.View full definition →, might read:

A 5 percent single-day move on a diversified bond fund is almost certainly a data error, not a market move. The check routes to the Fund Ops Steward, who confirms or corrects before publication. The threshold itself is a governance decision, owned and documented.

Worked example of a materiality trigger: if a fund's NAV is 20.00 and the error is 0.02 per share, that is 0.10 percent, or 10 basis points. Many fund administrators use a NAV error tolerance around 0.5 percent (50 bps) as a common industry threshold for investor compensation, though the exact figure varies by fund, jurisdiction and prospectus (treat as an illustrative estimate, not a legal standard). Your governance model decides the threshold and who signs off breaches.

Make it survive turnover

The whole point is durability. Three practices make governance outlast the people who built it.

1. Document the definition, not just the value. For each critical field, record what it means, its source of truth ("golden source"), its owner, and its check. When the benchmark steward leaves, the definition of "constituent weight as of rebalance close" stays.

2. Name backups. Every Owner and Steward has a named deputy. No single point of failure.

3. Run a data catalog. A catalog is a searchable inventory of datasets with owner, steward, source, sensitivity and lineage. Open tools like OpenMetadata or DataHub do this for free. When an auditor asks "where does the fee schedule live and who owns it," the answer is one search, not one week.

Audits: prove the model works

Governance you cannot evidence is governance you do not have. Schedule light-touch checks:

• Quarterly ownership review: confirm every critical dataset still has an active Owner and Steward.
• Exception aging report: how many data qualitydata qualityThe degree to which data is fit for purpose: accurate, complete, consistent, timely, valid and unique. Poor quality data undermines analytics, reporting and AI.View full definition → issues are open, and how old? Aging exceptions signal a steward is overloaded or a source is broken.
• Access review: who can change fee schedules or NAV inputs? Least privilege matters here.
• Lineage spot check: trace one published NAV back to its inputs. If you cannot, your lineage documentation has gaps.

Key takeaways

• Assign at the dataset level. "We own dataown dataData collected directly from your own customers and prospects through your own channels: your most reliable and privacy-compliant source.View full definition →" is meaningless. Name an Owner and Steward for benchmark constituents, fee schedules, NAV feeds and client records specifically.
• One Accountable person per decision. Use RACI, keep it to a single Accountable party, and back every role with a named deputy so the model survives resignations.
• Forums plus minutes equal defensibility. A Governance Council and a Quality Working Group with documented decisions are what you show regulators and auditors.
• Trace datasets to real rules. Client records to GDPR, NAV and fees to SEC/FCA records rules, transaction data to MiFIR. Owners should know their regulatory hook.
• Wire checks and a catalog to owners. Automated thresholds (like a 5 percent NAV move flag) route to the responsible steward, and a data catalog turns "who owns this" into a one-second search.