July Topic: Systems and Data Governance
This guest article is by Frank Ableson, CEO of navitend. M&A has had the privilege of working with
navitend for the last decade. navitend provides managed IT services for companies across the US,
with a particular focus on serving organizations with between 15 and 200 users. navitend helps
growing organizations build resilient technology, security, compliance, and operational foundations
that enable sustainable growth.
We asked Frank to share his insights on this topic as a guide for M&A clients on the best ways to
use their existing systems.
Why this matters
As organizations grow, they naturally accumulate systems, processes, and data. What starts out
simple becomes complex—and if left unmanaged, that complexity introduces unnecessary risk.
Entrepreneurial cultures often resist structure, however organizations which survive find a way to
blend structure and agility, often creating a strategic advantage in the process. Healthy
organizations recognize that effective Systems and Data Governance create the necessary
foundation for manageable growth. This starts with knowing how information moves
through your organization, who is responsible for it, and how it is protected. Your systems
and data are not just technical concerns—they are business assets. And like any asset, they need to
be understood, protected, and used effectively if you expect to scale.
At a Glance
• Core Systems
• Data Stewardship
• Information Security Basics: CIA and AAA
• Information Integrity through Well-Formed Transactions
• Inventory
• Master Data
• Taking Action
Understanding Your Core Systems
Every organization runs on a set of critical systems. The names may change, but the categories are remarkably consistent. The point of governance is not simply to list those systems—it is to understand what role each one plays, what data each one holds, and what business process depends on it.
Accounting Systems — where financial truth lives, including invoices, receivables, payables, and the data that drives reporting.
Quoting / Sales Systems — where opportunities are developed, pricing is managed, and revenue begins to take shape.
Support / Ticketing Systems — where work is tracked, service is delivered, and operational history is captured.
Human Resource Information Systems (HRIS) / Learning Management Systems (LMS) Platforms —
where employee records, training completion, and other people-related information are maintained.
These systems represent your organization’s operations, and they are all important. Each one holds a piece of your operational reality. If they are not aligned, you start to hear familiar questions: “Why do these numbers not match?” “Which system is right?” “Who made this change?” When those questions do not have clear answers, decision-making slows down and risk increases.
Practical Takeaway
You cannot govern what you have not identified. For most organizations, the first step is simply
naming the core systems, the business owner of each, and the kinds of data they contain.
Data Ownership vs. Data Custodian
One of the simplest—and often misunderstood—concepts in governance is the distinction between data
ownership and data custodianship. Not all responsibility belongs to IT. In fact, assuming that “IT owns the
data” is one of the easiest ways to create confusion and weaken accountability.
Data Owner
The data owner is accountable for the data itself: what it means, whether it is accurate, how it should be used, and who should have access to it. This is a business role. Finance owns financial data. Sales owns customer and pipeline data. HR owns employee data. Operations owns work product lifecycle management.
Information Technology rarely owns the data itself, but is frequently entrusted with protecting it. Let’s meet the Data Custodian.
Data Custodian
The data custodian is responsible for the platform or system that stores, transmits, and protects the data. This includes backups, security controls, access enforcement, system administration, and continuity of service. This role is typically an internal IT team or a capable managed services provider.
When these roles are clear, accountability follows. When the roles are not clear, decisions get delayed,
exceptions multiply, and risk is elevated because no one is quite sure who is supposed to act when there is a problem.
Data Classification
Once you know where your data resides, you need a rationale for who can access it. Classification drives retention requirements, access permissions, encryption decisions, and incident response priorities. This is where the CIA (Confidentiality, Integrity, and Availability) and AAA (Authentication, Authorization, and Auditing) models converge in day-to-day practice.
Here are some examples:
Only the finance team can process financial transactions, and only a subset of the team interacts with payroll data.
Not every employee should have access to sensitive employee, healthcare, legal, financial, or client
information.
Only a subset of your Information Technology team should be able to change the WiFi password, but every authorized team member should be able to access the network.
The CIA Triad: A Simple Way to Think About Protection
Every business system should protect information in three ways: keeping it private from unauthorized users, keeping it accurate and trustworthy, and making sure it is available when needed. Information security professionals often summarize these goals with the acronym CIA: Confidentiality, Integrity, and Availability.
Confidentiality
Making sure information is
available only to the right people
and protected from unnecessary
exposure.
Integrity
Making sure information is
correct, complete, and protected
from unauthorized or improper
change.
Availability
Making sure systems and data are there when the business needs them in order to operate.
These are not abstract ideas. They map directly to business consequences. Lose confidentiality and you risk exposure, embarrassment, or regulatory trouble. Lose integrity and your operations and reporting become unreliable. Lose availability and your business stops. Every system you run should be evaluated through this CIA lens.
AAA: Who Gets In, What They Can Do, and What They Did
Once information is identified and protected, the next step is determining who can access it and what they can do with it. Information security professionals often describe this through the AAA model: Authentication, Authorization, and Auditing.
Authentication
Proving that a user is who they
claim to be before any access is
granted.
Authorization
Defining what that user is
permitted to see, change, approve, or execute inside the system.
Auditing
Recording the actions that were
taken so the organization can
reconstruct the story later.
