Data Governance in Higher Education

And in the years leading up to the pandemic , uh, the question we most often got was, well, what problem are we trying to solve , uh, by, by doing this, by defining that by all of those kinds of things , uh, and then the pandemic hit and all of a sudden it was really obvious to all of us, what the problem was.

We were trying to solve , uh, access to , uh, meaningful, reliable, usable data , uh, became absolutely critical to our ability to, to manage and keep the university open , uh, through this, through this pandemic. Uh, and I couldn't imagine how we could have responded , uh, and , and functioned without everything from who is it that's supposed to be on campus. So how do we know , uh , for home too , hold the daily health check requirements , uh, how do we manage isolation and quarantine?

Uh, all of those, those kinds of things who are the people that we need to worry about for that. And then when we do get cases, how do we contact trace and, and who are, who are the people that they were, you know , the folks who are testing positive are in close contact with , uh, because you know, they're not going to remember everybody. So how do we, how do we look at those sorts of things? So on the plus side, we had a lot of the data structure and governance had already taken place.

We had a solid foundation for access and privacy , uh, and , uh, and we had all of the data moved from , uh, we needed most of it, at least , uh, from our transactional systems into our data warehouse, where we could marry it all together and start cross-referencing things and doing some pretty deep dive analysis to figure out what, what were we really experiencing as we had outbreaks or, or whatever around campus. Uh, and so, so that was really kind of the setup.

On the other hand, we've had our , we have found a lot of holes and a lot of , of cases, again, back to those things where we're saying, well, what problem are we really trying to solve? Because we can get by with what we have. Yeah. It tastes a little bit longer. And we got to spend more time cleaning up data and all of that before we use it.

Uh , but before having a real , uh, impending deadline and crisis, not one that we was arbitrary and self manufactured on our part, okay, we had this deadline, we want to get this done by this date, but if we miss this date, okay, so we missed the date , right? If we miss this date, we're not opening this fall, this past fall. So these were real deadlines and they were being influenced by, by things and conditions that were completely outside of our control.

And, and on top of that, the questions that kept coming in were questions that three hours earlier, we didn't even know that. And now we're asking this question and lo and behold, we have the data in a usable form in order to make those decisions. So a great example, we opened campus a week in , we have an incredible spike and, and , uh, cases on campus to no idea why, but we went out of control. We had to quadruple the amount of corn to be in isolation space.

Uh, we had, we didn't have enough people in order to reach out to the kids. Uh, folks weren't getting called back. We were in the news because we had students in quarantine and isolation that went a day and a half without getting food , uh, and things like that. So, so what's causing this and we were literally, we put a pause on in-person classes , uh, and we were absolutely ready to shut down and send everyone home.

Uh , but because we were able to know what students were in, what course sections, when and where, and because we know both on campus and off campus , off campus, where students are living, we were able with our County health officials to quickly identify unified the fact that we did not have community spread , we had event spread, and we were able to trace most of the, the big peak and the big Sturge back to three off-campus parties.

But we were able to identify absolutely without any question that this was not spreading in the classroom. And that allowed us to pause the classes, get all the kids back under control, cause kids are going to be kids and, and kind of ratchet things down. And two weeks later, we were back , uh, back in business , again , in-person classes. Uh , we created the opportunity for folks to be able to connect in if they were in quarantine or isolation.

Um , and we created a data feed for the faculty so that they knew who to expect to be online versus in-person. And we were able to open back up again , um , and , and resume kind of normal operations. Uh, we had a football season this year. Uh, granted it was only faculty staff and students , uh, in the stadium. Uh, but we literally were able to see hot by stadium section by because we know where everybody's ticket was .

So we had a heat map of the stadium we could see, okay, was there a breakout that resulted of this? And rather infamously , uh, we had played Clemson , uh, during the season we won , uh, and the kids storm in the field after the game. And it was in all the news and there was all these kids out on the field. The good news is, Hey, they were masked. Uh, and, but secondly, we were able to show that by section, there really wasn't an outbreak that resulted as because of that.

So, so it was just fascinating to be able to look at the data in that way , uh, and be able to make those kinds of decisions , uh , and feel comfortable about having home football games.

You know, what questions are we trying to answer with this data as we implement different phases and components of all of this. And I remember our executive vice president, having a very frustrating reaction, frustrated reaction to that. Uh , when he said, would you please stop asking me what questions we need to answer? I don't know.

And , and that caused us to kind of adopt the , the philosophy or the elevator speech value proposition that said we wanted to create the infrastructure that let us answer the questions that we don't yet know to ask, because our model before that was in essence, every question becomes a project slash report.

