Move from partially repeatable role administration to a documented lifecycle with time-bound access, review, and offboarding evidence.
Enterprise Data Governance · Privacy · Responsible AI
Govern the data.
Protect what matters.
I connect data governance, privacy, and responsible AI with practical controls and clear evidence. Explore my Microsoft Purview and Entra lab implementations, SQL data-quality checks, and governance program designs.
Dr. Bianca RiveraDBA · MBA · MSCISSC-401 · SC-300 · CompTIA Data+Orlando, Florida · Fully remote opportunitiesdrbiancarivera@gmail.comConnect on LinkedIn ↗My point of view
People should be able to find data, trust it, and use it responsibly.
Strong governance connects policy to everyday decisions: who owns the data, what it means, how quality is measured, who may use it, how long it should be kept, and what evidence proves the control works.
I bring more than 12 years of higher-education experience and doctoral training in information systems. My portfolio demonstrates how I apply that foundation to data governance, privacy, information protection, and responsible AI through independent lab implementations and documented program designs.
The fictional enterprise
Veloura Beauty Group
A modern beauty and lifestyle company selling cosmetics, haircare, and accessories through e-commerce, retail boutiques, and a loyalty app. Veloura works with influencers, agencies, suppliers, and beauty advisors—and is preparing to launch an AI-powered virtual beauty advisor.
One company · five connected case studies · one governed information lifecycle
What Veloura needs to govern
Customer profiles & preferencesProduct, shade & ingredient dataLoyalty & purchase historyInfluencer & supplier contractsAI recommendations & decisionsSelected portfolio
One enterprise.
Five connected governance disciplines.
Five connected case studies show how Veloura defines and owns data, governs access, protects and retains information, operationalizes privacy, validates selected controls, and governs responsible AI use. Evidence labels distinguish configured tests from program designs awaiting operating evidence.
01 · Configured & testedMicrosoft Purview
Sensitivity labels, PII detection, simulation, and publishing evidence.
02 · Configured & testedMicrosoft EntraApproved access, group provisioning, PIM, and a completed access review.
03 · Selected executed testsGovernance & SQLOwnership, quality rules, and SQL evidence for uniqueness and referential integrity.
Executive governance assessment
From fragmented controls to one accountable program
I assessed Veloura's fictional current state across identity, information, data, privacy, and AI governance. The assessment prioritizes foundational ownership and policy first, then control implementation, operating evidence, and executive assurance.
Move from ad hoc protection to documented classification, handling, retention, DLP, testing, and accountable monitoring.
Move from informal practices to documented owners, stewards, glossary terms, critical elements, quality rules, lineage, and issue SLAs.
Move from case-by-case handling to documented inventory, impact review, individual rights, retention, vendor review, and evidence.
Move from ungoverned concepts to documented inventory, risk assessment, boundaries, testing, human decisions, and monitoring.
Maturity progression:Initial — ad hocDeveloping — partially repeatableDefined — documented and assignedManaged — measured and enforcedOptimizing — continuously improved
Approve the charter, council, owners, stewards, policy hierarchy, risk register, critical data, and priority use cases.
Deploy governed access, classification, DLP, retention, quality rules, privacy workflows, and AI pilot gates.
Run access reviews, control tests, rights-request exercises, data-quality monitoring, and AI safety/fairness tests.
Review executive scorecards, close priority findings, govern exceptions, expand proven controls, and reset targets.
Assessment basis: Maturity scores and targets are original, illustrative consulting judgments for the fictional Veloura scenario—not measured results from a production organization.
01Microsoft Purview data protection
Completed · configured & testedProtecting sensitive information across its lifecycle
A Microsoft Purview lab implementation connecting classification, sensitivity labeling, automated PII detection, controlled rollout, and evidence to privacy and information-governance requirements.
Open case study details02Microsoft Entra identity governance
Completed · configured & testedGoverning sensitive-data access from request through review
An end-to-end identity-governance lab implementation demonstrating justified, approved, time-bound, least-privilege, and reviewable access to governed data.
Open case study details03Enterprise data governance & trusted data
Completed design · testing in developmentCreating accountable, trusted and traceable enterprise data
A governance operating model supported by ownership, metadata, lineage, Critical Data Elements, data-quality rules, executed SQL validation, and governed reporting.
Open case study details04Privacy operations & compliance
Completed · designed & documentedTurning privacy requirements into operating controls
A privacy-governance program design connecting processing inventory, assessments, individual rights, purpose limitation, retention, vendors, and incident decisions to evidence.
Open case study details05AI governance & responsible data use
Completed · designed & documentedGoverning an AI system before and after launch
An AI-governance program design connecting system inventory, data boundaries, risk assessment, accountable approval, test planning, monitoring, and stop criteria.
Open case study detailsCompleted · configured & testedA technical control was configured, exercised, and supported by retained evidence.
Completed · designed & documentedA professional governance program or artifact was completed; production operation is not claimed.
In developmentThe component is being configured or tested and is not yet presented as completed evidence.
One governed lifecycle: Data governance defines meaning, quality, ownership, and lineage. Entra governs who may access the data. Purview classifies, protects, and retains it. Privacy operations govern justified use and individual rights. AI governance controls how approved data may support automated decisions.
Enterprise architecture blueprint · designed; implementation evidence expanding
One technical foundation for all five governance projects
This reference architecture keeps the portfolio focused on governance while showing the data structures, transformations, analytical assets, and control points that Purview and SQL must govern.
Structured transactions and master data plus contracts, policies, and other unstructured information.
Preserve raw evidence, standardize values, resolve identifiers, apply quality rules, and retain exceptions.
Curated tables provide traceable, controlled inputs to dimensional models and downstream use.
Shared relationships and measures support reporting while approved datasets feed bounded AI use cases.
Registration, scanning, schema discovery, classifications, glossary terms, ownership, CDEs, lineage, impact analysis, data products, and quality context.
In development · catalog implementation will be captured step by stepDefinitions, stewardship, source-to-target mappings, quality dimensions, SQL thresholds, issue ownership, remediation, retest, and executive evidence.
Design completed · technical evidence expandingPII classification, minimization, purpose limitation, retention, rights requests, sensitivity labels, least privilege, access review, and audit evidence.
Designed with selected Purview and Entra controls configured and testedTraining-data suitability, data lineage, quality and bias risk, allowed-use boundaries, human oversight, monitoring, escalation, and stop criteria.
Program design completed · operating evidence in developmentScope boundary: This is a small, interview-ready reference architecture for the fictional Veloura environment. It demonstrates governance-focused technical fluency without claiming production architecture leadership or full analytics-engineering responsibility.
Project 01 · Microsoft Purview Data ProtectionProtecting sensitive information across its lifecycleOpen case study
Configured lab evidence · Microsoft Purview Data Protection
Protecting sensitive information across its lifecycle
I translated a business requirement for consistent protection into a practical Purview control: define the highest sensitivity tier, publish it to users, detect U.S. PII automatically, and validate the configuration in simulation before broader enforcement.
