Data Governance Risk Assessment Checklist

Data Governance Risk Assessment Checklist
Use this checklist to review data governance risks across your department, systems, and data assets. Complete each section with the most accurate information available.
Assessment Context
Respondent Name
First NameLast Name
Job Title or Role
Department or Business Unit
Assessment Date
MonthDayYear
2 digit month, 2 digit day, 4 digit yearDate
Assessment Scope / Data Domain(s) in Scope
Other
Data Inventory and Classification
Primary data set or system name
Data classification level
Is personal data processed?
Is sensitive data processed?
Is data shared externally or across teams?
Governance Controls Review
Data ownership clarity
Rows Strong Adequate Needs Improvement Not in Place
Ownership roles are clearly defined
Access control appropriateness
Rows Strong Adequate Needs Improvement Not in Place
Access permissions are aligned to job responsibilities
Retention and deletion process
Rows Strong Adequate Needs Improvement Not in Place
Retention schedules are defined and deletion is executed consistently
Change management for data definitions
Rows Strong Adequate Needs Improvement Not in Place
Changes to data definitions are reviewed and approved before implementation
Data quality monitoring and metadata completeness
Rows Strong Adequate Needs Improvement Not in Place
Data quality issues are monitored
Metadata and documentation are complete and current
Approval and exception handling
Rows Strong Adequate Needs Improvement Not in Place
Exceptions are approved, documented, and tracked to closure
Risk Findings and Prioritization
Identified Risks or Gaps
Likelihood of Impact
Impact Severity
Overall Risk Level
Existing Mitigation Actions
Owner Responsible for Remediation
Target Remediation Date
MonthDayYear
2 digit month, 2 digit day, 4 digit yearDate
Follow-up Priority
Should be Empty:

Rows	Strong	Adequate	Needs Improvement	Not in Place
Ownership roles are clearly defined

Rows	Strong	Adequate	Needs Improvement	Not in Place
Access permissions are aligned to job responsibilities

Rows	Strong	Adequate	Needs Improvement	Not in Place
Retention schedules are defined and deletion is executed consistently

Rows	Strong	Adequate	Needs Improvement	Not in Place
Changes to data definitions are reviewed and approved before implementation

Rows	Strong	Adequate	Needs Improvement	Not in Place
Exceptions are approved, documented, and tracked to closure

Select theme:

Rows	Strong	Adequate	Needs Improvement	Not in Place
Data quality issues are monitored
Metadata and documentation are complete and current

Data Governance Risk Assessment Checklist

Assessment Context

Data Inventory and Classification

Governance Controls Review

Risk Findings and Prioritization