Nominal ownershipRoles are assigned but decision authority, capacity, incentives, and escalation are unclear.Control response: approved charters, decision rights, capacity planning, forum ownership, and tracked actions.
Enterprise-wide overreachThe programme attempts to govern all data at the same depth before proving the model.Control response: prioritise material domains and critical data, pilot, learn, then scale.
Tool-led designPlatform configuration starts before business terms, ownership, controls, and workflows are agreed.Control response: define the operating model and requirements before detailed configuration.
Weak evidencePolicies, inventories, lineage, quality results, control records, or issue history are incomplete.Control response: record limitations, validate samples, establish evidence standards, and phase remediation.
Unclear boundariesConsultant, bank, vendor, legal, compliance, risk, audit, and technology responsibilities overlap.Control response: document who advises, decides, implements, validates, accepts risk, and owns BAU.