Keep the Policy, Keep the Score, Move the Council

Weaving Intelligence (House AI Style), with Jeff Shabel’s Experiential Commentary

The traditional data governance package came in three parts, and I have built every one of them: a policy written before anything else was built, a council to run the programme, and a maturity score to show whether any of it was working. Asked which of the three I had never stood up, and what leaving it out had cost, I could not answer the question as it was put:

I've stood up all of them at various points of time and that's what's led to my assessment of their value being what it is.

That is the warrant for what follows, and it is a limited one. It means the verdict comes from having built each part and watched what it did, not from having skipped one and found out the hard way. It does not mean the package is a single design I would vouch for whole, because it is not one. Its three parts did very different amounts of work.

Here is the verdict in short. Writing the policy first earned its keep, and for a reason that is easy to miss: the policy is what makes a score possible. Scoring earned its keep for the same reason, which makes the two of them one habit rather than two. The council earned its keep at one job, signing off on changes somebody has proposed, and did badly at the job several of the frameworks gave it, which was setting the standards and the direction in the first place.

This is a look back, so a good deal of what follows is history: where that package came from, what it handed to the way enterprises now think about data strategy, and which of its habits deserve to survive the handing over.

Where the package came from

By the middle of the 2000s the three parts were in print, mostly as industry efforts rather than academic ones.

The Data Governance Institute says of itself that "Since 2003, DGI has been the go-to resource for professionals worldwide," and that many practitioners build their programmes "around the renowned DGI Data Governance Framework" [1]. The framework as it stands today has ten components, among them Decision Rights, Policy and Rules, and Participants, and it describes governance programmes as contributing to "high-level, top-down, data-related Policy" [2]. What it shows is where the framework's own authors put policy: high and top-down.

The earliest council in this account was an institution, not a recommendation: in July 2005 a trade report described "a new Data Governance Council has been created by IBM and several dozen companies and IT organizations," formed to "redefine the management of data governance policy" and "the enforcement of policy in IT infrastructure, content and organizational behavior" [3]. The members named included banks, insurers, a pharmaceutical company, universities and the World Bank [3]. The forum that set out to define how organisations should govern data was itself a council of organisations, which is a fair sign of how natural the form seemed.

The score followed within eighteen months. A December 2006 report on IBM's assessment services said the council had "developed a series of 11 categories covering different aspects of data stewardship," and that "Against those categories, the now-standard 5-level maturity model was developed to benchmark the organization's effectiveness" [4]. One of its criteria "examines what rules and standards the organization follows when it implements data governance mandates" [4]. The score was built on top of the rules. That detail matters later.

The academic designs drew the same parts and gave a central group the lead on standards and principles. Kristin Wende's 2007 model set four roles and a committee, the data quality board, against the decisions of data quality management; the board is described as a "Committee, chaired by chief steward, members are business unit and IT leaders as well as data stewards" [5]. The board "defines the data governance framework for the whole enterprise," "sets top-down strategic goals," and "develops and directs corporate-wide standards, rules, policies, processes, and guidelines" [5]. An executive sponsor from top management supplies "sponsorship, strategic direction, funding, advocacy and oversight" [5]. Vijay Khatri and Carol Brown, in 2010, put the principles at the top of their framework: "Data principles, shown at the top of the framework, establish the direction for all other decisions" [6]. For example, they wrote, the decision rights for defining those principles "could be highly centralized within a group of corporate executives" [6]. Principles first and, in their example, the decision rights over them held by a group of corporate executives.

The scoring half then got models of its own. The CMMI Institute unveiled its Data Management Maturity model in May 2014, with "25 process areas reflecting all the fundamental disciplines of data management," built "over the span of three and a half years," and already used by "over 70 organizations" to evaluate their capabilities [7]. In February 2015 the EDM Council released its Data Management Capability Assessment Model, DCAM, "structured into 35 primary capability areas with 108 specific measurement criteria" [8]. DAMA International's body of knowledge, the DMBOK, dates its second edition to 2018 and a revised edition to March 2024 [9], and DAMA kicked off a third edition on June 25, 2025, "designed to modernize the framework" while "keeping the foundational principles that professionals rely on worldwide" [10].