High-value information lacked one consistent protection standard.
Customer personal information, employee records, financial data, credentials, contracts, and confidential business information needed a clear classification and handling rule across Microsoft 365.
Governance control designer and Purview implementer.
I defined the control objective, configured the sensitivity label and publishing policy, selected the enhanced U.S. PII detection template, and documented evidence for monitoring and review.
01Classified
Defined a Highly Confidential tier for restricted Veloura information.
02Marked & protected
Applied access controls and a visible confidentiality footer.
03Published
Made the label available through a governed publishing policy.
04Detected & validated
Used enhanced U.S. PII detection in simulation before enforcement.
The label covers files and other data assets, email, and meetings. Its configuration combines access control with the footer “HIGHLY CONFIDENTIAL | VELOURA BEAUTY GROUP.” Select the image to view it full size.
The auto-labeling policy uses Microsoft's enhanced U.S. PII template to identify sensitive content consistently across selected locations.
The Veloura U.S. PII Auto-Labeling Policy applies the Highly Confidential label and begins in simulation so matches can be reviewed before automatic enforcement.
The policy view documents the standard sensitivity-label publication and the dedicated Highly Confidential publishing policy, including synchronization status at the time captured.
Control outcome
A traceable path from business risk to configured evidence.
- Established a named highest-sensitivity tier with user-facing handling guidance.
- Extended the control across files, email, and meetings rather than treating protection as a single-application setting.
- Added visible content marking and restricted-access behavior for sensitive information.
- Configured automated PII detection with a simulation-first rollout to reduce false-positive and operational risk.
Evidence note: Screenshots document the configuration and rollout state captured during implementation. A “sync in progress” or simulation status is presented as deployment evidence—not as a claim that production propagation had already finished.
In development
Focused catalog extension: governance domain and business glossary
One bounded catalog exercise will add a Veloura governance domain, a published business glossary with approximately five priority terms, and documented owner and steward assignments. This extension demonstrates transferable catalog and stewardship concepts—not broad Purview administration—and will be marked completed only after evidence is retained.
Project 02 · Microsoft Entra Identity GovernanceGoverning sensitive-data access from request through reviewOpen case study
Configured lab evidence · Microsoft Entra ID Governance
Governing access from request through review
I translated Veloura's need for controlled marketing-data access into an end-to-end identity-governance workflow. Access was requested for a documented business purpose, approved by an accountable manager, provisioned through group membership, constrained by expiration, and revalidated through access reviews.
Marketing access needed to be justified, time-bound, and reviewable.
Employees, seasonal staff, and external collaborators could not rely on informal or permanent access. Veloura needed one controlled process that applied least privilege, separated requester and approver duties, and produced evidence for ongoing review.
Identity-governance designer and Entra implementer.
I created the identities and security group, configured the governance catalog and access package, tested requester and approver experiences, implemented privileged role controls, and completed an access review with documented justification.
01Requested
Captured a defined business activity and written justification from the requester.
02Approved & provisioned
Separated approval from requesting and added the approved user to the governed group.
03Privileged safely
Used eligible PIM access with MFA, a ticket, approval, and a two-hour activation limit.
04Reviewed
Revalidated continued access against business need, inactivity signals, and expiration controls.
Control design
Access Policy & Decision Evidence
The workflow ties each identity risk to an operating rule, an accountable decision maker, and evidence that can be reviewed later.
| Control objective | Operating rule | Accountability | Evidence |
|---|---|---|---|
| Business justification | Requester selects a defined activity and provides written justification | Requester | Access-package request record |
| Separation of duties | Requester cannot approve her own assignment; decision due within five days | Manager approver | Approval history and decision rationale |
| Least privilege | Access is granted through one governed group for 90 days | Resource owner | Assignment and group membership |
| Privileged administration | Eligible activation requires MFA, ticket, justification, approval, and a two-hour limit | Privileged-role approver | PIM settings and deactivation record |
| Continued need | Quarterly review considers inactivity signals and documented business purpose | Access reviewer | Review decision and completed outcome |
Lifecycle design
Microsoft 365 Identity Lifecycle & Governed Access
The lifecycle specification extends the tested Entra access-package scenario into a joiner–mover–leaver control model. Configured lab evidence is separated from designed operating requirements.
| Event | Governance requirement | Microsoft control | Validation & audit evidence | Status |
|---|---|---|---|---|
| Joiner | Provision only approved baseline and job-based access | HR trigger, group-based assignment, MFA registration, Conditional Access baseline | Approved request, group membership, sign-in and MFA records | Designed |
| Mover | Remove incompatible access before granting the new role | Group reassignment, access package, least-privilege review, PIM for elevated tasks | Before/after membership, approval, expiration, PIM activation log | Partially tested |
| Periodic review | Reconfirm continuing need and document the decision | Recurring access review using activity signals and owner judgment | Recommendation, reviewer rationale, completed review outcome | Tested |
| Leaver | Block access promptly and preserve required business records | Disable sign-in, revoke sessions, remove groups/roles/licenses, transfer ownership, retain records | Termination ticket, timestamps, revocation log, removal report, retention confirmation | Designed |
Control boundary: Conditional Access and the full joiner/leaver workflow are documented designs for implementation and testing; the portfolio does not claim they operated in production.
The package combined the marketing-data group with a required business-purpose question, requester justification, manager approval, a five-day decision window, 90-day expiration, and quarterly review controls.
Maya reviewed Sofia's request, business purpose, and justification before approving the 90-day assignment.
Approval automatically provisioned Sofia into the governed group, connecting the business decision to a technical access result.
Maya was eligible—not permanently active—for Identity Governance Administrator. Activation required MFA, justification, a ticket, and Admin approval.
After the work was completed, the privileged role was deactivated before its maximum duration.
Microsoft recommended denial based on inactivity. Maya compared that signal with Sofia's documented Q4 responsibility and approved continued access.
The administrative view recorded one approval, zero unreviewed users, and zero denials—closing the loop from request to review.
90 days
configured access-package term
5 days
configured approval deadline
2 hours
maximum PIM activation window
1 review
completed lab access decision
Governance outcome
A complete control lifecycle—not just a collection of Entra settings.
- Created a repeatable request path with structured business-purpose evidence and manager approval.
- Connected approval to automatic security-group membership and a defined 90-day expiration.
- Reduced standing privilege through eligible PIM assignment, MFA, ticketing, approval, and early deactivation.
- Used an access review to compare system recommendations with documented business need and record an accountable decision.
Evidence note: Veloura Beauty Group and the named personas are fictional. The configuration, request, approval, PIM activation, deactivation, and access-review evidence were created and validated in a Microsoft Entra lab tenant.
