When this is the right conversation
Reports disagree, a customer is asking difficult data questions, or a new AI initiative has exposed uncertainty about ownership and permissions.
What the work involves
- Agree the business decision, domain boundaries and evidence access before requesting data.
- Interview business owners, technical custodians and privacy stakeholders; trace a small set of important data flows.
- Test selected claims against available evidence, recording gaps and limitations rather than treating policy documents as proof.
- Prioritize a practical backlog by business consequence, dependencies and effort.
What we need from your team
One accountable sponsor, access to relevant staff and approved documentation. We start with metadata and redacted examples, not unrestricted production exports.
What useful completion looks like
The sponsor can identify the highest-priority issues, who owns them, which evidence supports them and what a first implementation would include.
This is a scoped operational diagnostic, not a statutory audit, certification, penetration test or legal opinion.
Before we begin
We agree the business objective, named delivery roles, access arrangements, fee, timetable and acceptance criteria in a written scope. Dependencies and out-of-scope work stay visible. We do not assume permission to change production systems or transfer sensitive information.
See the engagement processRelated field notes
Your first 90 days of data governance
Two reports. One question: which number can we use?
Imagine operations and finance bring different customer totals to the same meeting. The useful first step is not a larger dashboard. It is to agree what decision the number supports, compare the two definitions and trace a small, authorised sample of the calculation. A diagnostic separates a disputed definition from a missing source, a timing difference or an actual data error.
Illustrative scenario, not a client case study or a claim of past results.
The working evidence
- Scope briefThe business decision, sponsor, domain, systems and exclusions.
- Evidence indexThe actual material reviewed, its date, authority and remaining gaps.
- Issue registerObserved issue, consequence, decision owner and unresolved question.
- Prioritised roadmapDependencies, proposed sequence and acceptance evidence—not a generic maturity target.
Who does what
The sponsor selects the problem and makes people available. Domain owners explain the business meaning. Technical custodians help trace the selected sources. The consultant records the evidence and recommendations; the client retains approval authority.
Ask a colleague who did not attend discovery to follow one finding from its business consequence back to the supporting evidence. They should be able to identify what is known, what is not known and who decides the next step.
A gap hypothesis is not a verified defect. A missing document is not proof that a control does not exist. Recommendations remain provisional where access or evidence was outside the agreed scope.
Make the first workshop useful.
Bring roles, questions and approved examples—not an unrestricted data export.
- Which business decision is currently difficult to explain?
- Which two or three sources and reporting periods will define the first review?
- Who can confirm the evidence boundary and accept the prioritised findings?