Red Flag or Red Herring?

A few weeks ago, David Loshin, whose new book The Practitioner's Guide to Data Quality Improvement will soon be released, wrote the excellent blog post First Cuts at Compliance, which examines a challenging aspect of regulatory compliance.

David uses a theoretical, but nonetheless very realistic, example of a new government regulation that requires companies to submit a report in order to be compliant.  An associated government agency can fine companies that do not accurately report. 

Therefore, it’s in the company’s best interest to submit a report because not doing so would raise a red flag, since it would make the company implicitly non-compliant.  For the same reason, it’s in the government agency’s best interest to focus their attention on those companies that have not yet reported—since no checks for accuracy need to be performed on non-submitted reports.

David then raises the excellent question about the quality of that reported, but unverified, data, and shares a link to a real-world example where the verification was actually performed by an investigative reporter—who discovered significant discrepancies.

This blog post made me view the submitted report as a red herring, which is a literacy device, quite common in mystery fiction, where the reader is intentionally misled by the author in order to build suspense or divert attention from important information.

Therefore, when faced with regulatory compliance, companies might conveniently choose a red herring over a red flag.

After all, it is definitely easier to submit an inaccurate report on time, which feigns compliance, than it is to submit an accurate report that might actually prove non-compliance.  Even if the inaccuracies are detected—which is a big IF—then the company could claim that it was simply poor data quality—not actual non-compliance—and promise to resubmit an accurate report.

(Or as is apparently the case in the real-world example linked to in David's blog post, the company could provide the report data in a format not necessarily amenable to a straightforward verification of accuracy.)

The primary focus of data governance is the strategic alignment of people throughout the organization through the definition, and enforcement, of policies in relation to data access, data sharing, data quality, and effective data usage, all for the purposes of supporting critical business decisions and enabling optimal business performance.

Simply establishing these internal data governance policies is often no easy task to accomplish.  Just as passing a law creating new government regulations can also be extremely challenging. 

However, without enforcement and compliance, policies and regulations are powerless to affect the real changes necessary.

This is where I have personally witnessed many data governance programs and regulatory compliance initiatives fail.

Red Flag or Red Herring?

Are you implementing data governance policies that raise red flags, not only for implicit, but also for explicit non-compliance? 

Or are you instead establishing a system that will simply encourage the submission of unverified—or unverifiable—red herrings?

Related Posts

Days Without A Data Quality Issue

Data, data everywhere, but where is data quality?

The Circle of Quality

DQ-Tip: “Don't pass bad data on to the next person...”

The Only Thing Necessary for Poor Data Quality

Data Governance and Data Quality

Comments

[Jill Wanless]

Timely post Jim!

Sometimes organizations have the best of intentions. They establish strategic alignment and governing policies (no small feat!) only to fail at the enforcement and compliance.

I believe some of this behavior is due to the fact that they may not know HOW to enforce effectively, without risking the very alignment they have established.

I would really like to see a follow up post on what effective enforcement looks like.

Thanks very much!

[Jim Harris]

Thanks for your excellent comment, Jill.

As usual, I agree with you completely. The communication and collaboration that was necessary to establish strategic alignment and governing policies could be at risk of falling apart once the enforcement of those policies starts becoming a daily reality for the organization.

I am working on a follow-up about what effective enforcement might look like, thanks for the thought-provoking request.

Best Regards,

Jim