Project 03 · Enterprise Data Governance & Trusted DataCreating accountable, trusted and traceable enterprise dataOpen case study
Program design + selected lab evidence · Enterprise Data Governance
Building accountability around Veloura's most important data
I designed a practical governance operating model that connected business ownership, stewardship, shared definitions, data-quality rules, issue resolution, and performance monitoring. The result was a repeatable decision system for product, customer, sales, inventory, supplier, and loyalty data.
Teams used the same data differently—and no one owned the final decision.
Marketing, retail, e-commerce, finance, and supply chain relied on overlapping data but used inconsistent definitions and correction practices. Quality problems moved between teams without a named owner, deadline, or escalation path.
Enterprise Data Governance Lead.
I created the charter, defined decision rights, assigned owners and stewards, established critical data elements and business definitions, designed quality rules and issue tiers, and selected KPIs and KRIs for executive oversight.
01Chartered
Defined scope, principles, authority, outcomes, and governance forums.
02Assigned
Named accountable owners, operational stewards, and technical custodians.
03Standardized
Established shared terms, critical data elements, and testable quality rules.
04Measured
Created issue SLAs, escalation thresholds, KPIs, KRIs, and review cadence.
Technical governance expansion · in development
Architecture, modeling, mapping, catalog and control evidence
The next evidence cycle extends the existing Fabric and SQL work into a traceable chain from source field to governed use. Completed evidence will replace the “in development” labels only after it is built, tested, and captured.
Document major business entities; define keys, attributes, cardinality, normalization decisions, and SQL table structures; then show a sales star schema with fact, dimension, grain, and a justified bridge table.
Trace priority fields from operational sources to curated tables and reporting models with transformations, owner, steward, classification, CDE status, and quality rule.
Register and scan representative assets; enrich metadata; apply automated and custom classifications; connect glossary terms, owners, stewards, domains, data products, quality context, lineage, and impact analysis.
Execute duplicate, null, referential-integrity, valid-value, range, reconciliation, PII, CDE, completeness, accuracy, consistency, uniqueness, timeliness, and exception-reporting controls.
| Evidence area | Already present | Still to build or capture | Status |
|---|---|---|---|
| Data architecture | Raw-to-curated Fabric Lakehouse path and downstream report | Formal source-to-platform-to-catalog architecture with control overlays | In development |
| Data modeling | dim_product to fact_sales one-to-many semantic relationship | Conceptual model, logical ERD, physical DDL, normalization rationale, expanded star schema, bridge-table example | In development |
| SQL controls | Executed uniqueness, referential-integrity, and financial-output completeness evidence; documented control library | Execute remaining quality, reconciliation, PII, CDE, retention, and exception controls with remediation and retest | Partially executed |
| Purview catalog | Information-protection controls and discovery of the Fabric workspace and Lakehouse | Scan evidence, schema/column metadata, classifications, glossary, CDEs, domain, data product, quality context, lineage, impact analysis, and issue closure | In development |
| Privacy & AI integration | PIA, rights, retention, AI risk, boundaries, oversight, and monitoring designs | Connect mapped fields and lineage to minimization, purpose, retention, rights, AI suitability, quality, and bias controls | In development |
Artifact 01
Enterprise Data Governance Charter
A concise mandate that turns governance from a voluntary activity into an accountable business process.
Increase trust in Veloura's decision-critical data by establishing ownership, consistent definitions, quality expectations, and evidence-based oversight.
Customer, product, shade, sales, inventory, supplier, and loyalty data used across e-commerce, boutiques, reporting, and future AI services.
The Data Governance Council approves enterprise definitions, prioritizes cross-functional issues, and resolves ownership disputes.
Accountability follows business use. Definitions are shared. Controls are risk-based. Decisions are documented. Exceptions expire.
Steward working group biweekly; Data Governance Council monthly; executive scorecard quarterly.
Named ownership, approved CDE definitions, fewer recurring defects, issue SLA compliance, and traceable governance decisions.
Artifact 02
Operating Model & Decision Rights
A federated model keeps enterprise standards centralized while placing day-to-day accountability with the business domains that understand the data.
| Governance activity | Executive Sponsor | Council | Data Owner | Data Steward | Custodian |
|---|---|---|---|---|---|
| Approve enterprise policy | A | R | C | C | I |
| Approve business definition | I | C | A | R | C |
| Set data-quality threshold | I | C | A | R | C |
| Investigate quality defect | I | I | A | R | R |
| Approve material exception | I | A | R | C | C |
R Responsible · A Accountable · C Consulted · I Informed
Artifact 03
Policy Hierarchy, Decisions & Exceptions
A controlled hierarchy connects executive intent to repeatable work while preserving accountable, time-bound exceptions.
States mandatory principles, scope, accountability, and risk boundaries; approved by the Council and executive sponsor.
Define classification, access, quality, retention, privacy, and AI requirements; owned by the relevant governance lead.
Translate standards into requests, approvals, reviews, tests, escalation, evidence retention, and closure steps.
Configuration records, decisions, logs, test results, findings, metrics, and acknowledgments prove operation.
Exception path
Requester documents need and compensating controls → owner assesses impact → risk/privacy/security review as applicable → Council approves or rejects → exception receives an owner and expiration date → steward monitors → owner closes, renews, or escalates before expiry.
Artifact 04
Business Glossary & Critical Data Elements
Six priority elements connect a shared business meaning to a named owner, a quality expectation, and a downstream decision.
Persistent identifier for one sellable product record.
Owner: Merchandising · Must be unique and presentApproved identifier for a color variant within a product line.
Owner: Product · Must map to one active productEnterprise identifier for one recognized customer profile.
Owner: Customer Experience · Must be uniqueCurrent permission state for a defined processing purpose.
Owner: Privacy · Must include purpose and timestampGross sales less discounts, returns, and approved adjustments.
Owner: Finance · Must reconcile to source totalsUnits physically available at a location at the recorded time.
Owner: Supply Chain · Must be nonnegative and timelyArtifact 05
Metadata & Business Lineage
Business and technical metadata connect source evidence to governed definitions, transformations, reports, and the future AI service.
E-commerce, boutiques, loyalty, product, supplier, and consent systems remain the systems of record.
Catalog entries capture definition, owner, steward, classification, quality rule, and approved use.
Documented logic standardizes product values, resolves identifiers, and calculates approved sales measures.
Power BI reporting and the beauty advisor inherit approved definitions, quality status, and use restrictions.
Business name, definition, domain, owner, steward, source, classification, retention, quality rule, and approved consumers.
Material definition, source, transformation, or use changes require owner approval, impact analysis, and updated lineage before release.
