September 09, 2026
Data Governance Capability Level in an Organization Based on Cobit 2019
Erik Montenegro Wiesenhofer; Mônica Mancini
DOI: 10.22167/2675-6528-202602208
Article derived from a Final Course Work (TCC), with content based on the student’s original work and adapted to the editorial format of the Revista E&S with the support of the ResumeAI tool, an artificial intelligence solution developed by the Pecege Institute for textual synthesis and organization.
Summary
Data governance has become crucial for organizations seeking informational reliability and quality, especially in the telecommunications sector, due to the volume of data and the need for structured processing. The adherence of data governance practices associated with COBIT 2019’s APO14 objective “Managed Data” was evaluated in a telecommunications organization in São Paulo. The study was descriptive, with a qualitative approach and descriptive statistics. Data collection occurred through a questionnaire applied to approximately 25 professionals from the information technology, analytics, and operations areas, resulting in 15 valid responses. The results indicated a predominance of the classification “Partially”, with an overall average of 1.57 on a scale of 0 to 5, evidencing partial adherence to the evaluated practices. Ongoing initiatives were observed, mainly in strategy, roles, communication, and data lifecycle, but with pronounced weaknesses in aspects such as corporate glossary and conceptual standardization. It was concluded that the organization needs to advance in formalization, standardization, and monitoring to consolidate its data governance, revealing opportunities for evolution.
Keywords: organizational capacity; diagnosis; maturity; metadata; data quality.
1. Introduction
Data governance has emerged as a crucial component for organizations seeking greater reliability, standardization, and quality in the use of information in their operational and managerial processes. The increase in business demands related to data quality and consistency, especially in large organizations, has driven the need for structured practices. This scenario is intensified by the expansion of data volume and the diversity of sources generated by internal systems and processes, which complicate informational ecosystems (Otto, 2011; Khatri and Brown, 2010).
Such practices aim to support essential requirements such as quality, integrity, availability, and security of corporate information, in addition to supporting regulatory and operational demands (ISACA, 2018a). Effective information and technology governance is recognized as a critical factor for organizational performance, as it aligns technological capabilities with strategic business objectives and ensures consistency in the management of informational assets. In the telecommunications sector, the topic gains particular relevance due to the large volume of data generated and the need to ensure its structured treatment aligned with business objectives.
In this context, COBIT 2019 stands out as a reference framework for guiding good governance and management practices. It provides guidelines and objectives that allow for the structuring of processes and controls related to the corporate information value cycle (ISACA, 2018b). The application of COBIT 2019 to data governance topics has been the subject of recent studies, which point to its potential to support the construction of organizational models and strategic alignment (Thabit et al., 2020).
Within COBIT 2019, the APO14 objective, named “Managed Data”, encompasses practices focused on data management as an organizational asset. It covers aspects such as definition, standardization, quality, security, availability, and control of data throughout its lifecycle. This objective guides the adoption of guidelines, responsibilities, and monitoring mechanisms for structured treatment and reliable, consistent use of data, aligned with organizational needs (ISACA, 2019).
To support structured assessments, approaches based on capability or maturity levels are frequently used, which allow representing progressive stages of process development. COBIT 2019, for example, adopts a capability scale from zero to five to assess governance and management processes, aiding in mapping the current stage and identifying evolution gaps (ISACA, 2018a). This logic is compatible with models such as the Capability Maturity Model Integration (CMMI), which organizes process development into gradual levels.
However, many organizations still face difficulties in objectively assessing the maturity of their data governance processes. These difficulties are notable in defining responsibilities, standardizing practices, and measuring results related to data quality and usage, which limits the ability to consistently direct improvements (ISACA, 2018a). The literature also points out that the absence of structured diagnostics hinders the prioritization of initiatives and the reduction of gaps, compromising the generation of value from the corporate use of information (Alhassan et al., 2016).
