This browser is too old to run Achievable.

Update it, or open this page in a current version of Chrome, Safari, Firefox or Edge. On an iPhone or iPad, update iOS: every browser there runs on the version of Safari that comes with it.

Achievable logoAchievable logo
CMA Part 1
Sign in
Sign up
Purchase
Textbook
Practice exams
Support
How it works
Resources
Exam catalog
Mountain with a flag at the peak
Textbook
Introduction
1. External financial reporting decisions
2. Planning, budgeting, and forecasting
3. Performance management
4. Cost management
5. Internal control
6. Technology and analytics
6.1 Information systems
6.2 Data governance
6.2.1 Technology-enabled finance transformation
6.2.2 Data policies and procedures
6.2.3 Life cycle of data
6.2.4 Data management
6.2.5 Controls against security breaches
6.3 Data analytics
Wrapping up
Achievable logoAchievable logo
6.2.2 Data policies and procedures
Achievable CMA Part 1
6. Technology and analytics
6.2. Data governance
Our CMA Part 1 course is currently in development and is a work-in-progress.

Data policies and procedures

6 min read
Font
Discuss
Share
Feedback

Learning outcome statements

The learning outcome statements relevant for this section are:

  1. define data governance
  2. demonstrate a general understanding of data governance frameworks, including COSO’s Internal Control—Integrated framework

Definition of data governance

Definitions
Data governance
The overall management of the availability, integrity, usability, and security of data within an organization.

Data governance involves establishing policies, procedures, and responsibilities to ensure data is accurate, consistent, and compliant with regulatory requirements.

Data governance has four primary objectives:

Objectives of data governance
Objectives of data governance
Achievable

Data availability

Ensuring that data is accessible when needed by authorized users. This involves implementing backup strategies, redundancy systems, and disaster recovery plans to minimize downtime and data loss.

Data integrity

Maintaining the accuracy and reliability of data throughout its lifecycle. This requires implementing validation processes, error detection mechanisms, and audit trails to prevent unauthorized modifications or corruption.

Data usability

Ensuring that data is structured, formatted, and stored in a manner that allows efficient retrieval and processing. This includes data standardization, normalization, and metadata management to enhance usability across various departments.

Data security

Protecting data from unauthorized access, breaches, and cyber threats. Security measures include encryption, access controls, multi-factor authentication, and regular security assessments to safeguard sensitive information.

The COSO’s internal control-integrated framework

This has already been discussed in CMA Part 1 - Section E on Internal Control. Since this objective has appeared in separate learning outcome statements for each section, we have covered them here briefly in the context of data governance.

Organizations rely on structured data governance frameworks to ensure proper data oversight. Management typically selects which frameworks to adopt based on the organization’s regulatory requirements, industry standards, and business needs. These frameworks provide structured guidelines that help maintain compliance, security, and operational efficiency while ensuring that data governance aligns with the company’s strategic objectives.

One of the most widely recognized frameworks is COSO’s internal control—integrated framework, which provides a structured approach for risk management, internal controls, and data integrity.

Objectives

The COSO internal control—integrated framework categorizes internal control objectives into three main areas:

  • Operations: Ensuring the effectiveness and efficiency of business operations, including safeguarding assets and optimizing processes to support organizational goals.
  • Reporting: Supporting the reliability, timeliness, and transparency of financial and non-financial reporting to facilitate informed decision-making.
  • Compliance: Ensuring adherence to applicable laws, regulations, and internal policies to mitigate legal and financial risks.

These objectives provide a foundation for organizations to design and implement internal controls that enhance data governance, risk management, and overall business integrity.

Key components

The COSO framework is built upon five interrelated components, often referred to as the five pillars, which are further broken down into 17 guiding principles. These pillars serve as the foundation for implementing effective internal controls, including those applied to data governance.

Sidenote
Acronym to remember: CRIME

These components are often remembered using the acronym CRIME, which provides an easy way to recall the framework while preparing for the CMA exam.

C - control activities, R - risk assessment, I - information and communication, M - monitoring activities, E - control environment.

COSO internal control integrated framework acronym
COSO internal control integrated framework acronym
Achievable

Pillar 1: Control environment

This pillar establishes the tone at the top, promoting ethical behavior, accountability, and clear lines of authority. For example, a company with a well-defined control environment enforces a code of conduct, provides regular training on governance policies, and maintains a whistleblower policy so employees can report governance violations.

It includes principles such as:

  1. Demonstrating commitment to integrity and ethical values.
  2. The board of directors demonstrates independence from management and exercises oversight of internal control.
  3. Establishing structure, authority, and responsibility in pursuit of objectives.
  4. Demonstrating commitment to attract, develop, and retain competent individuals.
  5. Holding individuals accountable for their internal control responsibilities.

Pillar 2: Risk assessment

Identifies and evaluates risks that could prevent the organization from achieving its objectives, including risks to data security. For example, a company might classify data by sensitivity level, use predictive analytics to anticipate data security threats, and establish a formal risk response plan with contingency measures for potential cybersecurity threats.

