Metadata Management

Date

Client Name
Protiviti Team:
(Insert Team Member Name)
(Insert Team Member Name)
 Big Data Work Program – Metadata Management

Process Overview

Integrating, controlling and providing metadata. Planning, implementation and control activities to enable easy access to high-
quality, integrated metadata.

Table of Contents
1. Understand Metadata Requirements.........................................................................................................................2
2. Define the Metadata Architecture.............................................................................................................................. 3
3. Develop and Maintain Metadata Standards..............................................................................................................4
4. Implement a Managed Metadata Environment.........................................................................................................5
5. Create and Maintain Metadata................................................................................................................................... 6
6. Integrate Metadata...................................................................................................................................................... 7
7. Manage Metadata Repositories................................................................................................................................. 7
8. Distribute and Deliver Metadata................................................................................................................................ 8
9. Query, Report, and Analyze Metadata.......................................................................................................................8

** CONFIDENTIAL ** For internal use only Page of

 Big Data Work Program – Data Architecture, Analysis
& Design

Ref Control Objectives Testing Procedures Test Results

1. Understand Metadata Requirements
Related Risk: Lack of understanding, no well-defined scope, lack of education to users, no clear delineation for business and technical users, no data
governance organization, lack of confidence among business users, lack of flow for technical users
1.1 The metadata management strategy reflects Test results should be detailed here and work paper
an understanding of enterprise needs for references should be included at the end of each
metadata. sentence as follows [WPXX]. Once fieldwork is
complete, each work paper should be assigned a
unique number (e.g., WP01, WP02, WP03, etc.).
Exception related text should be in red font and
summarized in the “Observations” section.

Observations:
Section to be populated with any exceptions or “No
exceptions noted”.

Work Papers:
WPXX – Work Paper File Name.doc
1.2 The requirements are gathered to confirm
the needs for a metadata management
environment to set scope and priorities,
educate and communicate, guide tool
evaluation, guide metadata modeling, guide
internal metadata standards, guide provided
services that depend on metadata and to
estimate and justify staffing needs.

1.3 The requirements in (2) are obtained for both

business and technical users in the
organization.

1.4 The requirements in (2) are distilled from an

analysis of roles, responsibilities, challenges
and the information need of select

** CONFIDENTIAL ** For internal use only Page of

 Big Data Work Program – Data Architecture, Analysis
& Design

Ref Control Objectives Testing Procedures Test Results

individuals in the organization.

1.5 A data governance organization is in place.

2. Define the Meta-data Architecture

Related Risk: Information can be extracted from very limited sources, architecture design doesn’t support needs of the organization, semantic integration,
manual updates are not supported, lack of a single access point.
2.1 All metadata architectural layers are in place
(i.e. creation/sourcing, integration, metadata
repositories, delivery, usage and control/
management).
2.2 The metadata management system is
capable of extracting data from many
sources.

2.3 The system also supports manual updates,

requests, searches and lookups of metadata
by various user groups.

2.4 The managed metadata environment

separates the end-user from the various and
disparate metadata sources.

2.5 The architecture provides a single access

point for the metadata repository. This
access point provides all supply-related
metadata resources transparently.
2.6 The architecture design suits the needs of
the organization (i.e. is Centralized,
Distributed or Federated/Hybrid).

** CONFIDENTIAL ** For internal use only Page of

 Big Data Work Program – Data Architecture, Analysis
& Design

Ref Control Objectives Testing Procedures Test Results

2.7 Metadata is clearly classified as business,
technical or operational metadata.

2.8 The metadata used contains sufficient

information about data that helps reconcile
differences in terminology (e.g. Client and
Customer).
2.9 Operationally, the metadata used maintains
auditable information about users,
applications and processes that create,
delete, or change data, the exact timestamp
of the change, and the authorization that was
used to perform these actions.
3. Develop and Maintain Metadata Standards
Related Risk: Incorrect identification of standards, relevant rules are not specified and metadata elements are not grouped under the correct schemes.
3.1 Industry/Consensus standards are
understood and in place.

3.2 Relevant international standards are

understood and in place.