The same shape now governs fields next door. In the version of its Cybersecurity Framework published in February 2024, the National Institute of Standards and Technology places a GOVERN function "in the center of the wheel because it informs how an organization will implement the other five Functions" [11]. Its policy category reads "Organizational cybersecurity policy is established, communicated, and enforced," and its four tiers "characterize the rigor of an organization's cybersecurity risk governance and management practices," from Partial to Adaptive [11]. Governance at the centre, a written policy, a graded ladder: the package travelled well beyond data.

Why did it spread? My reading is that each part answers a question an executive will always ask about any programme. What are the rules? Who decides? Are we getting better? The policy answers the first, the council the second, the score the third. Three questions, three habits.

What the package handed to data strategy

The frameworks did not stay in their lane. DCAM's eight categories begin with "strategy, business case" before they reach "organizational structure, governance" [8]. A model built to measure data management capability starts by grading the strategy. That is one concrete case of the governance package reaching data strategy: in DCAM, one capability model, the strategy is one of the things scored. A data strategy written today may well be judged, sooner or later, against somebody's capability ladder.

A business can afford governance before it can afford a strategy. Asked why the data strategy an organisation agrees to so often outruns the one it funds, I said the gap was not special to data, and I put governance first:

Data as a strategy isn’t any better or worse than any of the others save that it tends to be lower on the list of priorities. Business needs to grow to the point where there’s sufficient spare capacity—in time, money and resources—that a sufficient amount can be allocated to Data Governance before Data as a Strategy (capital S) enters the conversation.

Inside one business, that is why the order holds: the policy, the council and the score are what governance spends its spare capacity on, and a strategy comes after them. Planning data at the level of the enterprise is older than the governance package: James Martin's Strategic Data-Planning Methodologies was published in 1982 [12]. What came after the package is strategy as one of the things a governance framework grades, which appears in DCAM in February 2015 [8], nearly a decade after the council and eight years after IBM's data governance maturity model.

So the package reached data strategy as something a framework grades: DCAM scores the strategy itself [8]. The package has had critics, and they have been busy. Gartner predicted in February 2024 that "By 2027, 80% of data and analytics (D&A) governance initiatives will fail" for lack of a crisis, and its analyst Saul Judah said chief data and analytics officers "should stop taking a center-out, command-and-control approach to D&A governance" and "rescope their governance to target tangible business outcomes" [13]. The release also said that "the typical 'one-size-fits-all' governance approach used today is not the approach needed by most organizations" [13]. That is a forecast, not a measurement, and the release states no method.

The most thorough revision came from data mesh. Zhamak Dehghani wrote in 2020 that "traditional data governance attempts to achieve that through centralization of decision making," by "establishing global canonical representation of data with minimal support for change" [14]. Her replacement is "A decision making model led by the federation of domain data product owners and data platform product owners," which decides "what decisions need to be localized to each domain and what decisions should be made globally for all domains," writes "a set of global rules," and leaves their enforcement to "automated execution of decisions by the platform" [14]. Notice what survives the revision. There are still global rules, written first; there is still measurement, with domain owners "best placed to decide how to measure their domain's data quality" [14]. What changes is who writes the rules, a federation instead of a central council, and how they are enforced, by the platform instead of by people.

When researchers went to see how that worked, the part that changed was the part that hurt. Jan Bode, Niklas Kühl, Dominik Kreuzberger and Sebastian Hirschl interviewed fifteen industry experts involved in data mesh implementations and reported: "We identify the shift from centralized toward federated data governance as the main challenge for professionals" [15]. In federated governance, they wrote, "Domain data product owners and relevant stakeholders collaboratively decide on common standards and policies" [15]. Their remedy was to "introduce a cross-domain steering unit responsible for strategic planning," alongside use-case prioritisation and the enforcement of certain governance rules [15]. That finding is about the third habit, not the first two.

Policy first, so there is something to score

Of the three habits, which earned its keep? Asked that directly, I named the policy and gave a reason that has nothing to do with tidiness:

Policy first is essential because it facilitates the scoring. As we all know, if you can’t score it, you can’t track it and if you can’t track it, you can’t improve it.

The chain in the second sentence is received wisdom, and I introduced it as such. Received wisdom deserves a test, and this one has two well-known problems.

The first is its pedigree. The chain is a close cousin of a better-known maxim, that what you cannot measure you cannot manage, and that maxim is usually credited to Peter Drucker. Writing for the Drucker Institute, Paul Zak says it "ranks high on the list of quotations attributed to Peter Drucker," and then: "There's just one problem: He never actually said it" [16]. Drucker's own view, Zak adds, "was quite nuanced"; the sentence Zak quotes from Drucker's Management: Tasks, Responsibilities, Practices says that work implies "accountability, a deadline and, finally, the measurement of results" [16]. The family's famous name is borrowed. That costs the chain nothing in logic, but it is worth knowing before anyone puts either line in a strategy deck under Drucker's name.

