Metrics for data governance: lineage, access, and stewardship health

Why governance needs metrics, not policy documents

Data governanceData governanceData governance is the set of policies, roles, and processes that ensure data is accurate, secure, well-defined, and used responsibly across an organization.Voir la définition complète → is the set of rules, roles, and processes that decide who can access, change, and be accountable for data. Most public sector agencies have a governance charter. Far fewer can produce numbers proving it operates day to day.

This gap matters because public sector data feeds decisions with legal weight: benefit eligibility, tax assessments, policing, child welfare. Bad or unaccountable data does not just cost money, it produces wrongful denials and audit failures. The US Government Accountability Office (GAO) has repeatedly flagged federal agencies for incomplete data governancedata governanceData governance is the set of policies, roles, and processes that ensure data is accurate, secure, well-defined, and used responsibly across an organization.Voir la définition complète →, including inconsistent data inventories under the Federal Data Strategy and OMB's Evidence Act.

Three metrics let you audit governance like an outsider: lineage coverage, stewardship assignment rate, and access-request turnaround time.

Metric 1: Data lineageData lineageData lineage maps how data moves and transforms across systems, from origin to consumption, showing where it came from, what changed it, and where it goes.Voir la définition complète → coverage

Data lineageData lineageData lineage maps how data moves and transforms across systems, from origin to consumption, showing where it came from, what changed it, and where it goes.Voir la définition complète → is the documented trail showing where a data element originated, what transformed it, and where it flows downstream, from source system to report to dashboard.

Why it matters in the public sector: when a state Medicaid agency reports an eligibility error rate, auditors need to trace that number back through every join, filter, and recode to the original claims record. Without lineage, you cannot answer "why does this number look wrong" or "what breaks if we retire this legacy mainframe field."

How to measure it:

• Lineage coverage rate = (number of critical datasets with documented, machine-readable lineage) / (total critical datasets), expressed as a percentage.
• A dataset counts as "covered" only if lineage is stored in a catalog tool (not a wiki page) and traces at least back to the system of record.

Mature private-sector data organizations often target 80 to 90% lineage coverage for tier-1 (regulatory or decision-critical) datasets. Public sector agencies frequently sit far below that; GAO and inspector general reports across federal agencies commonly cite lineage and metadatametadataDonnées sur les données, informations décrivant le contexte, la structure, la provenance et les caractéristiques d'un asset de données (auteur, date, format, source, définition). gaps as a recurring audit finding (estimate, based on repeated GAO IT management reports, exact percentages not centrally published).

Worked example:

An agency has 50 datasets flagged as "critical" (used in official statistics or benefits decisions). A catalog audit finds 14 have full lineage documented in the tool (e.g., Collibra, Alation, or an open-source option like OpenMetadata).

Lineage coverage = 14 / 50 = 28%.

That is a governance program that exists on paper but not in practice. A credible target for year one remediation is 60% coverage of tier-1 datasets.

Metric 2: Stewardship assignment and activity

A data stewarddata stewardA business-side owner responsible for the quality, consistency and appropriate use of data in their domain.Voir la définition complète → is a named individual (not a team, not a job title, an actual person) accountable for a dataset's definition, quality rules, and access decisions. Data stewardship health measures whether stewardship is real accountability or a checkbox in a RACI chart (Responsible, Accountable, Consulted, Informed, a common governance role matrix).

Key metrics:

• Stewardship assignment rate = datasets with a named, current steward / total cataloged datasets.
• Steward responsiveness = median time for a steward to resolve a flagged data qualitydata qualityThe degree to which data is fit for purpose: accurate, complete, consistent, timely, valid and unique. Poor quality data undermines analytics, reporting and AI.Voir la définition complète → issue (e.g., a broken field mapping, a duplicate record type).
• Steward turnover impact = number of datasets left "orphaned" (steward departed, role not reassigned within 30 days) per quarter.

A common failure pattern: an agency assigns stewards during a governance rollout, then never updates the roster. Eighteen months later, 40% of listed stewards have left the agency. The catalog says "owned." Reality says "abandoned."

Benchmark to apply: if your orphan rate exceeds 10% of critical datasets in any quarter, stewardship is decorative, not functional. This threshold is a practical rule of thumb from data governancedata governanceData governance is the set of policies, roles, and processes that ensure data is accurate, secure, well-defined, and used responsibly across an organization.Voir la définition complète → practice, not a regulatory standard, treat it as a working benchmark rather than a cited figure.

