Governed by Design: Eight Practices for Investment Data

Data governance defined:

An agreed and formalized model that assigns ownership, standards, and controls to ensure investment data is accurate, consistent, secure, and auditable across its lifecycle. It aligns people, processes, and technology firmwide to help ensure the trustworthiness of all data as a source of truth for decisions, reporting, and regulatory compliance.

Four factors have intensified the pressure to get data governance right:

• Regulatory scrutiny has increased. In the U.S., the SEC secured $8.2 billion in financial penalties and remedies in 2024. More than $600 million of that amount stemmed from recordkeeping violations.ⁱ In Europe, DORA (Digital Operational Resilience Act)ⁱⁱ and enhanced MiFID IIⁱⁱⁱ reporting requirements have similarly intensified scrutiny on data management practices.
• Accelerating settlement cycles matters as well. The shift to T+1 settlement in North America shone a spotlight on post-trade processes. Europe and the UK are now shifting to a comparable initiative. These changes are pushing firms closer to real-time operations from front to back office, where data accuracy and timeliness require standardization and better reference data.
• Error reduction is a persistent operating goal. Error-prone processes, breaks, and failed reconciliations drain resources and erode client confidence. Manual interventions to fix data issues can consume hours of operations teams' time per day. Across all financial services, operational risks led to more than 65,000 loss events between 2016 and 2021, with losses close to $600 billion.^iv
• Alternative data is expanding the data surface area. Managers across the board are considering different data sources to develop and refine strategies, generate higher returns, and manage risk. This data can include credit card transactions, social media, geolocation, mobile device data, and many other sources. To connect these sources to jobs and opportunities, we need a data architecture that is open. We also need a clear plan for how data is combined, checked, and governed across traditional and other sources.

From Principle to Practice

Investment firms that implement eight essential practices position themselves to turn data governance from an operational necessity into a strategic differentiator.

1. Establish a Single Source of Truths

Create a unified data platform that consolidates data across front, middle, and back offices to eliminate fragmentation, reduce reconciliation overhead, and ensure consistency across all reporting and analytics.

Not everything is relative, but different stakeholders have different needs, such as the difference between a portfolio and an accounting view of positions. Filling those needs depends on a coherent set of rules to determine the truth across many options. Achieving coherence means auditing, and you need to audit where data comes from and how it is used, report on "collisions" when the rules don't map as expected, and make alterations when gaps or conflicts arise.

2. Implement Comprehensive Data Quality and Lineage Controls

Continuously monitor, validate, and remediate data issues using automated checks and anomaly detection while tracking data from source to consumption, using metadata and lineage tools for transparency and traceability.

When mistakes inevitably happen, you cannot correct or prevent them without detailed knowledge about data sources and the business logic used to operate on data. AI and machine learning represent the best choice to spot, evaluate, and address complex data issues by establishing statistical baselines, flagging anomalies, and finding patterns across variables. Comprehensive audit trails that capture what changed and when give you the forensic discipline to reconstruct any historical state for regulatory inquiries or issue resolution.

3. Standardize and Normalize Data Using Domain-Aware Models

Adopt standardized data models tailored to the investment domain, ensuring seamless integration and comparability across asset classes, systems, and jurisdictions.

There's no shortage of good data technology. But it doesn't always apply directly to investment firms' needs. While firms and strategies differ, the same underlying patterns recur, such as accounting, security mastering, trade booking, or collateral/treasury modeling. Agreeing on nomenclature and building a common language into the infrastructure creates process efficiencies and helps open the door to low- or no-code solutions that other users can create and use reliably.

4. Empower Business Users with Self-Service Access

Enable investment, risk, and operations teams to discover, analyze, and use curated data directly through low-code/no-code platforms and governed data marketplaces, reducing dependence on IT and accelerating decision cycles.

Self-service is the ultimate customer service. It often makes everything easier for end users while increasing efficiency and reducing costs. Just like going to a bank branch for cash seems unusual, well-governed data helps your business users accomplish what they need with reliable underlying source data and without needing to request IT resources to achieve their goals. 

5. Govern Data Access with Granular Security Controls

Apply strict, role-based access control (RBAC), data masking, and encryption to protect sensitive data while supporting compliance with privacy and cybersecurity regulations like GDPR, SEC Reg S-P, and DORA.

Robust access governance ensures that only the right people, at the right time, can use the right data. Fine-grained entitlements act as intentional hurdles to human error or misconduct. By slowing down interactions with sensitive datasets, firms can reduce the likelihood of accidental changes or unauthorized exposure. While different in scope, GDPR, SEC Reg S-P, and DORA are ultimately about data utilization.

6. Build Scalable Architecture Across Legacy and Modern Systems

Design your platform to interface with existing OMS, accounting, and CRM systems while ensuring it can scale to meet increasing data volumes, new asset classes, and real-time operational needs such as intraday risk or ETF basket validation with minimal latency.

Few firms have the luxury of starting fresh. Most contend with legacy systems and previous decisions about how to handle their data, and even new investment firms must deal with constraints from technology and data partners. Moreover, the best time to plan for scale arrives before you need it. As your firm grows, worrying about collapsing servers, databases, or APIs adds unnecessary stress and churn. Managed services can further reduce your burden and mitigate havoc during sudden business or market changes.

7. Drive Adoption Through Stewardship and Cultural Change

Establish clear data ownership, invest in training, and align governance goals with business outcomes to foster a culture of accountability, data literacy, and continuous improvement across teams.

Data governance cannot be imposed from the top down. Building a true data culture takes executive sponsorship, clear role definitions, and demonstrable value delivery. Successful firms create data steward roles within business units, establish metrics that connect data quality to business performance, and celebrate wins when better data drives better outcomes.

Why Governance Matters

A single, governed data foundation reduces operational friction, speeds regulatory response, and improves decision support across an investment manager's book of business. Treating data governance as a strategic imperative gives you more room to capitalize on opportunities, manage risks, and meet stakeholder expectations. As markets become more complex and interconnected, those with strong data foundations will have the agility and insight to thrive.

Sources

[i] SEC, “SEC Announces Enforcement Results for Fiscal Year 2024,” 22 November 2024. https://www.sec.gov/newsroom/press-releases/2024-186

[ii] EIOPA, “Digital Operational Resilience Act (DORA).” https://www.eiopa.europa.eu/digital-operational-resilience-act-dora_en

[iii] ESMA, “MiFID II.” https://www.esma.europa.eu/publications-and-data/interactive-single-rulebook/mifid-ii

[iv] McKinsey & Company, “Response and resilience in operational-risk events.” https://www.mckinsey.com/capabilities/risk-and-resilience/our-insights/response-and-resilience-in-operational-risk-events