3.3 Metadata elements have been grouped into

sets designed for a specific purpose (e.g. for
a specific domain or a particular type of
information resource, are called metadata
schemes)
3.4 For every element, the name and the
semantics (the meaning of the element) are
specified.

3.5 Content rules (how content must be

** CONFIDENTIAL ** For internal use only Page of

 Big Data Work Program – Data Architecture, Analysis
& Design

Ref Control Objectives Testing Procedures Test Results

formulated), representation rules (e.g.,
capitalization rules) and allowed element
values (e.g., from a controlled vocabulary)
can be specified optionally. Some schemes
also specify as to which syntax the elements
must be encoded, in contrast to syntax
independent schemes.
4. Implement a Managed Metadata Environment (MME)
Related Risk: No pilot conducted to evaluate the environment, scope and strategy haven’t been defined appropriately and required integrations are not in
place.
4.1 A pilot has been conducted to prove
concepts and learn about managing the
metadata environment.

4.2 Subsequent cycles have had roadmap

planning, staff training and incremental roll-
out plan with assessment and reassessment
steps as necessary.
4.3 Metadata projects are integrated into current
IS/IT development methodology.

4.4 The MME project plan and team are in place

and the roles are clearly defined.

4.5 Data warehouse structure is tied to the MME

architecture.

4.6 The MME scope document and integration

strategy for the company are in place.

** CONFIDENTIAL ** For internal use only Page of

 Big Data Work Program – Data Architecture, Analysis
& Design

Ref Control Objectives Testing Procedures Test Results

5. Create and Maintain Metadata
Related Risk: Metadata is not appropriately maintained, resulting in low quality, inconsistent metadata that cannot be relied upon.
5.1 The data model of the repository is tailored to
meet the organization’s needs.

5.2 The metadata creation and update facility

provides for periodic scanning and updating
of the repository, in addition to the manual
insertion and manipulation of metadata by
authorized users and programs. An audit
process validates activities and reports
processes.

5.3 The quality of metadata is checked. If data

anomalies exist in the organization, they
appear correctly in the metadata and the
metadata guides the user through that
complexity.

5.4 Since quality of metadata is subjective,

business involvement in defining quality has
been present.

6. Integrate Metadata
Related Risk: Metadata is not integrated effectively resulting in inconsistent, low quality metadata.
6.1 The metadata is gathered and consolidated
from across the enterprise, including data
acquired from outside the enterprise.

** CONFIDENTIAL ** For internal use only Page of

 Big Data Work Program – Data Architecture, Analysis
& Design

Ref Control Objectives Testing Procedures Test Results

6.2 The governance process is involved in
resolving data quality matters arising from
integrating external and internal data.

7. Manage Metadata Repositories

Related Risk: Metadata repositories are not appropriately managed resulting in data quality and availability issues.
7.1 Metadata repositories are regularly backed
up. Backups are regularly tested to ensure
that metadata can be successfully restored.

7.2 Changes to the metadata repository follow a

defined change management process.

7.3 Repository interface jobs are monitored to

ensure successful completion.

7.4 Performance metrics are generated and

monitored by management to ensure that the
repositories are operating effectively.

7.5 Access to administer metadata repositories is

restricted to authorized users.

8. Distribute and Deliver Metadata

Related Risk: Metadata is not effectively distributed and delivered, resulting in unavailable information or data disclosure to unauthorized users.
8.1 Metadata delivery solutions are monitored to
ensure metadata is distributed effectively.

** CONFIDENTIAL ** For internal use only Page of

 Big Data Work Program – Data Architecture, Analysis
& Design

Ref Control Objectives Testing Procedures Test Results

8.2 Methods used to distribute metadata are
appropriate to meet business needs.

9. Query, Report, and Analyze Meta-data

Related Risk: Missing benefits of impact analysis and the implied productivity improvements, data security risks
9.1 Metadata content and usage is analyzed to
confirm that metadata is meeting business
needs.

9.2 Appropriate channels exist for business

users to access and report on metadata.

** CONFIDENTIAL ** For internal use only Page of