Artifact 06
Master & Reference Data Stewardship
Shared codes and golden identifiers are governed as reusable enterprise assets rather than corrected independently in each report.
| Data asset | Authoritative source | Stewardship control | Change evidence | Downstream use |
|---|---|---|---|---|
| Product master | Product information system | Unique Product ID; duplicate and survivorship review | Approved product-change record | Commerce, inventory, reporting, AI advisor |
| Shade reference list | Product taxonomy | Approved code, description, active status, and parent product | Taxonomy version and owner approval | Catalog, search, reporting, recommendations |
| Sales channel codes | Finance reference table | Controlled values for e-commerce, boutique, and partner channels | Effective date and reconciliation test | Revenue reporting and allocation |
| Consent-purpose codes | Privacy preference center | Purpose, lawful basis, status, jurisdiction, and effective period | Privacy approval and audit trail | Marketing, analytics, and AI eligibility |
Artifact 07
Data Quality Rules & Scorecard
Each rule is measurable, owned, and linked to the business decision it protects. Each percentage is the share of records in an illustrative monthly evaluation that passed the stated rule.
| Critical element | Dimension | Business rule | Target | Illustrative result |
|---|---|---|---|---|
| Product ID | Uniqueness | No duplicate active product identifier | 100% | 100% · Met |
| Shade Code | Validity | Maps to one active parent product | ≥ 99.5% | 99.2% · Watch |
| Consent Status | Completeness | Purpose and captured timestamp are present | 100% | 98.6% · Escalate |
| Net Revenue | Accuracy | Calculated value reconciles to approved components | 100% | 100% · Met |
| On-hand Quantity | Timeliness | Location update is less than four hours old | ≥ 98% | 97.4% · Watch |
How to read the results: “Met” reached the approved target; “Watch” missed a noncritical threshold and requires monitoring; “Escalate” missed a mandatory threshold and requires owner action. These percentages illustrate the scorecard design—they are not production measurements.
Artifact 08
Issue Management & Escalation
A closed-loop process prevents known defects from becoming permanent workarounds.
Record the affected element, rule, source, evidence, reporter, and business impact.
Confirm ownership, severity, root-cause hypothesis, workaround, and target date.
Correct the data and underlying process or system—not merely the report output.
Retest the rule, attach evidence, document residual risk, and record owner acceptance.
Critical · 1 business day
Regulatory, privacy, financial, or material customer harm. Immediate owner and sponsor escalation.
High · 5 business days
Material reporting or operational impact. Owner action plan required.
Standard · 15 business days
Contained defect with an approved workaround. Steward monitors through closure.
Artifact 09
Governance KPIs & KRIs
Illustrative quarterly targets distinguish governance adoption and control performance from unresolved business risk. Percentages show the share of in-scope items meeting the condition; whole numbers are counts during the quarter.
priority domains with an approved owner and steward
critical data elements meeting approved thresholds
issues resolved within the assigned SLA
critical elements without an accountable owner
repeated high-severity defects per quarter
expired exceptions still operating without review
Governance outcome
A durable decision system—not a collection of disconnected templates.
- Established clear accountability from executive sponsorship through operational stewardship and technical custody.
- Connected business definitions and critical data elements to owners, quality rules, and downstream decisions.
- Created a repeatable issue lifecycle with risk-based severity, deadlines, evidence, escalation, and closure criteria.
- Defined measurable KPIs and KRIs that show both governance adoption and remaining data risk.
Case-study note: Veloura Beauty Group and the illustrative scorecard results are fictional. The governance framework, decision rights, definitions, rules, issue process, and metrics were designed as original portfolio artifacts using enterprise data-governance practices.
Executed technical evidence · Fabric + Power BI
Turning inconsistent product data into trusted decisions
I translated a reporting need into a controlled data workflow: preserve the original evidence, profile and correct quality defects, create a trusted dimensional model, validate its calculations, and present the results in an executive-ready Power BI report.
Product-data defects weakened confidence in sales reporting.
Inconsistent categories, missing product status values, and the risk of unmatched records could distort revenue, profitability, and product-performance decisions. Veloura needed a repeatable path from source data to trusted reporting.
Data Governance and Quality Analyst.
I profiled the source data, documented quality rules, created the raw-to-curated transformation, designed the dimensional model and measures, validated the results with SQL, and used Power BI to communicate governed results.
01Preserved
Retained the raw product and transaction evidence unchanged.
02Profiled & curated
Identified defects, standardized values, and assigned missing status as UNKNOWN.
03Modeled & validated
Built the product-to-sales model and tested keys and calculations with SQL.
04Communicated
Turned governed measures into focused business insights in Power BI.
Five governed KPIs and three decision-focused visuals give leadership a clear view of revenue, gross profit, margin, transaction volume, regional performance, category performance, and the remaining product requiring review. Select the image to view it full size.
The original product data remains available as veloura_products_raw, while standardized corrections are written to veloura_products_curated. Dimensional and fact tables create a distinct trusted reporting layer.
Rather than assuming the transformation worked, I tested transaction uniqueness, product-key matching, and completeness of the financial output fields. The evidence confirmed 120 unique transactions, zero unmatched keys, and zero records with missing financial outputs.
An active one-to-many relationship connects dim_product to fact_sales. Reusable measures for net revenue, gross profit, and gross margin keep KPI logic consistent across visuals.
120 records
transactions tested in the lab dataset
0 records
transactions with unmatched product keys
0 records
transactions with missing financial outputs
1 product
product record flagged for review
Business outcome
A reporting result leaders can use—and trace back to controlled data.
- Preserved raw evidence while creating a separate curated dataset for reporting.
- Standardized inconsistent product values and made missing status visible as UNKNOWN instead of silently dropping it.
- Validated record matching and financial logic before presenting the results.
- Produced consistent revenue and profitability measures plus a visible exception for the one product still requiring review.
Technical control evidence
SQL Governance Control Library
Focused SQL controls connect a governance or privacy requirement to the records tested, exceptions returned, accountable remediation, and retest evidence. Status labels distinguish executed lab evidence from controls designed for the next test cycle.
The retained Fabric evidence uses COUNT, COUNT DISTINCT, LEFT JOIN, CASE, conditional aggregation, null checks, SUM, and ROUND. It validated 120 unique transactions, zero unmatched product keys, and zero records with missing financial outputs in the lab dataset.
The remaining controls will be executed against Veloura data, assigned to an owner or steward, remediated where needed, and rerun. Designed controls are not presented as completed test results.
| ID & control | Governance requirement | SQL capability demonstrated | Status |
|---|---|---|---|
| DQ-01 · Duplicate Product Detection | Each active product must have one unique governed identifier | GROUP BY, HAVING, duplicate exception output | Designed |
| DQ-02 · Required-Field Completeness | Decision-critical product fields must be populated | Null handling, conditional aggregation, completeness rate | Designed |
| DQ-03 · Orphaned Sales Detection | Every sales transaction must resolve to an approved product | LEFT JOIN, null exception test, referential integrity | Executed |
| DQ-04 · Product Status Validation | Status must match the approved reference domain | CTE, anti-join logic, business-rule validation | Designed |
| DQ-05 · Revenue Reconciliation | Source, curated, and reporting totals must agree | Multiple CTEs, UNION ALL, aggregation, variance calculation | Designed |
| PR-01 · Latest Consent Determination | Only the current purpose-specific consent decision may authorize use | CTE, ROW_NUMBER window function, date ordering | Designed |
| PR-02 · Retention Exception Detection | Records beyond the approved retention rule require disposition or exception | Date calculations, CASE, policy-based filtering | Designed |
| PR-03 · Deletion Verification | Approved deletion must be verified across connected systems | Cross-table checks, UNION ALL, residual-record identification | Designed |
How each control becomes governance evidence
Requirement → Data element and owner → SQL test → Exception record → Business risk → Remediation owner and due date → Retest and closure evidence. PR-01 through PR-03 technically validate the consent, retention, and deletion requirements defined in Project 04.