And we didn't want, we realized at that point, though, what we were building , uh, and the whole data governance structure, as well as the business intelligence data warehouse , uh, technology backbone to that , uh, had to be, had to be able to allow for the anticipation and to put things together that nobody thought to put together before , uh, and do it quickly. And without really having to worry about , uh, institutionalizing that question.

So we went from kind of a focus on let's build dashboards to let's create an environment that at a moment's notice, given whatever situation it was, people could pose questions of the data and, you know , if they had the right expertise, which is a whole another story, right? Uh, that they could look at data and answer very specific questions that were almost always one-offs . And that's where we landed here. The number of times, the questions changed for us over the, over the year.

And particularly in the first six months of the pandemic , uh, we would have never been able to survive. Uh, just, just, I would liken it to we're providing as data, think of it as electricity. We're the power company, the data governance program and the business intelligence environment is the power company. We don't the power company. Doesn't tell you where to put the lights in your house. They don't tell you how many lights you can put in.

They don't tell you when the tournament and when to turn them off. But when you plug your luck lamp into a wall and you turn it on and the light comes on and you don't have to wait, nobody has to come out and run new lines and do all of those things. And, but at the same time, there's fail safe in place , right?

To say that if you do something you shouldn't do with a power appliance or whatever, then we have fail-safes , that will shut that down and, and protect you and the institution from those kinds of mistakes. So, so that was really when the light bulb came on for us.

And we went forward with this idea of let's look at how all of the data in Iran and make sure that we have all of the channels built so that we can take course registration data and marry Marriott with , uh , an external , uh, health tracking or contact tracing application, and be able to all of that together, we can take ticket information and map it against seating charts at the, you know , for, for facilitates , to know where this is happening. Um ,

So we've got 40 or so different offices or units on campus. And when we're going to talk about a piece of data and build all of the metadata around that piece of data and determine what, what kind of access controls, and what's the definition, how can it be you should, where does it come from? And all of those sorts of things we poll in essence, the entire university is pretty much represented by unit. We pull all the units and we say, here's what we're going to talk about today.

Do you feel like you're responsible for this data? And there's where we uncover silos and cases where we've got possession is nine tenths of the law. I have it, therefore, it's my data. Uh , and that's where we uncover that. And we can say, no, you're really not the data steward for that. This is the day short . Uh, and , and we plotted out on, on the RACI matrix, you know , responsible, accountable consult inform. And we also had a fish, no role or nurse stake.

Uh, and then so people can say, yeah, I think I'm responsible. Uh, I think I'm accountable for the data that's there. Uh, Hey, I use this. This is important enough to my role and my function that I need to participate in , or just tell me when, you know, tell me what you guys decide, because I'm more of a user of it, or I'm really don't have a role . And, and not only do we do that as an invitation, but we capture that as part of the metadata.

So we know if, if we find an issue with, okay, this definition no longer fits this term or something changing in the metadata, we know who to invite back and who to run that by, because we capture all that as part of the metadata. So that was step one .

And one last thing on that is the beauty of doing the self opt in is that participation and engagement has been incredibly high because we're not forcing somebody to come sit through, you know, an hour workshop session to define a terms that they have no interest in. So we don't just invite all 40 people. We're going to do this, you know , calm. Uh, we tell them what we're going to talk about in advance.

We give them draft metadata, and we say, Hey, if this is valuable to you, calm , uh, and, and early on, a lot of people were coming out and, but as we move forward, now, typically we'll have four or five units will be represented. And the most now are comfortable with look, I really don't have a role, or just let me know. So that was one. The second one was we early on, started using a tool that we called guiding principles.

And what happened in that case was typically the data stewards are going to err on the side of being 100% risk averse. We don't want any risk . So we're going to classify all the data as sensitive or restricted. And at our first iteration of the warehouse and our first, there's probably 400 terms that we had ready to go. 80% of them were designated by the stewards and just restricted access. Uh , and so we went back to the steering committee.

It was our executive vice president or senior associate provost. Uh, and , and we said , uh, the EDP runs the operational side of the university. And obviously the provost is the academic side and we, and we went back to them and said, okay, we're going to turn this on, but it's not going to be very interesting cause everything's restricted. Well, like what's restricted. Well like the course catalog. Why is the course catalog restricted? Can we publish that?