Authentication:
Authentication is answering the question, "who are you?" It is important that users do not share passwords. There is often a temptation to share logins or licenses to reduce operating expense. Resist this practice, as it undermines your security posture and eliminates individual accountability. Modern organizations increasingly rely on Multi-Factor Authentication (MFA) to strengthen identity verification.
Authorization:
Authorization governs which users can perform which operations. There are many types of users including Administrative or Super Users. There are users with the ability to create transactions and those only able to run limited reports. The more sophisticated the software, the more the options available. An often-overlooked user type is the auditor. An auditor should not be able to change anything. An auditor needs to see the data, understand the process, and validate that controls are functioning. That almost always means read-only access. Providing a proper auditor role is far stronger than scrambling to export reports after the fact.
Auditing:
When something goes wrong—and sooner or later, something always does—the organization needs to answer a very simple question: “What actually happened?” A useful audit trail enables you to determine who conducted the transaction, when it occurred, what was changed, and in what sequence events took place. Without that trail, you are left with opinions and partial recollections. With it, you can piece together the facts.
Key governance principle
Good access control is not only about denying access. It is about granting the right access to the
right role, documenting the activity that follows, and retaining enough history to understand what
happened at a later point in time.
Clark-Wilson and the Well-Formed Transaction
The Clark-Wilson model is a widely recognized approach to preserving information integrity through
controlled processes and approved transactions. In well-run systems, data does not change randomly, but through defined processes, with clear guard-rails for data integrity. This is the heart of the concept of the wellformed transaction. The idea is straightforward: rather than allowing direct, uncontrolled edits to important data (such as directly in a database), a system should require that changes occur through approved procedures that enforce business rules.
A well-formed transaction helps preserve integrity because it limits the ways critical information can be
manipulated. Instead of manually altering a balance, for example, a user posts an adjustment, a reversal, or another recognized transaction type. That distinction matters. The data is not simply “different” afterward; it is different in a way that the system understands, the process allows, and the audit trail can explain.
When organizations permit arbitrary edits to critical records, they undermine trust in their own systems. When they require well-formed transactions, they create a controlled environment where the data can be trusted.
Another, related best practice is to avoid deleting data. Solid system design requires a reason to be recorded when data is “deleted,” or better yet, provides a means for voiding or “reversing” a transaction instead. This preserves the history and reduces the mystery at a later time. It is hard to explain where the data disappeared to in an audit!
If fixing a problem requires someone to “go behind the curtain” and manually alter the data, you've identified a process that is most certainly not using a well-formed transaction.
Inventory: Knowing Where Your Data Actually Lives
One of the biggest risks in any organization is the gap between what you know and what you can’t see. A meaningful “information inventory” should extend beyond the obvious line-of-business applications and
include every place company data may reside: formal systems, file shares, SharePoint sites, user desktops, cloud storage, vendor portals, exports, spreadsheets, email attachments, AI chat sessions, and personal notes used to compensate for weak process.
The goal of an inventory is visibility. If the organization does not know where data exists, it cannot secure it properly, back it up appropriately, control access effectively, or retire it responsibly.
A not-so-hidden risk: tribal knowledge
There is another category that deserves special attention: tribal knowledge. Critical process knowledge that lives only in one or two people’s heads is a substantial vulnerability. If those individuals are unavailable, leave the company, or simply become overloaded, the business slows down or stops. That is not just a staffing issue. It is a governance issue. It is a client experience issue. It can most certainly become a cash flow issue.
Tribal knowledge is also scale-limiting. You cannot build a resilient organization on undocumented shortcuts and memory. Mature organizations work to convert tribal knowledge into documented process, shared understanding, and repeatable workflow. We often call these “Standard Operating Procedures,” or SOPs.
Leading by example
If the business depends on one person “just knowing how it works,” the business has a control gap.
Governance includes the discipline of turning personal knowledge into organizational capability.
Master Data and the Single Source of Truth
As systems increase, the same data begins to show up in multiple places, which can introduce data integrity vulnerabilities. Master data refers to the core business entities that matter to nearly every organization—customers, vendors, employees, products, and other foundational records. A single source of truth identifies the system in which each of those records is authoritative.
For example, a CRM may be the authoritative source for customer identity and account ownership. An
accounting platform is typically the authoritative source for financial postings and balances. Other systems may reference that information, cache it, or synchronize with it—but they should not redefine it casually.
Without a clearly defined single source of truth, reports fail to reconcile, integrations become brittle, and trust in the data erodes. Once trust is gone, the value of the system drops with it, because every answer becomes subject to debate.
Taking Action
Good systems and data governance enable clarity. Clarity builds confidence. When these are in place, your business can operate with confidence, meaningfully reduce risk, and grow responsibly.
A great first step is to bring your leadership team together to map out how information and money flow
through your organization. Map your systems. Draw arrows. Put names to the boxes. Who owns the
information? Who protects the information? Where are the spreadsheets? Be relentless to surface the tools your team relies upon but are not visible to the organization.
About navitend
navitend helps growing organizations build resilient technology, security, compliance, and operational
foundations that enable sustainable growth. Visit their website navitend.com to learn more.
Don't hesitate to reach out to us for copies of prior editions from our extensive Monthly Topic archive. Other July Product Mix Monthly Topics include: Processes and Systems
Comments