Data governance for growing companies: a practical start
Data governance sounds like a big-company problem until a board deck goes out with the wrong revenue number. A lightweight plan for growing companies built around five questions: what data you have, what it means, who owns it, who can see it and how good it is.
"Data governance" sounds like committees, policies and a budget line only large companies can justify. In practice, the companies that suffer most from ignoring it are the growing ones. At 15 people everyone knows that revenue means the number in Stripe. At 60, a new hire pulls "revenue" from the CRM, which includes deals that never paid, and the board deck is 20% too high before anyone notices.
This guide keeps governance small. It comes down to reliable answers to five questions:
- What data do we have? (inventory)
- What does it mean? (definitions)
- Who is responsible for it? (ownership)
- Who can see and change it? (access)
- How good is it? (quality)
Everything else, from policies to tools, exists to keep those answers true as the company grows.
Why start now rather than later
- Informal knowledge stops scaling at around 30 to 50 people. New hires do not know which spreadsheet is the real one.
- Data debt compounds. Every month without definitions adds reports built on different assumptions. Untangling them later takes far longer than agreeing on them now.
- Legal obligations do not wait for size. Privacy laws such as the GDPR apply as soon as you hold personal data about the people they protect. You need to know where that data lives and who can reach it.
1. Inventory: know what you have
List every source of data that feeds a decision. For each one, record:
- Name and system: "Stripe payments", "HubSpot deals", "ops planning sheet"
- Owner (see section 3)
- Sensitivity: public, internal, confidential or restricted
- How often it updates
- Key fields people rely on
- Known problems: gaps, duplicates, manual steps
Start with the sources behind your most important dashboards and reports, not everything at once. If your sources are connected to clariBI, the list in Settings > Integrations is a ready starting point: each source shows its type, status and last successful sync. A shared spreadsheet is enough for the inventory itself until you have more than a few dozen sources.
2. Definitions: agree on what numbers mean
Clear metric definitions settle more arguments than any other governance work. For each business metric, write:
- Name and abbreviation: Monthly recurring revenue (MRR)
- Definition: the value of all active paid subscriptions on the last day of the month, excluding one-time charges, credits and tax
- Formula: the calculation, precise enough that two people get the same result
- Source: which system and which field
- Granularity: daily, weekly or monthly; per customer, per product
- Owner
- Often confused with: bookings, billings, collected cash
The usual trouble spots are revenue (booked, billed, collected, recognized), churn (customers or revenue, gross or net), active users (active how, over what window) and conversion rate (from what to what).
Put definitions where people see the numbers. In clariBI, a custom metric in the dashboard builder has a plain-language description field; paste the definition there so it travels with the chart. Our single source of truth playbook walks through the meeting where you agree on these definitions.
3. Ownership: one name per source and metric
Every source and every key metric needs one owner: a person, not a committee. The owner:
- keeps it accurate and current
- keeps its definition and known issues documented
- decides who gets access to sensitive fields
- investigates when a number looks wrong
- tells downstream users before something changes
Pick the person closest to where the data is created. Finance owns revenue and billing data. Sales operations owns the CRM. Marketing owns campaign and web analytics. Product owns usage data. Ownership is a few hours a month for most people, not a new job.
4. Access: least privilege without friction
Give people access to what their role needs. This is about reducing risk, not about trust: an intern who can see a salary sheet can also share it by mistake.
A simple mapping:
| Sensitivity | Examples | Who sees it |
|---|---|---|
| Public | Published reports, marketing figures | Anyone |
| Internal | Revenue dashboards, product metrics | All staff |
| Confidential | Customer personal data, detailed financials, HR data | Named teams |
| Restricted | Credentials, legal and board material | Named individuals |
In clariBI, everyone in an organization has one of five roles (Owner, Administrator, Analyst, Member, Viewer), each with a default set of permissions; the roles article lists them. On Professional and Enterprise you can create custom roles and use workspaces to share dashboards and reports with only the people who work on them.
Two access habits matter as much as the settings: remove people on their last day, and review who has admin rights every quarter.
Audit trails
Access rules are only useful if you can check them. Everyone in clariBI can see their own activity log. On Professional and Enterprise, the organization audit trail records sign-ins, role and permission changes, data source changes, data exports, and dashboards and reports created or deleted, with the user, time and IP address. The audit trail documentation lists what is recorded and who can read it.
5. Quality: catch problems before a meeting does
Bad data is worse than no data, because people act on it with confidence. The dimensions worth checking:
- Accuracy: does it match reality?
- Completeness: are required fields filled in?
- Consistency: does the same customer look the same in the CRM and in billing?
- Timeliness: is it fresh enough for how it is used?
- Uniqueness: are there duplicates inflating counts?
- Validity: are values in the expected format and range?
You cannot check these by hand every day, so automate the cheap ones:
- Freshness: know when a source stopped updating. In clariBI the last sync time only moves when data actually arrives, and failing sources show up under Issues in Settings > Integrations. The sync failures article explains the common causes.
- Volume: a 50% drop in daily orders overnight is more often a broken pipeline than a bad day.
- Ranges: an average order value that has sat between $40 and $60 for two years and suddenly reads $200 needs checking before anyone celebrates.
- Schema changes: a renamed column can break a report quietly. clariBI dashboards warn when a source's columns have changed since the dashboard was built.
Our post on spotting data quality issues early has more checks you can run.
A 90-day plan
Weeks 1 to 4
- Inventory the 10 sources that matter most.
- Define the 15 to 20 metrics that appear in leadership meetings.
- Name an owner for each.
- Review who has access to what, and remove what is not needed.
Weeks 5 to 12
- Publish definitions where people see the numbers.
- Set up freshness and volume checks for the critical sources.
- Hold a 30-minute monthly data review with the owners.
- Turn on audit logging everywhere it is available.
After that
- Add sources and metrics through the same process.
- Ask about roles, audit logs and two-factor sign-in when you evaluate any new tool.
- Cover the basics in new-hire onboarding.
Keep it light
- Conventions before policies. "Metrics are defined in this template on this wiki page" works. "Every change needs committee approval within 15 working days" will be ignored.
- Living documents. A wiki page anyone can edit, with history, beats a PDF that needs a review cycle.
- Automate checks, and alert a person only when something fails.
- Governance should make data easier to use, not harder to reach.
Where to start this week
Open a spreadsheet with five columns: source, owner, sensitivity, refresh frequency, known problems. Fill in your ten most-used sources. That one sheet answers two of the five questions and shows you where the other three are weakest.