Download the documented SQL control libraryEvidence boundary: DQ-03 and the financial-field completeness checks are supported by captured Fabric execution evidence. The other queries are documented control designs awaiting execution against the corresponding Veloura tables; no findings or closure results are claimed until that work is completed.
Evidence note: The dashboard is the communication layer—not the entire project. The case study demonstrates the full chain from source preservation and data-quality rules through SQL validation, dimensional modeling, governed measures, and business reporting.
Project 05 · AI Governance & Responsible Data UseGoverning an AI system before and after launchOpen case study
Program design case study · AI Governance & Responsible Data Use
Governing Veloura's AI beauty advisor before launch
I translated a promising personalization concept into a controlled launch decision. The governance package defined what the advisor could do, what data it could use, where people remained accountable, how risks were tested, and which signals could pause or stop the service.
Personalized beauty guidance could improve discovery—but also create trust risk.
Veloura wanted an advisor that could recommend products using customer preferences, product attributes, shade information, and purchase history. Without clear boundaries, the same experience could create bias, privacy, transparency, safety, and overreliance concerns.
AI-governance lead and control designer.
I created the use-case record, completed the impact assessment, defined allowed and prohibited uses, assigned accountable owners, designed preventive and detective controls, established human escalation paths, and documented a conditional launch decision.
01Inventoried
Recorded purpose, users, data, outputs, owners, dependencies, and lifecycle status.
02Assessed
Evaluated privacy, fairness, transparency, safety, security, and operational impact.
03Controlled
Defined data boundaries, human oversight, testing, documentation, and launch gates.
04Monitored
Established performance, harm, complaint, drift, incident, and review thresholds.
Artifact 01
AI System Record
A single inventory entry establishes accountability before assessment or launch.
Conversational product discovery and recommendation experience.
Suggests products; it does not make medical, employment, credit, or eligibility decisions.
Customer-facing recommendations with a staffed support escalation path.
Business owner supported by Privacy, Legal, Data Governance, Security, and Product.
Only governed attributes required for the documented recommendation purpose.
Release is limited until launch gates and monitoring evidence are satisfied.
Artifact 02
AI Impact & Risk Assessment
Risks are connected to affected stakeholders, evidence requirements, controls, and accountable owners.
| Risk | Potential impact | Inherent risk | Required treatment | Residual target |
|---|---|---|---|---|
| Unequal recommendation quality | Poorer outcomes across skin tones, hair textures, or customer segments | High | Representative test sets, subgroup evaluation, documented acceptance threshold | Moderate |
| Inappropriate sensitive inference | Privacy intrusion or discriminatory personalization | High | Prohibited-attribute rules, data minimization, prompt and output filtering | Moderate |
| Misleading or unsafe guidance | Customer harm, complaints, or misplaced reliance | High | Non-medical boundary, safety tests, clear disclosure, human escalation | Moderate |
| Unclear automated interaction | Reduced trust and inability to challenge an output | Moderate | AI disclosure, explanation cues, feedback and appeal route | Low |
| Model or data drift | Declining relevance, quality, or control effectiveness | Moderate | Version inventory, change review, monitored thresholds, rollback plan | Low |
Artifact 03
Data & Decision Boundaries
Clear boundaries make the control understandable to product, data, legal, and customer-support teams.
- Recommend products using current product attributes and consented preferences.
- Explain the recommendation factors in plain language.
- Offer an easy route to a human beauty advisor or customer support.
- Collect feedback for governed quality improvement.
- No diagnosis, treatment, or medical claims.
- No inference of protected traits, health conditions, or emotional state.
- No use of customer content outside the disclosed purpose.
- No silent expansion into pricing, eligibility, employment, or credit decisions.
Artifact 04
Responsible AI Control Matrix
Each principle is translated into an operating control, evidence, and accountable owner.
Compare recommendation relevance and failure patterns across representative customer and product segments.
Evidence: test results · Owner: Model RiskUse only approved attributes with documented consent, retention, and role-based access requirements.
Evidence: data map & access review · Owner: PrivacyTell users they are interacting with AI and provide meaningful recommendation factors and limitations.
Evidence: UX copy & testing · Owner: ProductTest prohibited advice, high-risk prompts, refusals, escalation, and documented rollback behavior.
Evidence: red-team log · Owner: AI ProductAssign business, risk, data, privacy, security, and incident owners with clear escalation authority.
Evidence: RACI & decision log · Owner: Executive SponsorReassess material model, data, vendor, prompt, or use-case changes before release.
Evidence: version record · Owner: TechnologyArtifact 05
Decision Rights & Lifecycle Gates
Named decision makers prevent responsibility from disappearing between product, technology, data, privacy, security, and risk teams.
| Gate | Required evidence | Decision |
|---|---|---|
| Intake | System record, purpose, owner, users, data, vendor, and prohibited uses | Accept, redirect, or reject |
| Pre-pilot | Impact assessment, control design, testing plan, notices, and escalation path | Conditional pilot approval |
| Expansion | Pilot KPIs/KRIs, subgroup results, complaints, incidents, and residual-risk acceptance | Expand, remediate, pause, or stop |
| Material change | Updated inventory, impact analysis, testing, lineage, and control evidence | Approve before release |
Artifact 06
Monitoring, Escalation & Stop Criteria
Metrics are paired with thresholds and actions so monitoring can change an operating decision.
share of evaluated recommendations meeting the approved relevance rubric
largest allowed relevance-rate difference between evaluated subgroups
share of controlled test prompts producing unsafe or prohibited responses
share of material system changes reviewed before release
Threshold basis: These are proposed pilot decision thresholds for the fictional advisor, not operating results. Before use, sample sizes, subgroup coverage, test prompts, scoring rubrics, and escalation tolerances would be approved by the AI Governance Council.
Pause or stop the service when:
a severe safety event occurs; a prohibited data use is detected; a fairness threshold is exceeded twice; an unresolved critical vulnerability exists; or a material change is released without approval. Product may pause the service immediately, while the AI Governance Council records the restart decision.
