- Under a data governance framework, the 'data custodian' role is primarily responsible for:
Answer: Implementing the technical controls for data storage, backup, security, and availability as directed by the data owner.
The data custodian (often IT) implements and maintains the technical infrastructure - storage systems, backups, access controls, encryption - that protects and makes data available, acting on the data owner's direction. Answer B is correct. Access decisions (A) are made by data owners. Classification (C) is the data owner's responsibility. Policy approval (D) is a governance committee function.
- Data governance is best described as:
Answer: A framework of policies, processes, roles, and standards that ensure data is managed as a strategic asset with appropriate quality, security, and compliance throughout its lifecycle.
Data governance is an enterprise-wide discipline encompassing policies, roles, accountability, and processes to ensure data is accurate, available, secure, and used appropriately. Answer A is correct. Backup and restore (B) is a technical IT function. Database performance (C) is IT operations. Data governance applies across all industries (D).
- A company implements a data catalog as part of its data governance program. The primary purpose of a data catalog is to:
Answer: Provide a searchable inventory of data assets across the organization, including metadata, data lineage, classification, and ownership information.
A data catalog is an organized inventory of data assets that enables users to discover, understand, and access data - documenting what data exists, where it lives, what it means, who owns it, and how it flows. Answer B is correct. Encryption (A), storage replacement (C), and compliance reporting (D) are not data catalog functions.
- An organization's data governance framework requires periodic certification of data quality by data owners. This practice primarily supports which governance objective?
Answer: Accountability - ensuring data owners regularly attest to the quality of their data domain and take ownership of issues.
Periodic data quality certification makes data owners accountable by requiring them to formally attest to the state of their data, driving proactive issue identification and remediation. Answer A is correct. Availability (B), security (C), and scalability (D) are separate governance and IT management objectives.
- When evaluating a data governance structure, an auditor should consider which of the following as the most critical success factor?
Answer: Executive sponsorship - senior leadership commitment and accountability for data governance is essential for the program to have the authority, resources, and organizational buy-in needed to succeed.
Data governance programs fail most often from lack of executive sponsorship - without visible senior leadership commitment and accountability, data governance lacks authority and organizational priority. Answer A is correct. Technology (B), staffing ratios (C), and meeting frequency (D) are important but secondary to executive commitment.
- Which of the following represents the most significant long-term risk of an organization operating without a formal data governance framework?
Answer: Data quality will deteriorate, trust in data will erode, compliance risks will increase, and the organization will struggle to derive strategic value from its data assets.
Without governance, data quality degrades over time, definitions diverge, compliance gaps accumulate, and the organization loses the ability to make confident data-driven decisions - the compounding long-term risk of ungoverned data. Answer D is correct. Hardware purchasing (A), database performance (B), and warehouse size (C) are operational IT concerns not caused by governance absence.
- An organization's data governance program includes a 'data issue management' process. The primary purpose of this process is to:
Answer: Provide a structured mechanism for reporting, prioritizing, investigating, and resolving data quality and integrity issues across the organization.
Data issue management gives business users a formal channel to report data problems, ensures issues are tracked and prioritized, and drives timely resolution by accountable parties - a core operational element of data governance. Answer C is correct. Breach reporting (A) is incident management. Backup scheduling (B) is IT operations. Auditing roles (D) is a governance committee function.
- In a data governance framework, the 'data owner' role is primarily responsible for:
Answer: Defining data access policies, approving access requests, ensuring data quality, and being accountable for the data's appropriate use within their business domain.
The data owner is a business accountability role - typically a senior business leader responsible for a data domain who approves access, sets quality standards, and is accountable for how data is used. Answer C is correct. Physical storage and maintenance (A) is the data custodian role. Report writing (B) is a data consumer function. Auditing (D) is the internal audit function's role.
- An organization's data governance framework lacks clear accountability - no one is assigned as the owner of the customer master data. The most significant risk of this gap is:
Answer: Customer data quality will deteriorate over time, leading to inconsistent, inaccurate records that affect customer service, billing, and reporting.
Without a data owner, no one is accountable for maintaining customer data quality - resulting in inconsistencies, duplicates, and inaccuracies that degrade operational performance and reporting. Answer A is correct. Software purchasing (B), data classification defaults (C), and automatic audit opinions (D) are not consequences of missing data ownership.
- A financial services company implements a data governance framework and designates the CFO as the data owner for all financial reporting data. Which of the following actions by the CFO would best demonstrate effective data ownership?
Answer: Reviewing and approving access to financial reporting data, attesting to data quality at period-end, and escalating unresolved data quality issues to the governance committee.
Effective data ownership involves active accountability: controlling access, attesting to quality, and driving resolution of issues - not passive delegation or technical management. Answer B is correct. Full delegation (A) abdicates ownership responsibility. Database administration (C) is the custodian's role. Publishing specifications (D) is useful but insufficient demonstration of ownership.
- Which of the following is a key indicator that data governance structures are operating effectively?
Answer: Data quality metrics show improvement over time, data issues are resolved within defined SLAs, and business users report increased confidence in data for decision-making.