Well, the data steward has the registrar in this case is restricting it because it changes right up until the last minute. And they don't want people making decisions until it's and not knowing that it changed further down the road . Oh , beta changes all the time. That's ridiculous. That should not be restricted. Right. We said, but, but nobody's ever told the data stewards how to make that decision.

So we put together a set of guiding principles where we had our general counsel , senior associate provost, executive vice president, strategic planning, and institutional research in a room. And we said, what are the guiding principles? What , what, how do we tell the folks to make this decision? And they came up, I think there are 11 of them.

First one presume trust , uh , you know, you don't, you don't have the right as a data store to say that person doesn't get it because I don't trust them. Um , you know , we hire everybody with, with high standards. We expect people to be having Tegrity. We need to say we trust them second guiding principle. We don't restrict access out of fear of misinterpretation fear that the data is going to change or fear the word discovering bad or missing data. In fact, we want that to happen.

So, and there were several others and then the biggest change in , and I think really as part of those guiding principles was I went back to the leadership team and I said, okay, so what are you going to do? And I told them, and they agree completely that we expected them to be the arbitrators. So if we got to a point where somebody's requesting access and the data steward couldn't agree, then we were going to come to them and they would make the call.

But at the same time, we want you to reaffirm the role of two data stewards, because you're not taking the ball out of their hands. You're just giving them guidance. Right. And they did that. But the biggest change was we put the burden of justification on the person wishing to restrict the access, as opposed to the person wanting to gain the access price was the other way around. Well, what's your business case? Why do you need this data? That's no longer the question.

The question now is why do you feel like this needs to be restricted? Because the default answer for access should be yes, unless there's a reason for it to be no . And, and, and, and that drama doesn't equal damage. And we need to make sure that we have clear and present likelihood of damage to the university. If you're going to this , we went from 80% of the data being restricted to less, to a, roughly 20% or less overnight, just by implementing the guiding principles.

And then we've taken that a step further and we've applied guiding principles to domains of data. So we now have a set of guiding principles for who has access, who has legitimate educational need and who is a school official for data that's protected by FERPA . Uh, we have guiding principles for all of our COVID data. We have guiding principles for , uh, our , uh , EEO and demographic. So we know at the outset we have something on which to base those decisions.

So, so that was really, I think the second item and the third was , uh, and I have to give our, our , uh , CIO at the time credit for this, he, from his background, he said, well, you guys should just build conceptual data models. So we did, and we we've built one so far actually, and it's focused on student. And so we now have, you know , kind of a network map that shows every node is a repository of data. So a student is a node, of course, is a node. Uh, and we have a network map.

Now that shows, how does this bucket of data called a student interact with this bucket of data called a course or a course section. So now we can answer the question, how does a faculty member see a student? Well , I'm a faculty member can see the student because the student is in a class you're teaching. They can see the student because they're advising the student. They can see the student because they're a department chair and the student is majoring or minoring in their department.

Uh, and , and so we can see all of those connections. And now that helps us to define what programs, if you will, we call it our TV network, right? What programs each one of those is channel and which programs play on that channel. So if I'm a faculty member and I'm looking at you as a student from a course perspective, I get to see everything about you, but only as it pertains to the course.

So I see all of your contact information that she had , the grades and assignments and everything for that course. But I don't see any of your other grades. I'm a department chair and you're majoring in my department. I see all of grades you're getting for other courses and , and all of those kinds of things. So it expands out or contracts. And we now have maps will tell us, okay, how does this work? And we did this by crowdsourcing.

We had 65 people from across campus, including a group of eight students that we pulled together in the workshops and started with a blank sheet of paper by topic area and said, okay, here's another student in the middle, your table works on athletics. What thing, how does a student interact with athletics? Uh, and they drew the map and we ran workshop after workshop, after workshop of those. I can't tell you how that workshop typically at 10 or 11 people in it .

So we had, I don't know , eight workshops or something like that. And we compiled all of this data on your was a ton of overlap, but every single one of those sessions gave us a new channel to think about that we hadn't thought of before. And so that, those three things I think really help us put in place this idea that we just need to build the channels and secure them appropriately.

Uh, and, and then we'll let you decide what, what show you want to watch and , and what channel you want to turn on web . Uh, and so, so those really were the three biggest things. I think that , uh ,

And , uh, that group there that's the group that has to accept and, and recommend actually blessed policy before it goes to the university there's policy committee. Uh, and you know , and they think of things from a strategic perspective. So whatever we're doing, you know, when we, the guiding principles, even though it was the senior executives that built them, we took them to the information governance committee and said, okay, here's the guiding principles.