The second problem is serious. In 1976 the social scientist Donald Campbell set down what is now called Campbell's law: "The more any quantitative social indicator is used for social decisionmaking, the more subject it will be to corruption pressures and the more apt it will be to distort and corrupt the social processes it is intended to monitor" [17]. A governance score is exactly such an indicator. Once a maturity level decides a budget or a bonus, people work on the level. The maturity models themselves have a record to match: Jens Pöppelbuß and Maximilian Röglinger observed that "hundreds of maturity models have been proposed by researchers and practitioners across multiple application domains," and that "the concept of maturity models is frequently subject to criticism," with "numerous shortcomings" disclosed in both the models and the way they were designed [18]. The criticism is older than the governance package. Richard Nolan's stage model, published between 1973 and 1979, added a stage called data administration on the way to one called maturity, and when John King and Kenneth Kraemer assessed it in 1983 they judged that "the empirical foundation of the model is questionable" [19]. I concede both points. Scoring can be gamed, and many of the ladders it climbs are poorly built.

Neither point touches the claim I made, which is about order, not honesty. The chain does not say a score will be truthful. It says you cannot have one without something to score against, and that the something is the policy. Profiling tools will count the blanks and the duplicates in data nobody has written a rule for, but a count is a description, not a score. It becomes a score when a rule says what the count ought to be. A monitoring tool that learns a baseline from the data is writing such a rule for you; it says what the data has been, not what it is for. The frameworks above agree, sometimes without meaning to. Khatri and Brown separate the two jobs: "governance includes establishing who in the organization holds decision rights for determining standards for data quality," while "Management involves determining the actual metrics employed for data quality" [6]. On my reading the standard comes first, and the metric measures distance from it. IBM's 2006 maturity model, as reported, examined "what rules and standards the organization follows" [4], so even the score of the governance programme was a score against rules. DCAM calls its criteria "standard evaluation criteria used for measuring data management capability" [8]. The two models just quoted, IBM's maturity model and DCAM, score against criteria somebody else wrote first. An organisation that adopts such a model without writing its own criteria has not skipped writing them first; it has borrowed somebody else's.

Campbell's law sharpens the point rather than refuting it. A score with no written policy behind it is the easiest kind to corrupt, because there is nothing to hold it against. Dehghani's comparison table names the traditional way governance measured its own success: "Measure success based on number or volume of governed data (tables)" [14]. That is a score of the machinery, counted because it was countable, with no rule behind it about what the data was for. Her replacement measures "the connections representing the consumption of data on the mesh" [14], which is at least a measure of use. The lesson I take is narrower than either. Write down what the data is for and what good looks like, and score against that. The policy will not stop people gaming the score, but it lets anyone who reads both see when they have.

So the habit survives the test in a smaller form than the slogan. Writing the policy first does not make a score honest. It makes a score possible, and it makes a dishonest one detectable. That still rules something out: any claim that governance has improved, made with no written standard against which the improvement was measured. The chain says why such a claim cannot be checked.

Councils sign; deciders decide

The frameworks and the research can show how the package was designed and where it has been criticised; whether each part paid for itself in practice is where the warrant becomes my own record, and it is pattern, not law.

Asked the same question about the council, I split it by the work it was given:

Councils, on the other hand, tend to add bureaucracy right where it’s least useful. For sign off on proposed changes, they’re useful. However, for establishing standards and/or direction, they’re beset by the same problems every ‘group project’ always encounters: too many cooks.

That is not a case for scrapping councils, and it should not be read as one. The split is by function. For signing off on a change somebody has proposed, a council is useful. For writing the standard, or choosing the direction, it adds bureaucracy in the one place where speed and a single point of view matter most. A council can write the standard when one member holds the pen and the power to enforce what is written, but then that member is the decider, and the rest of the table is signing.