This includes:

  1. Specifying suitable objectives.
  2. Identifying and analyzing risks to the achievement of objectives.
  3. Assessing fraud risk.
  4. Identifying and analyzing significant change that could impact the system of internal control.

Pillar 3: Control activities

Focuses on the policies and procedures that help ensure management’s directives are carried out, including controls that safeguard data. For example, a financial institution may enforce segregation of duties, run automated data validation checks, and restrict data modifications based on employee roles, so only authorized personnel can update critical records.

Principles include:

  1. Selecting and developing control activities that mitigate risk.
  2. Selecting and developing general controls over technology.
  3. Deploying control activities through policies and procedures.

Pillar 4: Information and communication

Ensures that relevant information is identified, captured, and communicated so people can carry out their internal control responsibilities. For example, a company conducts regular training sessions so employees at every level understand their data governance responsibilities.

This includes:

  1. Using relevant, quality information to support internal control.
  2. Communicating internal control information internally.
  3. Communicating with external parties about matters affecting internal control.

Pillar 5: Monitoring activities

Involves ongoing and periodic evaluations to confirm that internal controls are functioning as intended. For example, a company may conduct internal audits and track key performance indicators (KPIs) to monitor data quality over time.

Principles include:

  1. Selecting, developing, and performing ongoing and/or separate evaluations.
  2. Evaluating and communicating deficiencies promptly to those responsible for corrective action.

The data life cycle, records retention requirements, and controls against security breaches — including technology controls such as firewalls and access controls — are covered in later chapters, including life cycle of data and controls against security breaches.

Data governance definition

  • Overall management of data’s availability, integrity, usability, and security within an organization
  • Involves policies, procedures, and responsibilities ensuring accurate, consistent, compliant data

Four objectives of data governance

  • Availability: accessible when needed; backups, redundancy, disaster recovery
  • Integrity: accuracy/reliability via validation, error detection, audit trails
  • Usability: structured/standardized data (normalization, metadata) for efficient retrieval
  • Security: protection from breaches via encryption, access controls, MFA, security assessments

COSO Internal Control—Integrated Framework: objectives

  • Three main objective categories:
    • Operations: efficiency/effectiveness, safeguarding assets
    • Reporting: reliable, timely, transparent financial/non-financial reporting
    • Compliance: adherence to laws, regulations, internal policies

COSO framework: five pillars (CRIME)

  • Five interrelated components with 17 guiding principles total; acronym CRIME:
    • Control activities — policies/procedures (e.g., segregation of duties, automated validation checks)
    • Risk assessment — identify/evaluate risks incl. data security (e.g., classifying data sensitivity, fraud risk)
    • Information and communication — relevant info shared internally/externally for control responsibilities
    • Monitoring activities — ongoing evaluations (internal audits, KPIs) to confirm controls work
    • Eontrol environment — “tone at the top,” ethics, accountability, code of conduct, whistleblower policies
  • Framework helps organizations align internal controls with data governance and strategic goals; specific topics like data life cycle, retention, and security breach controls covered in later chapters

Sign up for free to take 15 quiz questions on this topic

Previous
Next  | 6.2.3 Life cycle of data
All rights reserved ©2016 - 2026 Achievable, Inc.

Data policies and procedures

Learning outcome statements

The learning outcome statements relevant for this section are:

  1. define data governance
  2. demonstrate a general understanding of data governance frameworks, including COSO’s Internal Control—Integrated framework

Definition of data governance

Definitions
Data governance
The overall management of the availability, integrity, usability, and security of data within an organization.

Data governance involves establishing policies, procedures, and responsibilities to ensure data is accurate, consistent, and compliant with regulatory requirements.

Data governance has four primary objectives:

Data availability

Ensuring that data is accessible when needed by authorized users. This involves implementing backup strategies, redundancy systems, and disaster recovery plans to minimize downtime and data loss.

Data integrity

Maintaining the accuracy and reliability of data throughout its lifecycle. This requires implementing validation processes, error detection mechanisms, and audit trails to prevent unauthorized modifications or corruption.

Data usability

Ensuring that data is structured, formatted, and stored in a manner that allows efficient retrieval and processing. This includes data standardization, normalization, and metadata management to enhance usability across various departments.

Data security

Protecting data from unauthorized access, breaches, and cyber threats. Security measures include encryption, access controls, multi-factor authentication, and regular security assessments to safeguard sensitive information.

The COSO’s internal control-integrated framework

This has already been discussed in CMA Part 1 - Section E on Internal Control. Since this objective has appeared in separate learning outcome statements for each section, we have covered them here briefly in the context of data governance.

Organizations rely on structured data governance frameworks to ensure proper data oversight. Management typically selects which frameworks to adopt based on the organization’s regulatory requirements, industry standards, and business needs. These frameworks provide structured guidelines that help maintain compliance, security, and operational efficiency while ensuring that data governance aligns with the company’s strategic objectives.

One of the most widely recognized frameworks is COSO’s internal control—integrated framework, which provides a structured approach for risk management, internal controls, and data integrity.