Artifact 07
AI Obligations & Standards Crosswalk
A requirements register converts laws, standards, and voluntary frameworks into accountable evidence without claiming that one framework automatically establishes legal compliance.
| Source | Relevant expectation | Veloura control | Evidence owner |
|---|---|---|---|
| NIST AI RMF | Govern, map, measure, and manage AI risk throughout the lifecycle | Inventory, impact assessment, testing, monitoring, escalation, and decision records | AI Governance Lead |
| ISO/IEC 42001 | Management-system accountability, objectives, risk treatment, documented operation, and improvement | AI policy, assigned roles, lifecycle gates, control review, corrective action | AI Governance Council |
| EU AI Act screening | Determine role, jurisdiction, prohibited practices, risk category, transparency, and provider obligations | Legal applicability assessment before launch or material expansion | Legal & Privacy |
| Privacy requirements | Purpose limitation, minimization, transparency, individual rights, retention, and security | Approved-data boundary, consent check, notice, retention rule, access review | Privacy Officer |
Artifact 08
Third-Party AI Risk Review
The external model or service provider is assessed as part of Veloura's control environment—not treated as a transfer of accountability.
Confirm storage location, subprocessors, encryption, retention, deletion, training use, and tenant isolation.
Evidence: contract terms & architecture responseReview independent assurance, vulnerability practices, incident history, resilience, and notification commitments.
Evidence: assurance report & remediation recordRequire version notice, limitations, evaluation results, material-change review, and a documented rollback path.
Evidence: model documentation & change logEvaluate permitted use, output rights, confidentiality, indemnity, regulatory cooperation, and audit rights.
Evidence: legal review & approved exceptionsAssess dependency, portability, service failure, alternate operation, data return, and verified deletion.
Evidence: continuity and exit planApprove, conditionally approve, remediate, or reject—with an owner, deadline, residual risk, and review date.
Evidence: vendor-risk decision recordProposed executive decision record
Conditional pilot decision pending evidence
The advisor may proceed only after the required controls are evidenced. Expansion would require review of pilot monitoring, incidents, complaints, subgroup results, and any material system changes.
- Approve AI disclosure and the non-medical limitation
- Complete representative fairness and safety testing
- Validate consent, minimization, retention, and access controls
- Exercise human escalation and incident response
- Record the named owner's residual-risk and launch decision
Governance outcome
A defensible launch decision with clear accountability and evidence.
- Converted an AI concept into an inventoried, owned, and purpose-limited system record.
- Connected material risks to preventive, detective, and responsive controls.
- Defined human decision boundaries, escalation authority, pause criteria, and a documented approval path.
- Created measurable oversight that supports review throughout the AI lifecycle—not only before launch.
Case-study note: Veloura Beauty Group, its beauty advisor, and the illustrative thresholds are fictional. The governance artifacts were designed as original portfolio work and organized around the NIST AI Risk Management Framework functions: Govern, Map, Measure, and Manage.
In development
AI assessment and control-validation exercise
The next evidence cycle will complete one use-case risk assessment, execute a focused test log, document the approval decision and conditions, and simulate one monitoring-threshold breach through escalation or stop action. No operating result is claimed until the exercise is completed.
Project 04 · Privacy Operations & ComplianceTurning privacy requirements into operating controlsOpen case study
Program design case study · Privacy Operations & Compliance
Turning privacy requirements into operating controls
I designed Veloura's privacy program from an unstructured fictional current state: establish accountability, determine which requirements apply, inventory processing, embed privacy review into change, operate individual rights and data lifecycle controls, govern vendors, prepare for incidents, and report evidence to leadership. The artifacts show the work product behind that program—not a claim of legal practice or production employment.
Document purposes, people, data categories, systems, recipients, retention, and accountable owners.
Screen new or changed processing for necessity, proportionality, sensitive data, and heightened impact.
Coordinate verified requests, searches, exceptions, responses, deletion, and defensible records.
Evaluate third parties, trace decisions to evidence, track exceptions, and monitor overdue action.
Privacy artifact 01
Privacy Program Charter & Operating Model
The charter defines why the program exists, who makes decisions, how privacy work enters business processes, and what evidence reaches the Governance Council. It prevents privacy from becoming an isolated legal checklist.
Maintain the processing inventory, interpret requirements with counsel, assess change, operate rights, govern lifecycle and vendors, and oversee remediation.
The executive sponsor sets direction; the Privacy Lead coordinates; Legal interprets obligations; Security, Data Owners, Stewards, and Process Owners implement controls.
New processing enters through a screening gate. Elevated risk receives a PIA, control conditions, accountable approval, a review date, and tracked exceptions.
Monthly operations review addresses requests, assessments, incidents, vendor findings, deletion failures, training, exceptions, and overdue remediation; material risk escalates to the council.
Privacy artifact 02
Data Inventory & Processing Record
A RoPA-style inventory connects processing purpose to data categories, systems, sharing, retention, and accountable ownership. It also provides the metadata foundation for rights requests, protection rules, risk review, and deletion.
| Processing activity | Purpose & people | Personal data | Systems & sharing | Lifecycle & owner |
|---|---|---|---|---|
| Loyalty membership | Operate rewards and preferences · customers | Identity, contact, purchase history, preferences, consent | CRM, loyalty app, email provider | Membership plus policy-defined period · Customer Experience |
| Order fulfillment | Process purchases and returns · customers | Contact, shipping, order, payment token | Commerce, payment, fulfillment partners | Transaction schedule · Commerce Operations |
| Personalized marketing | Deliver permitted offers · customers and prospects | Contact, consent, engagement, segments | CRM, consent platform, marketing provider | Consent/objection trigger · Marketing |
| Virtual beauty advisor | Provide product guidance · app users | Preferences, conversation inputs, recommendation events | App, governed data product, AI provider | Purpose-limited schedule · Digital Experience |
Privacy artifact 03
U.S. Privacy Applicability & Requirements Matrix
This is the analysis step before control design: identify the people, data, activity, location, and sector involved; determine potential federal and state obligations with qualified counsel; then translate confirmed requirements into owned actions and evidence.
| Requirement area | Applicability question | Operational response if triggered | Evidence |
|---|---|---|---|
| Consumer transparency | What personal data is collected, used, disclosed, sold, or shared—and what promises has Veloura made? | Map actual practices to clear notices; route material changes through review and approval | Notice inventory, processing record, version and approval history |
| State consumer rights | Which state law covers the person, entity, data, and activity? | Configure applicable access, correction, deletion, portability, appeal, and opt-out paths | Legal matrix, request log, decision record, response proof |
| Sensitive or children's data | Does processing involve defined sensitive data, biometrics, precise location, health-related data, or children? | Apply heightened screening, minimization, authorization/consent rules, access limits, and launch conditions | Data classification, PIA, consent record, control test |
| Sector and relationship | Do health, financial, consumer-reporting, communications, employment, or other sector rules apply? | Engage counsel and the responsible function; add the sector-specific control set rather than assuming general rules are sufficient | Applicability decision, control mapping, accountable sign-off |
| Incident notification | Which people, data types, systems, states, regulators, contracts, and time requirements are implicated? | Preserve facts, perform legal notification analysis, document the decision, notify where required, and remediate | Incident chronology, assessment, approvals, notices, corrective actions |
Privacy artifact 04
Privacy Impact Assessment
A structured assessment moves a new initiative from description to decision. It records purpose, necessity, data flows, affected people, risk, controls, owner, conditions, and review date.