Set that beside the designs, and the disagreement is plain. Wende's board was given exactly the work I would take away from a council: it "defines the data governance framework for the whole enterprise," "sets top-down strategic goals," and "develops and directs corporate-wide standards" [5]. Khatri and Brown gave as an example that the decision rights for defining the principles could be centralised "within a group of corporate executives" [6]. Data mesh hands the global rules to a federated team of product owners [14]. That is the shift Bode and his colleagues named as the main challenge, and their interviewees said that "the lack of a central unit results in insufficient prioritization of use cases" [15]. The steering unit the authors proposed in answer, they say, "can only complement and support the federated governance structure" and "may grow obsolete with the increasing maturity of a data mesh" [15]. So the study does not show that a crowded table cannot write a standard. It reports interviewees saying a federated table did not set priorities across domains, and a remedy that puts strategic planning in one cross-domain unit, without saying how large that unit should be.

The strongest objection is that committees plainly can write standards; international standards are written that way. ISO's standards are drafted by "independent technical experts nominated by our members," who "negotiate all aspects of the standard, including its scope, key definitions and content," and "The voting process is the key to consensus" [20]. Norbert Kerr and Scott Tindale's review of group performance reported that recent research has found that "process gains as well as losses are possible," and that both are frequently explained by "situational and procedural contexts" [21]. I read that as saying a crowded table is not doomed. I concede the objection as far as it goes. Too many cooks is a tendency, not a law of nature.

But the objection carries its own price tag. ISO says that "From first proposal to final publication, developing a standard usually takes about 3 years" [20]. The loss side of the group ledger is just as well documented: Steven Karau and Kipling Williams's meta-analysis of 78 studies found social loafing, "the tendency for individuals to expend less effort when working collectively," to be "robust" and to generalise "across tasks" [22]. An enterprise that needs a naming standard or a definition of an active customer this quarter cannot wait three years. In a committee of busy executives, which is my illustration of that finding and not theirs, each member is likely to assume another is doing the drafting. Even ISO, whose experts negotiate the draft as a group, closes the process with a vote, and the vote is the step where the many take part. Who should hold the pen before that step is my judgement, from having stood up every part of this package, not ISO's.

The practitioner literature got there first. Robert Seiner, the advocate of what he calls non-invasive data governance, gives the Data Governance Council the job of "Approving things that need to be approved – i.e., data policy, data role framework, methods, priorities, tools, etc." [23]. He reports that organisations often consider that "only five to ten percent of all decisions need to be raised to the strategic level," and that "Higher percentages often reflect difficulties of facilitating toward acceptable solutions at the tactical level" [23]. Seiner still lets the council make strategic decisions, so he and I do not draw the line in exactly the same place. But his council mostly approves what others have prepared, and he treats a council that has to decide a lot as a sign that something below it is broken. That is most of my split, arrived at from a different school.

If the council does not set direction, who does? My answer to that is blunt: whoever holds the authority and, more than that, the power to enforce, makes the final call, and the other groups live with it. One academic definition is not far off. Rene Abraham, Johannes Schneider and Jan vom Brocke, reviewing "145 research papers and practitioner publications published during 2001-2019," define the subject as "the exercise of authority and control over the management of data" [24]. Authority and control are properties of people who can act, not of meetings. I have also said that every part of the traditional package, councils included, is correct and oversold, and that each lives or dies on whether a champion with real weight stands behind it. On my reading, a council cannot be that champion, because the weight is spread across the table and no one member carries it out of the room.

Then what is sign-off for, if the decision was already made? My own record has a harder word for some approvals. I have said that when a department head writes a business case, the decision has usually been made before the case is written, and the procurement steps that follow are mostly formality. A council that signs off on a direction the decider has already chosen looks like the same formality. I do not think it is wasted. My test for whether an organisation can carry out a strategy compares the scope of the strategy with the number of signatories: the more signatories there are among the people it directly affects, the better its chances. Put those two answers together and the council's sign-off has a job after all. It does not choose the direction. It puts the names of the people who must carry the direction on the page, before they are asked to carry it.

Here is the arrangement the look back points to, as one loop:

Doctrine before the sticker

The package was pitched at enterprise scale, yet the plainest case for policy first I have made is about a single programme, master data management. Asked whether all data loses value or only master data, I said all of it, and the remedy I gave for an MDM project was a policy by another name:

That’s why getting the process right as early as possible is so important to an MDM Project. Without an approved and established doctrine defining what the data means, how it’s collected, how it’s maintained and how it’s cleaned and deduplicated, all we’re doing is slapping a ‘Grade-A’ sticker on a slice of meat that remains just as questionable as it did when we first got it. It’s possible it’s Angus, but it’s also possible it’s horse.

