Example output · Information Governance Consultancy
Information Governance Accountability & Assurance Matrix
This illustrative matrix demonstrates how an organisation can connect important information assets and processing activities to accountable owners, governance obligations, supporting evidence, review responsibilities, assurance status and improvement actions.
Illustrative example only. All entries are fictional and contain no client information. Statuses describe example evidence positions, not verified assessments or certifications. Applicable obligations, governance roles, controls and review frequencies depend on the organisation’s activities, sector and risk profile. These are established during an engagement. This example is not legal advice.
| Information asset or processing activity | Accountable owner | Governance obligation | Control or evidence expected | Review responsibility | Assurance status | Improvement action |
|---|---|---|---|---|---|---|
| Employee (HR) records | People Director | Retention, secure disposal and UK GDPR accountability | Approved retention schedule; documented disposal records | Information Governance Lead — annually* | Partially evidenced | Record and verify disposal decisions against the approved schedule |
| Customer or service-user records | Operations Director | Documented lawful basis; appropriate access controls | Record of processing activities; access review evidence | Data Protection Lead / DPO, where appointed — quarterly* | Evidenced | Maintain and document the established review cycle |
| Contracts and supplier records | Head of Legal | Appropriate retention and contractual safeguards for personal-data processing | Contract register; documented supplier roles; applicable processor agreements | IG Committee — six-monthly* | Gap identified | Confirm required contractual safeguards for flagged suppliers |
| Data shared with an external partner | Senior Information Risk Owner | Documented sharing purpose, lawful basis, responsibilities and appropriate safeguards | Information-sharing record; applicable data-sharing agreement or protocol; documented roles | IG Committee — on renewal and material change* | Not yet assessed | Inventory sharing arrangements and assess applicable legal roles and controls |
| New system holding personal data | Project Sponsor | Data protection by design; DPIA screening and a DPIA where required | Screening record; completed DPIA where indicated; documented approval decision | Data Protection Lead / DPO, where appointed — before go-live | In progress | Complete screening, undertake any required DPIA and resolve material findings before approval |
| Board and committee papers | Governance or Board Secretariat | Appropriate retention and protection of governance decision records | Approved retention schedule; controlled minutes and decision archive | Governance Committee — annually* | Evidenced | Maintain the approved controls and scheduled review |
*Review frequencies are illustrative, not universally prescribed regulatory intervals. Organisations should establish them according to their legal obligations, risks and governance arrangements.
Understanding the assurance statuses
- Evidenced
- The specified evidence has been reviewed and supports the control being assessed. It does not establish overall regulatory compliance.
- Partially evidenced
- Some supporting evidence has been reviewed, but identified gaps remain.
- In progress
- The required work is underway, with an assigned owner and planned completion date.
- Gap identified
- A required or expected control, document or item of evidence is missing or inadequate.
- Not yet assessed
- The activity has been recorded, but the relevant evidence has not yet been reviewed.
How to use this matrix
- Prioritise by risk. Start with information assets and processing activities that carry the greatest regulatory, operational or organisational significance.
- Establish accountability. Identify one accountable owner for each activity, alongside appropriate review and oversight responsibilities.
- Identify the evidence. Document the controls, records and assurance information needed to demonstrate effective governance.
- Assess accurately. Record each status according to the evidence reviewed, recognising that assurance is specific to the control and scope assessed.
- Drive improvement. Assign actions, owners and target dates, then report progress through the appropriate governance forum.
Want a matrix tailored to your organisation?
Discuss the governance outputs, ownership arrangements and assurance evidence your organisation needs.
Talk to a Senior Practitioner