Define the business outcome, establish why each data element is needed, and reject speculative collection.
Identify sensitive data, vulnerable groups, unexpected use, exclusion, surveillance, and loss-of-control concerns.
Map sources, systems, transformations, recipients, locations, privileges, retention, and deletion dependencies.
Assign controls and owners, record residual risk, set review triggers, and preserve accountable approval evidence.
Privacy artifact 05
Notice, Consent & Preference Governance
The control connects public promises to actual processing. Each notice or preference mechanism has an owner, purpose, audience, data use, sharing description, effective date, change trigger, and test evidence.
Reconcile notices against the processing inventory, system behavior, vendors, cookies, mobile features, and AI use.
Use clear, layered language; distinguish required processing from optional choices; avoid misleading interfaces.
Record the choice, communicate it to connected systems and vendors, apply suppression where needed, and prevent unauthorized reuse.
Submit representative choices, inspect downstream changes, test withdrawal and opt-out paths, and retain dated evidence.
Trigger reassessment when purposes, data, recipients, technology, jurisdictions, or material representations change.
Privacy artifact 06
Individual Rights Request Workflow
The workflow treats a request as a governed case: securely validate the requester, identify the applicable right and deadline, locate relevant data, coordinate review, deliver the response, manage appeal where required, and retain only the evidence needed to demonstrate completion.
Log request type, scope, channel, date, jurisdiction, and target date.
Use proportionate identity checks and protect the request record itself.
Search systems and vendors using the processing inventory and data map.
Validate matches, dependencies, legal holds, exceptions, authorized-agent status, and third-party data.
Provide, correct, restrict, delete, opt out, or explain the documented outcome securely.
Record approvals, actions, response proof, appeal handling where applicable, and minimal audit evidence.
Privacy artifact 07
Retention & Defensible Deletion Matrix
Illustrative Veloura policy rules use an event-based trigger, an accountable owner, and a verified disposition. Final periods would be validated against applicable law, contracts, litigation holds, and business requirements.
| Record class | Trigger | Illustrative rule | Owner | Disposition evidence |
|---|---|---|---|---|
| Customer profile & consent | Account closure, withdrawal, or inactivity | Retain only for the approved purpose and applicable obligation | Customer Experience | Consent history plus deletion/anonymization log |
| Orders & financial records | Transaction close | Follow approved finance and legal schedule | Finance | Scheduled deletion report and exception record |
| Marketing prospect data | Objection, withdrawal, or campaign inactivity | Suppress contact where required; delete unnecessary profile data | Marketing | Suppression and deletion confirmation |
| Support records | Case closure | Separate necessary case evidence from redundant attachments | Customer Care | Disposition log and sampled control test |
| AI interaction logs | Session or pilot close | Minimize and aggregate; retain identifiable detail only when justified | Digital Experience | Aggregation/deletion job result and review |
Privacy artifact 08
Vendor Data-Protection Review
A single review connects procurement to privacy, security, information governance, and responsible AI—before personal data is shared.
Purpose, instructions, prohibited secondary use, AI training, and commercialization limits.
Data categories, locations, subprocessors, transfers, interfaces, and onward disclosure.
Access, encryption, logging, resilience, incident notification, cooperation, and assurance evidence.
Return, deletion, backup expiry, portability, transition support, and verified termination.
Approve, condition, remediate, or reject—with owner, due date, exception, and reassessment trigger.
Privacy artifact 09
Privacy Incident & Breach Decision Workflow
The workflow separates rapid operational response from the legal determination of whether notification is required. It preserves facts, ownership, reasoning, approvals, communications, and corrective action.
Open the case, limit exposure, protect affected people, and preserve volatile evidence.
Determine what happened, when, systems, data, people, locations, recipients, and protections involved.
Security, Privacy, Legal, and the business owner evaluate harm, applicability, contracts, and notification duties.
Document notification and escalation decisions, accountable approvals, rationale, audiences, and timing.
Coordinate accurate notices, regulator or partner communications, support channels, and message control.
Correct causes, validate closure, update risk and controls, track actions, and report themes to oversight.
Operational measures
Evidence that privacy work is moving—not merely documented.
Illustrative dashboard measures would be validated against Veloura's policy, jurisdiction, and operating capacity.
share of processing records with a named owner
rights requests past the applicable response deadline
share of high-risk changes screened before launch
vendor exceptions operating past their approved expiration
Case-study note: These are original, illustrative privacy-program artifacts for fictional Veloura Beauty Group—not legal advice, an exhaustive U.S. law survey, or a claim of universal compliance. Applicability, legal basis, response periods, notices, consent, retention, transfers, incident notification, and individual rights vary by jurisdiction and would be validated with qualified counsel.
In development
Privacy operations and technical-validation exercises
The next evidence cycle will complete one privacy impact assessment, one individual-rights request tabletop, and one vendor-review decision. The SQL control library will then validate latest consent, retention exceptions, and deletion across connected records, with findings, accountable remediation, and retest evidence documented.
Portfolio-wide assurance layerRisk → Requirement → Control → Test → Evidence → Finding → RemediationOpen assurance evidence
Portfolio-wide assurance layer · data & information risk
Connecting governance decisions to enterprise risk
I consolidated risks from data quality, privacy, information protection, governed access, reporting, vendors, and AI into one decision system. The framework establishes appetite and tolerance, evaluates risk scenarios, assigns treatment and control ownership, tests effectiveness, and reports residual exposure to accountable leaders.
The Executive Risk Committee sets appetite; business owners accept residual risk; the risk function challenges; internal audit provides independent assurance.
Assets, threats, vulnerabilities, likelihood, and business impact are evaluated before and after controls.
Mitigate, avoid, transfer, or accept—then track actions, exceptions, evidence, and overdue exposure.
KRIs, control failures, incidents, and tolerance breaches escalate through a defined reporting cadence.