A doctrine, in that answer, is four things written down and approved: what the data means, how it is collected, how it is maintained, and how it is cleaned and deduplicated. Each is a policy, and each can be scored. Meaning can be checked against a definition. Collection can be checked against a method. Maintenance and cleaning can be checked against a rule and a result. Without them, an MDM platform stamps its output with the authority of a golden record, and the stamp says nothing about what is underneath. That is the sticker.

Nothing in those four is specific to master data. That is the part of an MDM programme that scales beyond it. The platform belongs to one domain and one budget line; the doctrine can be lifted, domain by domain, into the rest of the estate, because every data set has a meaning, a collection method, a maintenance routine and a cleaning rule, whether or not anyone wrote them down. A governance framework that scales beyond its MDM programme does so by carrying the doctrine outward, not the tool. The habit of writing the policy first was always more portable than the system it was first written for.

The loop above travels with it. Each domain that takes the doctrine on needs the same three things: someone with the authority to settle its definitions, a written rule for each of the four, and a score against each rule. The council's place does not change as the doctrine spreads. When one domain's rule has to change because another domain depends on it, the change is proposed, and the people who run the domains it touches sign it. What changes is the number of signatures needed, and that is where my test of scope against signatories bites hardest. A doctrine that governs five domains and carries the signature of one has been announced, not adopted.

That last point needs one guard, because a policy can be bought as well as written. Asked about governance tooling, I said:

What the tool vendors gloss over is that the tool isn't even half the battle. A tool that's unused performs exactly as well as a tool that's unsuited. The challenge for data governance groups in general — and for governance tools specifically — is business push-back. The enterprise needs to embrace and enforce data governance as a standard, or it's just another pro-forma box that legal checks to confirm they're 'compliant' with ANSI Standard 12345 or the BobTom Regulation.

The standard and the regulation in that answer are invented names; the point does not depend on which real ones a reader substitutes. It joins Campbell's law to the policy question. A policy that lives only inside a tool, or only in a compliance checklist, produces a score of signatures and installations, which is the most corruptible kind there is: it counts that the box was ticked, not that the data behaved. Policy first, done properly, means the business has embraced the rule and enforces it, so that the score measures the data and not the paperwork. Done badly, it is a binder that legal signs once a year, and the maturity model gives it a level anyway.

What the look back changes

The package spread as three habits because each answered a question executives always ask: what are the rules, who decides, are we getting better. DCAM, one capability model, scores the strategy itself [8], and the same shape appears next door, where the newest cybersecurity framework puts governance and policy at the centre and grades the result in tiers [11]. Of the critics of the old package, Gartner's analyst asks that governance be rescoped "to target tangible business outcomes" [13], and data mesh keeps global rules and the measurement of data quality while arguing about who should write the rules and how they should be enforced [14].

Having built each part, I would hand a data strategy written today the package in a different arrangement from the one the frameworks drew.

Keep the policy and the score, and treat them as one habit. Write down what the data is for and what good looks like before building anything that measures it, because the score has nothing to measure until you do. Expect the score to be gamed, as Campbell said it would be, and keep the written rule beside it so the gaming shows.

Name the decider. Direction and standards belong to whoever holds the authority and the power to enforce, and a data strategy that does not say who that is has left the job to a meeting.

Keep the council, and give it the job it does well. Let it sign off on changes somebody has proposed, so that the people who must carry a change have put their names to it first. Do not ask it to write the standard. ISO can afford three years; most enterprises cannot.

That arrangement still rules things out. It rules out a strategy that claims progress against no written standard, a council asked to invent the direction it is supposed to approve, and an MDM programme that ships a golden record with no doctrine behind it. The second of those was in the package as the designs drew it. The look back does not say the old frameworks were wrong. It says they bundled one habit worth keeping whole with one worth keeping in a smaller job, and then gave the smaller one the decider's work.