Here's how we want to roll them out. Do you concur? Is there something that you're having trouble with or whatever? Uh, so, so they kind of oversee it, but I will tell you this, that it is I've used the expression all the time. It's top down driven, but bottom up, execute it . And we have a senior associate provost and now a provost, because we've just changed that role. Uh, the provost is a big scientist and the , uh , senior associate provost is, is , uh , a self-proclaimed data geek.

Uh, and our executive vice president at the time was a data geek. And, and our now new EVP is also , uh , a data geek. Uh, if you will develop data , then I like to play with it, dig into it. They don't have the time, but they, they get the value of it. Right? And so without them driving, it makes it very difficult to get the grassroots execution.

Because if you don't get all the people in the room, then it's going to be real easy for somebody to say, well, that's their data and their application. And we've had some absolutely fantastic discussions , uh, and empathy built when we do these sessions with the, you know , the , uh, folks who self identify through the RACI process , uh, because people had no idea that this office needs this data. They had no idea.

And how, if we define it and use it this way, it's not going to meet their needs. So, so that, that, you know, but they also know that when push comes to show, the first question coming out of our senior leadership is going to be, where did this data come from? And if it didn't come from the business intelligence environment, they're going to be immediately suspect the suspect of the data.

Uh, uh, messaging and communication is in there. Uh, I'm in there , InfoSec is in there. So we're kind of separate from that. So maybe this will help with what I'm about to say, this is not a technology problem. This is a culture change problem. And this is a culture change challenge.

Uh, you can have the most wonderful technology solution in the world, but if you can't get past the fact that it's actually institutional data and it's an institutional asset, then none of those applications and such are going to matter, how do we get from it's okay for people to see data? How do we get from it's okay for people to ask questions because of the data.

Uh, and , and that just because the data appears to be indicating something wrong, let's presume trust and not immediately say that there's a problem here. Great example, looking at turnover rate, right? Well, this office has a 40% turnover rate, and this office has a 5% turnover rate. The officer has the 40% turnover rate had 10 people in it. And four of them took an early retirement package. The folks who had the 5% was know , 400 person unit.

And the impact of that was probably more significant than, than this, because we can manage this one. We couldn't, we can manage just a 40% one because we knew what was coming, what it was. We offered an early retirement package. The other one, you know, you never know when they're going to walk away. And so, but it's okay to ask, well, why does that, you don't have a 40% turnover rate, or why is that unit staff growth so high?

Well, it was because we moved a sub unit from this organization to their organization. They didn't hire 20 more people. They just acquired 20 more people and somebody else in Boston. So the net change there wasn't one. It's okay to ask those questions and it's okay to see those sayings and say, well , why did that happen? Oh, okay. That's why that happened. That's okay. Or why did that happen? Oh, that's not okay. And we need, and we need to fix that. So

Um , you know, and, and, you know, don't try to boil the ocean either , uh, take it in small little steps, look for small victories and , uh , and such , uh, but, but the other biggest thing, I think that helped us a lot was we didn't shy away from making senior leadership uncomfortable. How often do we hear that? Don't bring your boss a problem, bring your boss a solution. Well , the truth is sometimes the boss is the only one that can solve the problem.

And what we found was quite candidly, the bosses wanted to solve the problems, but nobody ever showed them what the real problem was. So people down below who weren't trying to bring problems to their boss were doing extraordinary work and incredible heavy lifting to get answers, because there were all of these problems that data governance and such could solve, but because it was such institution-wide or so broad of an impact, they themselves couldn't solve it.

But when we put the senior leadership on the spot and said, here's what the issue is, make them feel uncomfortable, give them the incentive, because nobody's going to change until the , the hurt and pain of changing becomes less than the hurt and pain of whatever the condition is. Right? So you got to make sure they understand where the pain is coming from. And sometimes means asking pretty bold questions. Like I don't want my analyst, this came from a senior leader.

I don't want my analysts to have access to performance review and salary data. Why not? Well, because that person may not be mature enough in their career to handle that. I immediately asked the question then why did you put them in that position? If you don't ask that question, then you just step back and say, okay, well, you know, because in reality, that person is the senior leader to everybody else at the university.

If they go and ask the HR VP, give me a spreadsheet that has all the salaries and performance ratings in it, HR is going to give it to them . And that was going to be on a spreadsheet and a thumb drive or whatever , attached to an email, which we all know is so much more secure than firewalls. So, so be bold, but be patient , uh, and, and understand that people have, you know, it has to be their idea. You just have to fool them into thinking that,