Objectives

The COSO internal control—integrated framework categorizes internal control objectives into three main areas:

  • Operations: Ensuring the effectiveness and efficiency of business operations, including safeguarding assets and optimizing processes to support organizational goals.
  • Reporting: Supporting the reliability, timeliness, and transparency of financial and non-financial reporting to facilitate informed decision-making.
  • Compliance: Ensuring adherence to applicable laws, regulations, and internal policies to mitigate legal and financial risks.

These objectives provide a foundation for organizations to design and implement internal controls that enhance data governance, risk management, and overall business integrity.

Key components

The COSO framework is built upon five interrelated components, often referred to as the five pillars, which are further broken down into 17 guiding principles. These pillars serve as the foundation for implementing effective internal controls, including those applied to data governance.

Sidenote
Acronym to remember: CRIME

These components are often remembered using the acronym CRIME, which provides an easy way to recall the framework while preparing for the CMA exam.

C - control activities, R - risk assessment, I - information and communication, M - monitoring activities, E - control environment.

Pillar 1: Control environment

This pillar establishes the tone at the top, promoting ethical behavior, accountability, and clear lines of authority. For example, a company with a well-defined control environment enforces a code of conduct, provides regular training on governance policies, and maintains a whistleblower policy so employees can report governance violations.

It includes principles such as:

  1. Demonstrating commitment to integrity and ethical values.
  2. The board of directors demonstrates independence from management and exercises oversight of internal control.
  3. Establishing structure, authority, and responsibility in pursuit of objectives.
  4. Demonstrating commitment to attract, develop, and retain competent individuals.
  5. Holding individuals accountable for their internal control responsibilities.

Pillar 2: Risk assessment

Identifies and evaluates risks that could prevent the organization from achieving its objectives, including risks to data security. For example, a company might classify data by sensitivity level, use predictive analytics to anticipate data security threats, and establish a formal risk response plan with contingency measures for potential cybersecurity threats.

This includes:

  1. Specifying suitable objectives.
  2. Identifying and analyzing risks to the achievement of objectives.
  3. Assessing fraud risk.
  4. Identifying and analyzing significant change that could impact the system of internal control.

Pillar 3: Control activities

Focuses on the policies and procedures that help ensure management’s directives are carried out, including controls that safeguard data. For example, a financial institution may enforce segregation of duties, run automated data validation checks, and restrict data modifications based on employee roles, so only authorized personnel can update critical records.

Principles include:

  1. Selecting and developing control activities that mitigate risk.
  2. Selecting and developing general controls over technology.
  3. Deploying control activities through policies and procedures.

Pillar 4: Information and communication

Ensures that relevant information is identified, captured, and communicated so people can carry out their internal control responsibilities. For example, a company conducts regular training sessions so employees at every level understand their data governance responsibilities.

This includes:

  1. Using relevant, quality information to support internal control.
  2. Communicating internal control information internally.
  3. Communicating with external parties about matters affecting internal control.

Pillar 5: Monitoring activities

Involves ongoing and periodic evaluations to confirm that internal controls are functioning as intended. For example, a company may conduct internal audits and track key performance indicators (KPIs) to monitor data quality over time.

Principles include:

  1. Selecting, developing, and performing ongoing and/or separate evaluations.
  2. Evaluating and communicating deficiencies promptly to those responsible for corrective action.

The data life cycle, records retention requirements, and controls against security breaches — including technology controls such as firewalls and access controls — are covered in later chapters, including life cycle of data and controls against security breaches.

Key points

Data governance definition

  • Overall management of data’s availability, integrity, usability, and security within an organization
  • Involves policies, procedures, and responsibilities ensuring accurate, consistent, compliant data

Four objectives of data governance

  • Availability: accessible when needed; backups, redundancy, disaster recovery
  • Integrity: accuracy/reliability via validation, error detection, audit trails
  • Usability: structured/standardized data (normalization, metadata) for efficient retrieval
  • Security: protection from breaches via encryption, access controls, MFA, security assessments

COSO Internal Control—Integrated Framework: objectives

  • Three main objective categories:
    • Operations: efficiency/effectiveness, safeguarding assets
    • Reporting: reliable, timely, transparent financial/non-financial reporting
    • Compliance: adherence to laws, regulations, internal policies

COSO framework: five pillars (CRIME)

  • Five interrelated components with 17 guiding principles total; acronym CRIME:
    • Control activities — policies/procedures (e.g., segregation of duties, automated validation checks)
    • Risk assessment — identify/evaluate risks incl. data security (e.g., classifying data sensitivity, fraud risk)
    • Information and communication — relevant info shared internally/externally for control responsibilities
    • Monitoring activities — ongoing evaluations (internal audits, KPIs) to confirm controls work
    • Eontrol environment — “tone at the top,” ethics, accountability, code of conduct, whistleblower policies
  • Framework helps organizations align internal controls with data governance and strategic goals; specific topics like data life cycle, retention, and security breach controls covered in later chapters

More from Data governance

  • Life cycle of data
  • Data management
  • Controls against security breaches