The relevance of data governance as an organizational capability to sustain data quality and consistency, as well as to meet business and compliance requirements, justifies conducting studies in this area (Otto, 2011). Evaluating the capability of processes related to APO14 “Managed Data” allows for understanding the current stage of data governance practices, highlighting gaps, and guiding decisions on evolution priorities (ISACA, 2019). By structuring an applied diagnosis, this study seeks to contribute an objective reading of the perceived maturity level and provide subsidies for continuous improvement, aligning with consolidated recommendations in the data governance literature (Alhassan et al., 2016). Additionally, by adopting a recognized framework and engaging with studies that address its use for data governance, the work strengthens the link between theory and organizational application (Thabit et al., 2020). Therefore, the general objective of this work is to evaluate the adherence of data governance practices associated with COBIT 2019’s APO14 “Managed Data” in an organization in the telecommunications sector located in the city of São Paulo.
2. Material and Methods
The research was conducted in an organization in the telecommunications sector, located in São Paulo, SP, Brazil, operating in digital infrastructure and corporate connectivity solutions.
The study was conducted as a case study (Yin, 2015), adopting a qualitative approach supported by descriptive statistics for the organization and interpretation of responses. The work is descriptive in nature, seeking to record and organize evidence about data governance practices in the organization, without the intention of explaining causal relationships (Gil, 2017).
The sample was defined by convenience (Gil, 2017), composed of professionals from the areas of information technology, “analytics”, and operations, with direct or indirect involvement in activities related to data treatment and governance.
The data collection instrument consisted of a structured questionnaire with 15 closed-ended questions, developed based on the practices and activities of APO14 – “Managed Data” objective of COBIT 2019. The questionnaire was organized into four thematic blocks: strategy, roles, and communication (4 questions); corporate glossary and metadata (3 questions); data quality (4 questions); and data lifecycle and maintenance (4 questions). These blocks aimed to verify the formal direction for data management, the existence and standardization of common definitions, the presence of quality criteria and metrics, and practices related to data retention, updating, and disposal.
The responses were recorded on a Likert scale from 0 to 5, representing progressive capability levels, from “Non-existent” (0) to “Improved” (5), in line with the capability levels used by COBIT 2019 (ISACA, 2019). The interpretation of the capability levels was conceptually supported by the Capability Maturity Model Integration [CMMI], as proposed by Gorgona (2021).
Data collection occurred between December 2025 and January 2026, using an electronic form developed in “Google Forms”. The form was sent to approximately 25 professionals, resulting in 15 valid responses that constituted the analyzed sample.
The data analysis methodologies included the creation of tables to represent the distribution of responses and the comparison of results by thematic block. Arithmetic means were calculated per question and per block to synthesize the perceived maturity level. Responses were converted into numerical values from 0 to 5, where 0 = “Does not exist”, 1 = “Informal”, 2 = “Performed”, 3 = “Defined”, 4 = “Measured”, and 5 = “Optimized”. The arithmetic mean was transformed into an achievement percentage by dividing by the maximum value of the scale (5) and multiplying by 100. The obtained percentage was classified according to the “achievement ratings” approach (Souza Neto, Almeida and Mira da Silva, ISACA, 2019), with ranges similar to those defined in ISO/IEC 33004: “Fully” (F) for >85%, “Largely” (L) between 50% and 85%, “Partially” (P) between 15% and 50%, and “Not” (N) below 15%. This logic allowed for the interpretation of the perceived implementation degree of the practices evaluated in APO14. As it is a self-assessment, the findings should be interpreted as respondents’ perceptions, subject to biases.
3. Results and Discussion
This section presents the results obtained from the 15 valid responses to the applied questionnaire. Initially, the sample profile is presented, followed by the consolidated results by thematic block and, subsequently, the detailed results by question. The analysis sought to highlight the level of adherence of the evaluated practices to objective APO14 – Managed Data, allowing for the identification of aspects that are relatively more developed and gaps that still require greater structuring within the studied organizational context.
Sample profile
The target population consisted of approximately 25 professionals from the areas of information technology, analytics, and operations. 15 valid responses were obtained, which constituted the analyzed sample, comprising 5 managers and 10 technical analysts. Table 1 details the characterization of the target population and the sample.