Metric 3: Access-request turnaround time

This is the metric that most directly affects service delivery and public trust. Access-request turnaround time measures how long it takes from a legitimate request for data access to actual, provisioned access.

This matters enormously for the public sector because of layered legal regimes:

• In the US, the Privacy Act of 1974 and agency-specific rules (like FERPA for education records, or HIPAAHIPAAHealth Insurance Portability and Accountability Act, loi américaine imposant la protection des données de santé (PHI). Violations : amendes jusqu'à 1,9M$ par catégorie de violation. for health data) govern who may access personal data and under what safeguards.
• In the EU, the General Data Protection Regulation (GDPR) requires documented lawful basis and often a Data Protection Impact Assessment before new access is granted, enforced by national Data Protection Authorities.

Slow turnaround is not just inefficiency, it is a governance signal: it usually means access approval workflows are manual, undocumented, or routed through people who no longer understand the system.

How to measure it:

• Median turnaround = median calendar days from request submission to access granted, tracked by dataset sensitivity tier.
• Segment by tier: public data should be near-instant (hours); restricted/PII data should have a defined SLA (service level agreement, an agreed target response time).

Worked example:

An agency logs 120 access requests for restricted datasets last quarter. Sorted turnaround times in days: the median (60th value when ranked) is 34 days. Their published SLA target is 10 business days.

Compliance rate = requests resolved within SLA / total requests. If only 22 of 120 met the 10-day target, that is an 18% SLA compliance rate, a strong signal the access process is broken regardless of what the policy document promises.

Putting it together: a governance health scorecard

A useful audit does not treat these three metrics separately. Combine them into a simple scorecard reviewed quarterly:

| Metric | Formula | Illustrative target (estimate, practice-based) |

|---|---|---|

| Lineage coverage (tier-1) | documented lineage datasets / tier-1 datasets | ≥ 70% |

| Stewardship assignment | named current stewards / critical datasets | ≥ 90% |

| Orphaned dataset rate | orphaned datasets / critical datasets | ≤ 5% |

| Access SLA compliance | requests within SLA / total requests | ≥ 85% |

These targets are not from a single regulation, they reflect common data governancedata governanceData governance is the set of policies, roles, and processes that ensure data is accurate, secure, well-defined, and used responsibly across an organization.Voir la définition complète → maturity benchmarks used across public and private sector practice. Treat them as a starting point for internal target-setting, not a compliance requirement.

A simple way to compute the scorecard programmatically from a catalog export:

import pandas as pd

df = pd.read_csv("catalog_export.csv")
tier1 = df[df.tier == "critical"]

lineage_coverage = (tier1.has_lineage.sum() / len(tier1)) * 100
steward_rate = (tier1.has_current_steward.sum() / len(tier1)) * 100
orphan_rate = (tier1.steward_orphaned.sum() / len(tier1)) * 100

print(f"Lineage coverage: {lineage_coverage:.1f}%")
print(f"Stewardship assignment: {steward_rate:.1f}%")
print(f"Orphan rate: {orphan_rate:.1f}%")

This kind of script, run quarterly against the same catalog fields, turns governance from a narrative ("we take data seriously") into a trend line leadership can act on.

For a deeper reference model, the DAMA-DMBOK (Data Management Body of Knowledge) is the standard practitioner framework covering stewardship, lineage, and metadatametadataDonnées sur les données, informations décrivant le contexte, la structure, la provenance et les caractéristiques d'un asset de données (auteur, date, format, source, définition). management in detail.

Key Takeaways

• Data governanceData governanceData governance is the set of policies, roles, and processes that ensure data is accurate, secure, well-defined, and used responsibly across an organization.Voir la définition complète → is only real if it is measurable: lineage coverage, stewardship assignment, and access turnaround are the three core diagnostic metrics.
• Lineage coverage below 50% on critical datasets means audits and error tracing will be slow or impossible; treat 70%+ on tier-1 data as a credible working target.
• An orphaned steward rate above roughly 10% signals stewardship exists on paper only, not in daily accountability.
• Access-request SLA compliance ties directly to legal obligations (Privacy Act, GDPR) and to public trust; track it by data sensitivity tier, not as one blended average.
• Build a quarterly scorecard from catalog metadatametadataDonnées sur les données, informations décrivant le contexte, la structure, la provenance et les caractéristiques d'un asset de données (auteur, date, format, source, définition). rather than a narrative report, it converts governance claims into a trend you can audit like any other operational metric.