Resources

Most people walk into a data governance role and find no handover, no inventory, and no clear place to start. The previous person left, the documents are scattered across folders nobody has access to any more, and the chief executive is asking when the AI strategy will be ready. This guide is for that situation.

Data governance, stripped of jargon, is really about answering three questions well: what data do we have, who is responsible for keeping it honest, and can we trust it enough to make decisions with it. Everything else, the policies, the reviews, the software, is just a way of making those three answers reliable and repeatable.

You do not need a large team or a big budget to begin. You do need about two days of focused effort in your first week, a notebook, and the willingness to say out loud that you do not know the answers yet. Everything useful starts from that honesty.

At the end of three months, you will have an inventory you can show a regulator, a named owner for every significant data asset, and at least three datasets where quality is being watched rather than guessed at. That is not a finished governance programme. It is the foundation that everything else is built on.

The most common mistake at this stage is to try to write a comprehensive policy document before anything has been measured in practice. Policies written before practice are wish-lists. Policies written after the first three months reflect what your organisation is actually capable of doing, and they survive contact with reality.

When you are ready for the next stage (linking your rules to the software your teams already use, setting up automatic checks, and preparing for external audits) that is a conversation worth having. We walk customers through that rollout live on a discovery call.

The single biggest reason governance platforms fail to land in public-sector and institutional settings is that they ask you to move your data first. You are told the platform is ready to help the moment you have migrated twenty years of records into a new store. Nobody ever manages to complete that migration, so the platform is never fully useful.

eventParity deliberately takes the opposite position. We connect to the data you already have, where it already lives. Nothing is copied unnecessarily. Nothing is moved without a business reason. The governance layer sits above your existing systems rather than replacing them, which is the only arrangement that actually works at a ministry or a university with a long data history.

The most common troubleshooting question is why a connection succeeds but shows no data. It is almost always a permissions issue on the source side. The service account exists, but the granting team did not yet attach it to the right role. A five-minute conversation with your database administrator usually resolves it.

If your data estate spans several jurisdictions, connection topology becomes part of the contract. We design the deployment shape with you before anything goes live: a single managed instance today, or a sovereign on-premise deployment as a scoped engagement. The choice depends on your residency and sovereignty obligations, not on what is easiest for us to operate.

Most compliance failures are not failures of intent. They are failures of evidence. Your organisation did the right thing, but the trail of who did what, when, and on whose authority, cannot be reconstructed three years later when the question finally arrives. The distance between "we have a policy" and "we can show that we followed it, every time, including the awkward cases" is where governance programmes live or die.

This reference is for the officer who has to stand up in front of a regulator or a board audit committee and answer specific questions about specific decisions. It is not a legal opinion. It is a practical guide to what evidence you need to be producing continuously, in the background, so that answers are ready on the day they are asked for.

The principle running through all of these is simple: if it is not written down, it did not happen. Your team's memory, your email archive, and the screenshots saved in someone's desktop folder do not count. The artefact has to be in a place a third party can examine on request, in a form that cannot be quietly edited after the fact.

The hardest question a compliance officer usually faces is not about the law. It is about what their own organisation actually did, given what the law required. eventParity is built around making that second question easier to answer: every change is recorded, every decision has an author, and every artefact can be produced in one click when the moment comes. The regulation changes; the artefact holds.

If you want a review of your current evidence posture, that is a discovery-call conversation. We walk through a real example with you, show where the evidence holds up, and flag the places where it would not survive an adversarial audit. No deck, no pitch. Just a look at where you are.

Picture a federal programme with a single mandate. Say, delivering a social intervention to citizens in every state of a country. The programme is run by one ministry at the centre. Implementation happens through twenty-three agencies on the ground, each answerable to a different state or regional authority. Each of those agencies already has a system of record, chosen locally, set up years ago, and staffed by people who know it well. None of the systems agree on the shape of a citizen record.

The central ministry has to report to parliament on programme outcomes. It cannot do that by waiting for twenty-three different spreadsheets to arrive by email, each with its own definition of who counts as a beneficiary. It also cannot solve the problem by forcing all twenty-three agencies onto a single system, because that migration would take years and would be political suicide with the state authorities.

The only arrangement that actually works is a federated one. Each agency keeps its own system, its own data, and its own independence. What they share is a single set of governance standards: agreed definitions, agreed quality thresholds, and a single place where the programme-level view is assembled. The shared standards are the contract between the ministry and the implementers, and the tool enforces the contract without replacing the local systems.