Table 1. Characterization of the target population and the sample
| Element | Quantity |
|---|---|
| Target population (invitations sent) | 25 |
| Valid answers (sample) | 15 |
| Managers (in sample) | 5 |
| Technical analysts (in-sample) | 10 |
Source: Original research findings (2026)
It was observed that the sample was composed of professionals with different levels of involvement in the organizational context, which favored the acquisition of complementary perceptions about the data management practices investigated. The sample composition was compatible with the case study proposal, as it included participants with direct or indirect involvement in processes related to the treatment, use, and organization of corporate data.
Synthesis of results by thematic block
Considering the average of the questions in each block, it was found that all thematic blocks remained in the Partially (P) range, with a global average percentage of 31.5% and an overall average of 1.57 on a scale of 0 to 5. This result indicates that, in the respondents’ perception, the evaluated practices are still in a partial stage of implementation. Table 2 summarizes the averages, achievement percentage, and classification by thematic block.
Table 2. Means, achievement percentage, and classification by thematic block
| Block | Questions | Average (0-5) | % achievement | Class |
|---|---|---|---|---|
| Block 1 – Strategy, roles, and communication | 4 | 1.88 | 37.7% | P |
| Block 2 – Corporate Glossary | 3 | 0.78 | 15.6% | P |
| Block 3 – Data quality | 4 | 1.67 | 33.3% | P |
| Block 4 – Data Lifecycle | 4 | 1.77 | 35.3% | P |
Source: Original research findings (2026)
In comparative terms, the best performing block was strategy, roles, and communication, with an average of 1.88, followed by the data lifecycle block, with an average of 1.77. In contrast, the corporate glossary block showed the lowest result, with an average of 0.78, highlighting a more pronounced fragility in the standardization, formalization, and dissemination of data-related concepts.
The joint reading of these results suggests that the organization already presents initial initiatives towards data management, especially in aspects closer to strategic articulation and certain control mechanisms. Nevertheless, such initiatives seem to occur in a fragmented manner, with a low degree of formalization and limited institutionalization. This means that, although the topic is already present in the organizational environment, the existing practices do not yet appear sufficiently consolidated to characterize a mature data governance model.
The relatively superior performance of the strategy, roles, and communication block can be interpreted as a sign that the organization already recognizes the importance of the topic and presents some level of articulation between business areas and information technology. However, as this block also remained in the Partially range, it is understood that there is still relevant room for evolution in defining responsibilities, communicating objectives, and systematically monitoring actions related to data management.
Similarly, the result of the data lifecycle block indicates that the organization already demonstrates some attention to aspects such as retention, protection, disposal, and review of data usage over time. Nevertheless, the observed average reveals that these practices are not fully formalized nor uniformly applied, which suggests limitations in the clarity of guidelines and the consistency of adopted procedures.
On the other hand, the poor performance of the corporate glossary block deserves special attention, as it highlights an important structural fragility. The absence of shared definitions, standardized terms, and common conceptual references tends to compromise the semantic consistency of information, hindering communication between areas and favoring distinct interpretations of the same data. In organizational contexts that depend on interaction between technical, operational, and analytical areas, this type of fragility can directly affect the reliability of analyses, the comparability of indicators, and the efficiency of processes.
In general, the results show that the organization’s main challenge is not necessarily the complete absence of initiatives related to data management, but the difficulty in consolidating them as formal, recurring practices integrated into institutional functioning. The predominance of the classification Partially in all blocks reinforces the perception of an initial stage of maturity, in which the topic is already recognized as relevant, but still lacks greater standardization, conceptual clarity, definition of responsibilities, and continuous monitoring mechanisms.
Results per question
Table 3 presents the results by question, including the average of the responses, the achievement percentage, and the class assigned according to the ranges: Fully (F) > 85%, Largely (L) 50-85%, Partially (P) 15–50%, and Not (N) < 15%.