References

[1] The Data Governance Institute, "Membership in the Data Governance Institute," datagovernance.com (undated page). Read 2026-10-12. A self-description by a membership and training body. Cited for the two phrases quoted in the body. https://datagovernance.com/?p=1931

[2] The Data Governance Institute, "DGI Data Governance Framework Components," datagovernance.com (undated page; the framework's own page shows a last modification of 7 February 2025). Read 2026-10-12. The current version of the framework; its first edition was not read. Cited for the component names and the phrase quoted in the body. https://datagovernance.com/the-dgi-data-governance-framework/dgi-data-governance-framework-components/

[3] Todd R. (surname abbreviated on the page), "Corporate IT council to review safeguarding data," Computerwoche (FoundryCo), 1 July 2005. Read 2026-10-12. A trade report of IBM's announcement; the page carries no credit to an original publication. Cited for the three phrases quoted in the body and the membership list. https://www.computerwoche.de/article/2610729/corporate-it-council-to-review-safeguarding-data.html

[4] Tech Monitor, "IBM inaugurates data governance assessment services," 13 December 2006. Read 2026-10-12. A trade report; IBM's own model document was not read, and the report says it was not then public. Cited for the categories, the five-level model and the criterion quoted in the body. https://techmonitor.ai/?p=46302

[5] Kristin Wende, "A Model for Data Governance – Organising Accountabilities for Data Quality Management," ACIS 2007 Proceedings, paper 80 (2007), pp. 417–425. Read 2026-10-12 in full in the AIS eLibrary PDF. Re-read 2026-10-13 for the four roles and one committee of Table 1 (pp. 420–421). Cited for the model of four roles and one committee, the description of the data quality board (Table 1, p. 420; p. 421) and the executive sponsor (p. 421). https://aisel.aisnet.org/cgi/viewcontent.cgi?article=1079&context=acis2007

[6] Vijay Khatri and Carol V. Brown, "Designing Data Governance," Communications of the ACM 53, no. 1 (January 2010): 148–152, doi:10.1145/1629175.1629210. Read 2026-10-13 in the CACM web text, abstract to conclusion (the tables appear as captions only and the figures are images; none of the passages quoted comes from them). Cited for the four passages quoted in the body. https://cacm.acm.org/research/designing-data-governance

[7] CMMI Institute, "CMMI Institute Unveils the Data Management Maturity Model," press release (Business Wire), Pittsburgh, 29 May 2014. Read 2026-10-12 in a reproduction of the release. The model itself was not read. Cited for the process-area count, development period and adoption figure quoted in the body. https://www.businesswirechina.com/en/news/27209.html

[8] EDM Council, "EDM Council Releases Best Practice For Data Management: DCAM Defines Standard Criteria For Evaluation Of Data Management Capability In Financial Services," release reproduced by Mondo Visione, 19 February 2015. Read 2026-10-12. The model itself is licensed and was not read. Cited for the category list, the capability-area and criteria counts, and the phrase quoted in the body. https://mondovisione.com/media-and-resources/news/edm-council-releases-best-practice-for-data-management-dcam-defines-standard-2015219/

[9] DAMA International, "Body of Knowledge" page. Read 2026-10-12. The DMBOK itself was not read. Cited for DAMA's own dating of the second edition and the revised edition. https://dama.org/content/body-knowledge

[10] DAMA International, "DAMA-DMBOK 3.0 Project" page. Read 2026-10-12. Cited for the kick-off date and the two phrases quoted in the body; the page gives no release date. https://dama.org/dama-dmbok-3-0-project/

[11] National Institute of Standards and Technology, The NIST Cybersecurity Framework (CSF) 2.0, NIST CSWP 29, 26 February 2024. Read 2026-10-12 in the PDF (pp. iv, 3, 4, 7, 17 checked). Cited for the GOVERN passage (p. 4), the GV.PO category (p. 17) and the Tiers (p. 7). https://nvlpubs.nist.gov/nistpubs/CSWP/NIST.CSWP.29.pdf

[12] James Martin, Strategic Data-Planning Methodologies (Englewood Cliffs, N.J.: Prentice-Hall, 1982), ISBN 0138511136. Read 2026-10-12 at the library catalogue record only (WIPO Knowledge Repository); the book was not read. Cited only for its title, author, publisher and year, as evidence that enterprise data planning was in print before the governance package. https://tind.wipo.int/record/18086

[13] Gartner, "Gartner Predicts 80% of D&A Governance Initiatives Will Fail by 2027, Due to a Lack of a Real or Manufactured Crisis," press release, Stamford, Conn., 28 February 2024. Read 2026-10-12. A prediction; the release states no method or sample. Cited for the prediction and the passages quoted in the body. https://www.gartner.com/en/newsroom/press-releases/2024-02-28-gartner-predicts-80-percent-of-data-and-analytics-governance-initiatives-will-fail-by-2027-due-to-a-lack-of-a-real-or-manufactured-crisis-

