Data Management & Governance

Why this topic matters

Reliable financial reporting depends on reliable data. Information Systems and Controls (ISC) Area I tests data governance roles, the data life cycle, how relational databases are structured and queried, data storage architectures, and the controls that protect data integrity. The 2026 blueprint added clarifications to the data management tasks, so expect practical questions.

Data governance

Data governance is the framework of policies, roles, and processes for managing data as an asset — ensuring it is accurate, secure, available, and used appropriately.

Role	Responsibility
Data owner	A senior business manager accountable for a data set — decides classification and who gets access
Data steward	Manages data quality, definitions, and adherence to policy day to day
Data custodian	Usually information technology staff — implements storage, backups, and technical controls
Data user	Uses data for authorized purposes
Chief data officer or governance council	Sets enterprise data strategy and policy

Data classification

Organizations label data by sensitivity (for example, public, internal, confidential, restricted) so controls match the risk. Personal information, payment card data, and health information are typically restricted and subject to legal requirements.

The data life cycle

1. Create or collect — capture only what is needed (data minimization); validate at input.
2. Store — secure, backed up, encrypted where sensitive.
3. Use — access limited by role; activity logged.
4. Share — only with authorized parties, under agreements; secure transmission.
5. Archive — retained per the records retention policy and legal requirements (tax, regulatory, litigation holds).
6. Destroy — secure disposal (overwriting, degaussing, physical destruction) when retention ends, with documentation.

Relational databases

• Data is stored in tables (relations) of rows (records) and columns (fields or attributes).
• A primary key uniquely identifies each row; a foreign key is a field that matches a primary key in another table, linking the tables.
• Referential integrity means every foreign key value must match an existing primary key (you can't record a sale for a customer that doesn't exist).
• Normalization organizes tables to reduce redundancy and update anomalies (first, second, and third normal forms); denormalization is sometimes used in reporting databases for speed.
• A database management system (DBMS) controls access, enforces integrity rules, and logs changes. The data dictionary holds metadata — definitions, formats, and relationships.

Structured query language (SQL) basics

Clause	Purpose
SELECT	Choose the columns to return
FROM	The table(s)
WHERE	Filter rows before grouping
JOIN … ON	Combine tables on matching keys — an inner join returns only matches; a left join returns all rows from the left table
GROUP BY	Aggregate rows (with SUM, COUNT, AVG)
HAVING	Filter groups after aggregation
ORDER BY	Sort results

Data storage architectures

Architecture	Description
Operational (transactional) database	Online transaction processing (OLTP) — supports day-to-day transactions; normalized, current
Data warehouse	Integrated, cleaned, historical data from many sources, structured for analysis — online analytical processing (OLAP)
Data mart	A subset of a warehouse for one department or subject
Data lake	Raw data of all types (structured and unstructured) stored in native format; flexible but needs strong governance to avoid a "data swamp"
Data lakehouse	Combines lake storage with warehouse-style structure and governance

Data moves from sources into warehouses through extract, transform, and load (ETL) (or extract, load, transform). Controls include reconciling record counts and control totals between source and target, validating transformations, and logging failures.

Data integrity and quality controls

• Input controls: validation rules, required fields, drop-down lists, duplicate checks.
• Master data management: a single, governed "golden record" for customers, vendors, and products — changes to master data (for example, vendor bank accounts) require independent approval and review of change reports.
• Database controls: restricted direct database access, logging of changes, segregation between database administrators and application users.
• Data quality monitoring: exception reports, reconciliations, and data profiling.
• Data lineage documents where data came from and how it was transformed — important for trust in reports and analytics.

How it is tested

• Assign responsibilities to data owners, stewards, and custodians.
• Order and apply the data life cycle, including retention and destruction.
• Interpret keys, referential integrity, and simple SQL queries.
• Choose between a warehouse, mart, and lake, and identify ETL controls.