Table 3. Results by question, with full statement, average, achievement percentage, and classification
| Block | Question | Question statement | Average (0-5) | % achievement | Class |
|---|---|---|---|---|---|
| Block 1 – Strategy, roles, and communication | Q1 | The data management strategy is developed collaboratively between the business and information technology areas. | 2.33 | 46.7% | P |
| Block 1 – Strategy, roles, and communication | Q2 | The roles and responsibilities related to data management are clearly defined, documented, and assigned within the organization. | 1.60 | 32.0% | P |
| Block 1 – Strategy, roles, and communication | Q3 | The objectives, priorities, and scope of data management are clearly and periodically communicated to the involved areas. | 1.53 | 30.7% | P |
| Block 1 – Strategy, roles, and communication | Q4 | The organization uses metrics and indicators to monitor and evaluate data management results. | 2.07 | 41.3% | P |
| Block 2 – Corporate Glossary | Q5 | There is a corporate glossary that defines and standardizes the main terms and concepts related to the organization’s data. | 0.93 | 18.7% | P |
| Block 2 – Corporate Glossary | Q6 | The corporate data glossary is systematically maintained and updated by the responsible areas. | 0.60 | 12.0% | N |
| Block 2 – Corporate Glossary | Q7 | Collaborators use the corporate glossary as a reference in processes, analyses, and communications related to data. | 0.80 | 16.0% | P |
| Block 3 – Data quality | Q8 | There is a formalized strategy to ensure data quality aligned with the organization’s objectives. | 1.47 | 29.3% | P |
| Block 3 – Data quality | Q9 | The organization regularly evaluates data quality through defined criteria, processes, and metrics. | 2.00 | 40.0% | P |
| Block 3 – Data quality | Q10 | Data quality issues are monitored, logged, and tracked to resolution. | 1.73 | 34.7% | P |
| Block 3 – Data quality | Q11 | The results of data quality assessments are used to promote improvements in processes and controls related to data. | 1.47 | 29.3% | P |
| Block 4 – Data Lifecycle | Q12 | The organization has clear policies and guidelines for data lifecycle management. | 1.53 | 30.7% | P |
| Block 4 – Data Lifecycle | Q13 | Security, retention, and protection guidelines are applied consistently throughout the data lifecycle. | 2.07 | 41.3% | P |
| Block 4 – Data Lifecycle | Q14 | Data archiving and disposal processes are executed according to policies defined by the organization. | 1.67 | 33.3% | P |
| Block 4 – Data Lifecycle | Q15 | Data lifecycle management is reviewed and improved to meet new organizational and regulatory needs. | 1.80 | 36.0% | P |
Source: Original research findings (2026)
The detailed analysis by question allowed for a more precise identification of the points of greatest and least adherence in the set of practices evaluated. The highest average observed was in the question related to the collaborative development of the data management strategy between business and information technology areas (Q1), which suggests the existence of some level of alignment between these areas. Also standing out, in relative terms, were the questions related to the use of metrics and indicators for monitoring (Q4) and the application of security, retention, and protection guidelines throughout the data lifecycle (Q13).
Although these items performed better than the others, all remained in the Partially range, which demonstrates that such practices, even if recognized, are not yet fully structured or institutionalized. This reinforces the idea that the organization presents punctual advances in components closer to strategic direction and certain control routines, but without yet reaching a more consistent level of maturity.
In contrast, the lowest results were concentrated in issues related to the corporate glossary, especially in the systematic maintenance and updating of this instrument (Q6). This finding indicates that the organization does not yet have a sufficiently structured conceptual basis shared among collaborators. The fragility in this dimension is particularly relevant because the corporate glossary represents not only a documentary resource but an institutional alignment mechanism capable of supporting communication, reducing ambiguities, and strengthening the uniform interpretation of data across different areas.
In the data quality block, the results also pointed to a scenario of partial implementation. There was a perception that efforts to evaluate data quality exist (Q9), but still with limitations in formalizing a strategy aligned with organizational objectives (Q8) and in the systematic use of the results of these evaluations to promote improvements in processes and controls (Q11). In other words, the findings suggest that the organization can perform checks and monitoring to some extent, but still faces difficulties in transforming these efforts into permanent, systematic, and articulated practices.