Effective data governance produces measurable outcomes: improving data quality, timely issue resolution, and increased user trust in data. Answer C is correct. Software purchase (A) is an input. IT-only governance (B) lacks business accountability. No governance committee meetings (D) suggests inactivity, not effectiveness.
- What is the primary difference between data governance and data management?
Answer: Data governance establishes the policies, roles, and accountability framework; data management executes the operational activities of collecting, storing, processing, and using data within that framework.
Data governance sets the 'rules of the road' - policies, roles, and oversight. Data management is the operational execution - the day-to-day activities of actually working with data following those rules. Answer B is correct. Governance is strategic, not database administration (A). Both apply to all data types (C). Governance is an internal business function (D).
- An organization's data governance framework includes a data quality scorecard that measures accuracy, completeness, and timeliness for each major data domain. The primary purpose of this scorecard is to:
Answer: Provide ongoing visibility into data quality performance, enabling data owners and stewards to identify and remediate issues before they impact business processes.
A data quality scorecard is a management tool providing continuous measurement of quality metrics, enabling proactive issue identification and remediation. Answer A is correct. External audit requirements (B) are a secondary consideration. Cost justification (C) is a governance activity but not the scorecard's primary purpose. Training needs (D) may be identified but are not the primary purpose.
- Which of the following best describes a 'business glossary' in the context of data governance?
Answer: A centralized, authoritative repository of agreed-upon business term definitions, ensuring consistent understanding and use of data across the organization.
A business glossary establishes standard definitions for key business terms (e.g., 'revenue,' 'active customer,' 'headcount'), ensuring everyone in the organization uses data consistently and interprets reports the same way. Answer B is correct. A technical data dictionary (A) documents database structure, not business meaning. Application inventories (C) and compliance checklists (D) are separate artifacts.
- A data governance framework's 'data lineage' capability provides which of the following benefits?
Answer: It documents the origin, movement, transformation, and consumption of data across systems, enabling impact analysis and root cause investigation of data quality issues.
Data lineage maps how data flows from source through transformations to final consumption, enabling organizations to trace data quality issues to their source and understand the downstream impact of data changes. Answer D is correct. Automatic error correction (A) is a data quality tool function. Encryption (B) and access control (C) are security functions unrelated to lineage.
- A financial institution discovers that the same customer has five different records across its CRM, loan origination, and core banking systems with inconsistent addresses and account information. This problem is best addressed through:
Answer: A master data management (MDM) initiative that establishes a single authoritative customer record (golden record) synchronized across all systems.
MDM creates a single trusted version of key data entities (customers, products) that all systems reference, eliminating the inconsistencies caused by siloed data. Answer D is correct. Encryption (A) protects confidentiality but does not fix data quality. Deleting duplicates without investigation (B) risks losing valid data. Access restriction (C) does not resolve inconsistency.
- Which of the following scenarios most clearly demonstrates the need for a data governance framework?
Answer: A company's three business divisions produce conflicting customer count figures because each uses a different definition of 'customer,' creating confusion in board-level reporting.
Conflicting data definitions producing inconsistent reports across divisions is the classic symptom that data governance is needed - inconsistent standards, no data ownership accountability, and no authoritative definitions. Answer C is correct. Hardware upgrades (A), encryption (B), and authentication (D) are technical IT management activities that do not require governance frameworks.
- An auditor evaluating data governance structures finds that the organization has no documented data retention schedules for any data domain. The primary risk of this gap is:
Answer: The organization may retain data longer than necessary (increasing privacy and storage risk) or delete data too soon (creating legal and regulatory compliance violations).
Without retention schedules, data is either kept too long (increasing breach impact, storage costs, and GDPR minimization violations) or disposed of too early (destroying records needed for litigation, audits, or regulatory requirements). Answer A is correct. Retention schedules do not affect backup capability (B). External auditors do not mandate indefinite retention (C). Data quality is unaffected by retention schedules alone (D).
- Which of the following data governance roles is typically responsible for ensuring that data privacy requirements are embedded in data governance policies and processes?
Answer: Chief Privacy Officer (CPO) or Data Protection Officer (DPO), in coordination with data owners.
The CPO or DPO brings regulatory privacy expertise (GDPR, CCPA, HIPAA) to ensure privacy requirements are incorporated into data governance policies, working with data owners who are accountable for their domains. Answer D is correct. Custodians (A) implement technical controls. Stewards (B) manage operational quality. Data owners (C) are accountable for their domains but typically rely on privacy experts for regulatory guidance.
- A data governance committee is established at an organization. The primary purpose of this committee is to:
Answer: Provide oversight and strategic direction for data governance initiatives, resolve cross-functional data issues, and ensure data policies align with organizational objectives.
A data governance committee is a cross-functional oversight body that provides strategic direction, resolves conflicts, approves policies, and ensures alignment between data management practices and business strategy. Answer D is correct. It supplements, not replaces, internal audit (A). Daily operations (B) are management and IT functions. ERP development (C) is a project management activity.