Artifact 01
Risk Appetite, Tolerance & Escalation
Qualitative appetite statements are paired with measurable thresholds so governance bodies know when action or acceptance is required.
| Risk category | Appetite | Tolerance trigger | Required decision |
|---|---|---|---|
| Privacy & regulated data | Very low | Any confirmed unauthorized disclosure of regulated personal data | Immediate incident escalation and executive notification |
| Privileged access | Low | Any unapproved standing administrator or overdue critical review | Remove access or obtain documented time-bound exception |
| Decision-critical data quality | Low | Any critical element below threshold for two reporting cycles | Owner treatment plan and council escalation |
| AI customer harm | Very low | Severe safety event, prohibited inference, or repeated fairness breach | Pause service pending investigation and restart approval |
| Innovation & pilot uncertainty | Moderate | Residual exposure above approved pilot boundary | Reduce scope, add controls, transfer, or reject launch |
Artifact 02
Enterprise Technology Risk Register
Each scenario connects business impact to inherent exposure, control response, accountable ownership, and a target residual position.
| ID & scenario | Inherent | Primary response & controls | Owner | Residual |
|---|---|---|---|---|
| R-01 · Customer PII is shared outside approved channels | High | Mitigate · classification, labeling, DLP, alert review | Information Protection | Moderate |
| R-02 · Stale or excessive access exposes marketing data | High | Mitigate · access package, approval, expiration, review | Marketing Data Owner | Low |
| R-03 · Standing privilege enables unauthorized change | High | Mitigate · PIM eligibility, MFA, approval, time limit | Identity Governance | Low |
| R-04 · Poor product or consent data distorts decisions | High | Mitigate · CDE rules, scorecard, issue SLA, reconciliation | Domain Data Owner | Moderate |
| R-05 · Incorrect reporting drives financial action | Moderate | Mitigate · controlled transformations, key tests, calculation validation | Finance Analytics | Low |
| R-06 · AI produces biased, unsafe, or misleading guidance | High | Mitigate/avoid · use boundaries, testing, monitoring, human escalation, stop criteria | VP, Digital Experience | Moderate |
| R-07 · AI provider failure or change weakens controls | High | Transfer/mitigate · due diligence, contract controls, change notice, exit plan | Vendor Risk | Moderate |
Rating key: Inherent risk is the exposure before controls; residual risk is the exposure expected after the listed controls. Low, Moderate, and High are qualitative judgments based on the combined likelihood and business impact in this fictional assessment.
Artifact 03
Control Testing & Findings
Testing distinguishes whether a control is appropriately designed from whether it operated as intended, while preserving exceptions and corrective action.
| Control tested | Procedure & evidence | Design | Operation | Result & response |
|---|---|---|---|---|
| Sensitivity-label publication | Inspected label scope, protection settings, publishing policy, and rollout status | Effective | Monitor | Simulation/sync evidence retained; validate propagation before enforcement claim |
| Governed access lifecycle | Sampled request, approval, group provisioning, PIM deactivation, and review decision | Effective | Effective | No exception in tested lab scenario |
| Reporting-data validation | Tested transaction uniqueness, unmatched keys, and financial-field completeness | Effective | Effective | 120 unique transactions; zero unmatched keys; zero records with missing financial outputs |
| AI launch governance | Reviewed required evidence against pilot gates and stop criteria | Effective | Not yet operated | Conditional pilot only; operating-effectiveness testing follows monitored use |
Artifact 04
Risk-to-Control & Evidence Map
The matrix shows the consulting through-line: a material risk becomes a policy requirement, an operating procedure, a technical or process control, a test, and retained evidence.
| Risk | Policy / standard | Procedure | Control | Test & evidence |
|---|---|---|---|---|
| R-01 · Sensitive data leaves approved channels | Classification & handling standard | Label, share, monitor, investigate | Purview label, DLP, retention | Inspect configuration; simulate PII match; retain policy and rollout evidence |
| R-02/03 · Excessive access or standing privilege | Identity lifecycle & least-privilege standard | Request, approve, provision, review, revoke | Groups, access package, MFA, PIM, access review | Sample approval, membership, activation/deactivation, and review records |
| R-04/05 · Poor data drives incorrect decisions | Data quality & reporting standard | Profile, validate, escalate, correct, reconcile | Quality rules, curated model, SQL checks, scorecard | Retain rule results, issue record, reconciliation query, and report evidence |
| Privacy rights or retention failure | Privacy operations & retention standard | Verify, search, review, respond, delete, evidence | RoPA, PIA, DSR workflow, schedule, vendor review | Run tabletop request; inspect approvals, exceptions, response, and deletion proof |
| R-06/07 · Harmful AI behavior or vendor change | Responsible AI & third-party standard | Inventory, assess, test, approve, monitor, pause | Risk tier, use boundaries, gates, human escalation, stop criteria | Review test log, decision record, monitoring thresholds, incident and restart evidence |
Executive risk report
A decision view—not a compliance inventory
This illustrative snapshot summarizes the seven scenarios in the risk register above. Monthly operational reporting and quarterly executive review would focus attention on exposure above tolerance, failed controls, overdue treatments, and accepted exceptions.
all material scenarios listed in the portfolio risk register
R-01, R-04, and R-06 retain Moderate residual risk
AI launch governance awaits operating evidence from a pilot
illustrative target for accepted exceptions past expiration
Case-study note: The risk appetite, register, and executive metrics are original, illustrative portfolio artifacts for the fictional Veloura enterprise. Lab-based control results are identified separately from proposed or not-yet-operated controls.
How I build a governance program
01Assess & prioritize
→Identify business objectives, material risks, current maturity, and accountable sponsors.
02Design governance
→Define policies, ownership, stewardship, decision rights, workflows, and measurable requirements.
03Implement & test
→Configure selected controls, execute scenarios, document findings, and retain defensible evidence.
04Operate & improve
Monitor KPIs and exceptions, remediate issues, report risk, and mature the program over time.
Credentials & foundation
Business depth.
Technical fluency.
My background combines doctoral-level business and information systems education with hands-on knowledge of Microsoft security, identity, cloud, data, privacy, and responsible-AI practices.
Doctor of Business AdministrationInformation Systems
Master of ScienceComputer Information Systems
Master of Business AdministrationBusiness Administration
Certifications earned
Microsoft Certified: Information Security Administrator Associate (SC-401)Microsoft Certified: Identity and Access Administrator Associate (SC-300)Microsoft Certified: Security, Compliance, and Identity Fundamentals (SC-900)Microsoft Certified: Azure Data Fundamentals (DP-900)CompTIA Data+CompTIA A+
Certification preparation
CIPP/US — In Progress
Planned certifications
CDMP Associate — PlannedArtificial Intelligence Governance Professional (AIGP) — Planned
Complementary technical coverage
Governance-focused SQL supports data-quality validation, reconciliation, exception reporting, and traceable controls. SC-401 focuses on classifying, protecting, retaining, and preventing inappropriate use of sensitive information. Microsoft Purview connects those capabilities through metadata, classification, lineage, policy, quality, privacy, and governance controls.
Next chapter
Governance can be rigorous without losing the human side.
Open to fully remote opportunities in enterprise data governance, metadata and data catalogs, data quality and stewardship, information governance, privacy and data-protection operations, Microsoft Purview, and governance operations. Entra, Fabric, reporting, risk, and responsible AI strengthen this core focus.