In general, the results show that the organization’s main challenge is not necessarily the complete absence of initiatives related to data management, but the difficulty in consolidating them as formal, recurring practices integrated into institutional functioning. The predominance of the classification Partially in all blocks reinforces the perception of an initial stage of maturity, in which the topic is already recognized as relevant, but still lacks greater standardization, conceptual clarity, definition of responsibilities, and continuous monitoring mechanisms.
The interpretation of these findings must consider that the data derive from the respondents’ perception, a characteristic inherent to the adopted method. This aspect does not invalidate the results, but indicates that they should be understood as an organizational diagnosis built from the perspective of the participants directly involved with the subject. Nevertheless, this type of evidence is especially relevant in maturity studies, as it allows identifying how practices are perceived internally and in which dimensions the most evident gaps are concentrated.
In summary, the results obtained allowed us to demonstrate that the adherence to the evaluated data management practices occurs partially. The diagnosis revealed that the organization already shows movements towards data governance, but still requires significant advancements to transform these efforts into more stable, coordinated, and institutionalized practices. The organization presents a predominant classification of Partially, with an overall average of 1.57 on a scale of 0 to 5 and 31.5% achievement regarding the practices evaluated in objective APO14 – Managed Data of COBIT 2019. This indicates that the organization has initiatives related to data governance, but they are still conducted with a low level of formalization, standardization, and institutionalization. The analyzed practices are in an initial stage of consolidation, with signs of development in some dimensions, but with relevant gaps for data governance to be established in a more structured, consistent, and continuous manner within the studied organizational context.
4. Conclusion
This study sought to evaluate the adherence of data governance practices associated with COBIT 2019’s APO14 “Managed Data” objective in a telecommunications organization located in São Paulo. It was found that the adherence of the evaluated practices occurs partially, with an overall average of 1.57 on a scale of 0 to 5, corresponding to 31.5% achievement. Ongoing initiatives were observed, especially in the strategy, roles and communication, and data lifecycle domains, which showed relatively superior performance. However, a pronounced fragility was identified in the corporate glossary domain, with the lowest average, evidencing the need for greater conceptual standardization and formalization. The findings indicate that, although the organization already recognizes the importance of data governance, the main challenge lies in consolidating these initiatives as formal, recurring practices integrated into institutional functioning. The main contribution of this work lies in the objective diagnosis of the perceived maturity level, providing subsidies for continuous improvement and for the direction of enhancement actions, aligning with the literature recommendations on data governance.
As a limitation of the study, it should be noted that the analysis was conducted in a single organization, which restricts the generalization of the findings to other institutional contexts. Additionally, the diagnosis was constructed based on the respondents’ perception, rather than on a direct verification of documentary or procedural evidence, which gives the results the character of a perceived internal view. The exclusive focus on APO14 objective of COBIT 2019, although it allowed for analytical depth, did not fully encompass other dimensions of governance and management. For future studies, it is recommended to expand the application of the instrument in other organizations and sectors, aiming for comparative analyses and greater interpretive robustness. It is also suggested to use complementary approaches, such as interviews and documentary analysis, to relate participants’ perceptions to more concrete implementation evidence. Finally, future studies can explore other COBIT 2019 objectives, broadening the understanding of data governance maturity in different organizational contexts.
Bibliographic References
Information Systems Audit and Control Association [ISACA]. (2018a). COBIT 2019 Framework: Introduction and Methodology. Disponível em: . Acesso em: 11 out. 2025.
Information Systems Audit and Control Association [ISACA]. (2018b). COBIT 2019 Framework: Governance and Management Objectives. Disponível em: . Acesso em: 11 out. 2025.
Khatri, V.; Brown, C. V. (2010). Designing data governance. Communications of the ACM, 53(1), 148-152. Disponível em: . Acesso em: 26 jan. 2026.
Otto, B. (2011). Organizing data governance: findings from the telecommunications industry and consequences for large service providers. Communications of the Association for Information Systems, 29, art. 3. Disponível em: . Acesso em: 26 jan. 2026.
Thabit, T. H.;
Article originating from the Course Conclusion Work of the Specialization in Data Science and Analytics of the MBA USP/Esalq
To learn more about the course, click here and access the MBX Academy platform