[14] Zhamak Dehghani, "Data Mesh Principles and Logical Architecture," martinfowler.com, 3 December 2020. Read 2026-10-12 (section "Federated computational governance" and its comparison table). Cited for the passages quoted in the body. https://martinfowler.com/articles/data-mesh-principles.html

[15] Jan Bode, Niklas Kühl, Dominik Kreuzberger and Sebastian Hirschl, "Towards Avoiding the Data Mess: Industry Insights from Data Mesh Implementations," arXiv:2302.01713, version 4. Read in full 2026-10-13 in the v4 PDF, to the last reference. Method: fifteen semi-structured interviews with industry experts. Cited for the finding, the description of federated standard-setting, an interviewee-reported difficulty, and the recommendation and its two limits quoted in the body. https://arxiv.org/html/2302.01713v4

[16] Paul Zak, "Measurement Myopia," Drucker Institute (undated as fetched). Read 2026-10-12. Re-read 2026-10-13. Cited for the attribution point (the maxim Zak says Drucker never said is "If you can't measure it, you can't manage it."), the phrase on Drucker's view, and Drucker's sentence from Management: Tasks, Responsibilities, Practices as Zak quotes it; Drucker's book itself was not read. https://drucker.institute/?p=15380

[17] Donald T. Campbell, "Assessing the Impact of Planned Social Change," Paper #8, Occasional Paper Series, Public Affairs Center, Dartmouth College, December 1976; reprinted in Journal of MultiDisciplinary Evaluation 7, no. 15 (2011): 3–43. Read 2026-10-12 at p. 34 of the reprint in the journal's PDF. Cited for the sentence quoted in the body. https://jmde.journals.publicknowledgeproject.org/index.php/jmde_1/article/view/297

[18] Jens Pöppelbuß and Maximilian Röglinger, "What Makes a Useful Maturity Model? A Framework of General Design Principles for Maturity Models and Its Demonstration in Business Process Management," ECIS 2011 Proceedings, paper 28. Read in full 2026-10-13 in the open ECIS 2011 PDF. Cited for the three phrases quoted in the body. https://aisel.aisnet.org/ecis2011/28/

[19] John Leslie King and Kenneth L. Kraemer, "Evolution and Organizational Information Systems: An Assessment of Nolan's Stage Model," ICIS 1983 Proceedings, paper 12. Read in full 2026-10-13 in the open ICIS 1983 PDF (a three-page paper, pp. 129-131, that is itself an extended abstract). Cited for the dates of Nolan's model, its data-administration and maturity stages, and the judgement quoted in the body. https://aisel.aisnet.org/icis1983/12

[20] International Organization for Standardization, "Developing standards" page (undated). Read 2026-10-12. Cited for the passages quoted in the body. https://www.iso.org/developing-standards.html

[21] Norbert L. Kerr and R. Scott Tindale, "Group Performance and Decision Making," Annual Review of Psychology 55 (2004): 623–655, doi:10.1146/annurev.psych.55.090902.142009. Read 2026-10-13 at the abstract only; the full text is paywalled. Cited for the two phrases quoted in the body. https://www.annualreviews.org/content/journals/10.1146/annurev.psych.55.090902.142009

[22] Steven J. Karau and Kipling D. Williams, "Social Loafing: A Meta-Analytic Review and Theoretical Integration," Journal of Personality and Social Psychology 65, no. 4 (1993): 681 ff., doi:10.1037/0022-3514.65.4.681. Read 2026-10-13 at the abstract only, from an index copy (the publisher's page refused the fetch tool). Cited for the definition and finding quoted in the body. https://doi.org/10.1037/0022-3514.65.4.681

[23] Robert S. Seiner, "Complete Set of Data Governance Roles & Responsibilities," TDAN.com (undated on the page). Read 2026-10-12. Cited for the council's responsibilities and the escalation passages quoted in the body. https://tdan.com/?p=21589

[24] Rene Abraham, Johannes Schneider and Jan vom Brocke, "Data governance: A conceptual framework, structured review, and research agenda," International Journal of Information Management 49 (2019): 424–438, doi:10.1016/j.ijinfomgt.2019.07.008. Read 2026-10-13 at the abstract only (the publisher's page refused the fetch tool; the abstract was read on the authors' institute page). Cited for the definition and the review's scope quoted in the body. https://www.wi.uni-muenster.de/publication/86740390