Governance is an operating model, not a policy folder
And why your CDO keeps building the wrong artifact
I’ve sat across from data leaders who’ve slid laptops across the table at me. 47 SharePoint folders open. Frameworks. Roles and responsibilities matrices. Data quality standards. Glossaries. Steering committee charters.
The question is the same every time: “It’s all there. So why does nothing work?”
That question is the entire job.
What a policy folder is
A policy folder is what a governance program produces when it has been treated as a documentation exercise.
It looks thorough. It satisfies the audit committee. It ticks the box on “we have data governance.” Consultants like it because it generates output you can point to. Executives like it because it signals progress without disrupting anything.
The problem is that nobody opens it. The engineer pushing a schema change at midnight has SharePoint closed. The analyst rebuilding a report after Finance flagged a number is looking at code, not policy. The product manager scoping a new ML use case has never heard of it.
The folder exists. The behaviour it was supposed to shape does not.
What an operating model is
An operating model is the answer to one question, repeated for every meaningful data decision in the company:
When this happens, who decides, who executes, who is informed, and how long does it take?
Governance, stripped of theatre, is the documented answer to that question across the decisions that matter.
Some examples:→ A new dataset lands in the warehouse. Who owns it within five business days, and what happens if nobody claims it?
→ Finance reports a number that’s off by 3 percent. Who reconciles, who signs off on the fix, and who tells the audit committee?
→ A team wants customer data for a new ML model. Who reviews, what’s the SLA, and what happens if it’s declined?
→ A pipeline breaks at 2am. Who gets paged, what’s the rollback path, and who communicates to downstream consumers?
These are not policy questions. They are operating questions. They have names attached, timeframes attached, escalation paths attached, and consequences attached.
If your governance documentation doesn’t answer them, your governance documentation is a policy folder.
The Tuesday at 3pm test
I’ve watched governance programs that looked excellent on paper collapse the moment they met an actual Tuesday at 3pm.
Tuesday at 3pm is when the CFO emails the CDO because last quarter’s revenue number doesn’t reconcile with the board pack. It’s when the new marketing director wants customer data for a campaign and doesn’t know who to ask. It’s when the auditor calls about a control and nobody can locate evidence for it.
What happens next is the only thing that matters.
In a policy-folder organisation, someone forwards the SharePoint link. Then nothing happens for two weeks while three people argue about whose remit it is.
In an operating-model organisation, the named owner takes the call. The decision is made within a defined window. The action is logged. The next quarter, that loop is faster because it ran once.
The artifact is the same. The behaviour is different. The behaviour is what governance actually is.
Why CDOs build policy folders anyway
Two reasons.
The first is that documentation is legible to executives in a way operating models are not. A47-folder SharePoint shows up in a steering committee deck. A reduction in time-to-decide for data ownership questions does not, unless someone fights for it to.
The second is that operating models require muscle nobody wants to use. They require naming specific people. They require holding those people accountable. They require an executive sponsor who will back you when a senior leader tries to opt out. They require the CDO to behave like a COO of data, not a librarian.
Most CDOs were hired to fix data. Almost none were hired with a clear mandate to redesign how decisions get made. So they build the artifact they were asked for. The folder. And then they wonder why the data quality issues from 2022 are still the data quality issues of 2026.
What to do this week
If you’re a data leader reading this and recognising your own SharePoint, here is the one move I’d make first.
Pick the three data decisions that cost you the most time last quarter. The ones that bounced around for weeks, escalated unnecessarily, or got resolved by whoever had the loudest opinion in the room.
For each one, write a single page. Who decides. Who executes. Who is informed. Within what timeframe. What happens when it goes wrong.
Get it signed off by the executive sponsor. Publish it. Run it for 60 days. Measure the time-to-decide before and after.
That single page is more governance than the folder.
The folder is what you have. The operating model is what you build.
This is the reality — data governance is not a passive sport. It’s an active dynamic engagement.