The political advantage of this arrangement is that it respects the autonomy the state authorities already have. The ministry is not asking the agencies to hand over their data. It is asking them to participate in a shared standard of how the data is described and how its quality is measured. That is a conversation implementers can say yes to, because it does not threaten the authority they already hold.

The operational advantage is that problems surface in weeks rather than months. The old model, where the ministry discovers data problems in the week before a report is due to parliament, disappears. The new model has the problems visible as they happen, with the named people who can fix them already on the receiving end of the alert. Parliament gets a cleaner number, and the implementers get to fix their own issues before anyone outside their state knows there was one.

What this looks like on a discovery call is a walk-through of the specific programme: which agencies, which systems, which report to parliament is on the line, and how fast the ministry can get to a defensible programme-level view. Every programme is different; the shape of the deployment is part of the contract, not a default setting.

A public university with a century of history has, over time, become twelve semi-autonomous faculties sharing a logo. Each faculty runs its own research grants, its own student records, and its own relationship with donors and funders. That autonomy is a strength. It is also the reason the vice-chancellor cannot produce a coherent institutional position when the accreditation body asks for one.

The specific precipitating moment is usually an accreditation review. The reviewers ask to see how the institution manages research data across faculties: provenance, ethics approvals, retention, access controls. Each faculty can answer for itself; nobody can answer for the institution. The review either ends with conditions attached, or the university spends six months in a crash programme to produce the answers after the fact.

The arrangement that works in a university context is almost the opposite of a top-down crackdown. It is federated: each faculty remains in control of its own data and its own research ethics process, but the institution has agreed a minimum standard of what every faculty captures and how it captures it. That standard is thin enough that faculties do not feel their autonomy is threatened, and thick enough that the vice-chancellor can answer an accreditation question without phoning all twelve deans.

The cultural work is harder than the technical work. Getting faculty deans to agree on a shared standard requires presenting the standard as a protection for their autonomy, not a threat to it. The argument is that the institution is going to be asked questions by funders, regulators, and accreditors whether or not the faculties are ready, and the standard is the cheapest way to make sure each faculty is answering in its own voice rather than being answered for.

The immediate dividend is in the accreditation review itself. Where the previous review generated weeks of defensive preparation, the next one generates a ninety-minute walk-through of a dossier that already exists, updated in the ordinary course of research work. The review either passes cleanly or identifies specific improvements that can be implemented inside a single faculty without dragging the whole institution into a reorganisation.

What this looks like on a discovery call is a look at the university's current accreditation obligations, the faculties that already have good practice, and the minimum shared standard that can be adopted without provoking political resistance. Every institution's shape is different; the standard follows from the institution, not the other way round.

A development organisation is funded to deliver a public-health intervention across seven countries. It works through local partners, chosen because they know the communities and have the operational reach. The maturity of those partners varies dramatically. One partner in a coastal capital has a modern operations team with a database, a reporting rhythm, and a data protection officer. Another, in a rural region, still runs on paper forms, a mobile phone, and a spreadsheet that lives on one laptop.

The development organisation has the same reporting obligations to its donor regardless of the maturity of its partners. The donor does not accept "we have good partners and worse partners" as an answer. It wants a single, consistent picture of the programme. The organisation therefore has to bridge a ten-year difference in operational maturity with a governance arrangement that all seven partners can actually participate in.

The mistake to avoid is choosing the most sophisticated partner as the template. Doing that turns the less mature partners into a compliance problem, and the programme spends more time policing its own delivery than doing the work it exists for. The right move is to meet the partners where they are, ask for the minimum that every partner can actually commit to, and build the sophistication in over time.

That is the baseline. From there the programme can start to build capacity in specific partners who are ready for it: moving one onto a database, another onto automated quality checks, another into the data-protection-officer role inside their own organisation. The coordinating team has a single view of where each partner sits on the maturity curve, so the capacity investment goes where it will actually be absorbed.

The donor outcome is a programme report that tells the truth about how the programme is actually running across all seven countries. Not an idealised version. Not a version that depends on the most sophisticated partner producing nine-tenths of the work. An honest, current, defensible picture, with the governance record to back it up.

What this looks like on a discovery call is an honest conversation about the partners, the jurisdictions, the donor obligations, and the maturity gap the programme is trying to bridge. The deployment shape (managed, federated, or fully isolated per partner) falls out of that conversation.