Chapter 13 — Data systems
Lesson map
Lesson 13 published. Map, example, EX037.
flowchart TD
N0["Learning outcomes"]
N1["13.1 Register as data"]
N2["13.2 Validating quality"]
N3["Lab — Validating a synthetic risk register"]
N4["13.3 Integrity of governance data"]
N5["Synthesis"]
N0 --> N1 --> N2 --> N3 --> N4 --> N5
N5 --> EX["Worked example"]
EX --> Q["Exercise EX037"]
Logical drawing
flowchart LR
N0["Learning outcomes"]
N1["13.1 Register as data"]
N2["13.2 Validating quality"]
N3["Lab — Validating a synthetic risk register"]
N4["13.3 Integrity of governance data"]
N5["Synthesis"]
N0 --> N1 --> N2 --> N3 --> N4 --> N5 --> Q["EX037"]
[Learning outcomes]
|
v
[13.1 Register as data]
|
v
[13.2 Validating quality]
|
v
[Lab — Validating a synthetic risk register]
|
v
[13.3 Integrity of governance data]
|
v
[Synthesis]
|
v
[Worked example] --> [Exercise EX037]
Learning outcomes
You will (1) model a risk register as structured data; (2) validate register quality automatically; (3) protect governance data integrity.
13.1 Register as data
Ardwell's risk register lives in a spreadsheet edited by many people. Nadia models it as a table with defined fields: identifier, owner, last review date and a score from one to twenty-five on the cooperative's five-by-five scale. Defined fields allow automatic checks. She learns from database design that each field should have a type and allowed values, so that a score of thirty or a blank owner can be caught. Treating the register as data rather than a document is the first step towards reliable risk reporting.
13.2 Validating quality
Nadia's lab checks six synthetic register rows against three rules: every risk must have an owner, reviews must be no older than one hundred and eighty days, and scores must lie between one and twenty-five. The lab finds six issues affecting four rows. Two risks have no owner. Three reviews are overdue, one by over a year. One score of twenty-six is outside the scale. Only two rows are clean. Nadia sends each owner a specific list of fixes rather than a general reminder.
Lab — Validating a synthetic risk register
"""Validate a synthetic risk register: missing owners, overdue reviews, scores out of range."""
from datetime import date
today = date(2026, 10, 1)
reg = [("R01", "IT ops", date(2026, 6, 1), 12), ("R02", "", date(2026, 9, 1), 8),
("R03", "Finance", date(2025, 8, 15), 20), ("R04", "OT eng", date(2026, 3, 20), 26),
("R05", "HR", date(2026, 8, 30), 6), ("R06", "", date(2025, 11, 2), 15)]
issues = []
for rid, owner, last, score in reg:
if not owner: issues.append((rid, "no owner"))
if (today - last).days > 180: issues.append((rid, f"review overdue {(today-last).days} days"))
if not 1 <= score <= 25: issues.append((rid, f"score {score} outside 1-25"))
for i in issues: print(*i)
print(f"rows {len(reg)}; issues {len(issues)}; clean rows {len(reg) - len({r for r, _ in issues})}")
Run with python3 lab_register.py. Verified output:
R02 no owner
R03 review overdue 412 days
R04 review overdue 195 days
R04 score 26 outside 1-25
R06 no owner
R06 review overdue 333 days
rows 6; issues 6; clean rows 2
13.3 Integrity of governance data
A register that anyone can edit without a trace cannot serve as evidence. Nadia recommends moving it into a system that records who changed each entry and when, with approvals for score changes. She notes that falsified or careless edits could make risks look smaller before a board meeting. Version history makes such changes visible. Prof. Brenner adds that the same principles of integrity, access control and audit trails that protect business data apply to the governance data that describe risk. Approvals for score changes also mean a risk can only be lowered before a board meeting with a named person accepting it.
Worked example
Nadia defines typed register fields, finds six issues in four of six rows and recommends an audited register system.
Synthetic case. The register rows are synthetic.
Errors and limits
Validation checks form, not whether risks are correct. Audit trails need review.
Exercises
- EX037 — Validation rules. Which three rules did the lab apply? Rubric: 3 = owner present, review within 180 days, score 1-25;; 2 = three rules;; 1 = vague;; 0 = none.
- EX038 — Clean rows. How many of six rows were clean? Rubric: 3 = two;; 2 = 2;; 1 = six;; 0 = none.
- EX039 — Integrity risk. What could happen without change history? Rubric: 3 = risks made to look smaller before board meetings;; 2 = manipulation;; 1 = vague;; 0 = none.
Synthesis
Treating governance records as validated, audited data makes risk reporting reliable.
Continue studying — chapter 13 of 50
← Chapter 12 (draft) · Course chapter index · Chapter 14 (draft) →