Forget the Maturity Score. Run the Who-You-Know Test.

Maturity assessment week ends the same way, I suspect, almost everywhere. The workshops are done, the heat map is coloured in, and a hand goes up at the back of the room. So where are we? What is our number?

I have watched that hand go up myself, and it is a fair question; a number feels like progress, and progress feels like something you can report upward.

The person everything depends on. Nobody decided that; it just happened.

In my first book I offered a cheaper method. If you are an insider and old rice in your organisation, you do not need the workshops. Close your eyes, put your hands on your heart, and ask yourself which tag your data culture honestly deserves: Champion, Achiever, Player, Mediocre, or Loser. I have noticed something about that last word. The organisations most likely to sit at that level are also the most likely to object to the label and ask for something softer, Laggard perhaps. An organisation that argues about the word rather than the level has just told you its level.

But there is a measure I trust even more than the hands on the heart. It costs nothing, takes ten minutes, and tells you more about your organisation’s data governance than any framework score.

I call it the who-you-know test.

The Test

The test of a governed organisation is not how many rules it has written. It is how few of its decisions depend on who you know.

Think about what that means in an ordinary week. In a well governed system, you get access to a dataset because a rule grants it, and it would feel strange to ask a favour for it. In a badly governed one, the favour is how things actually get done. Both organisations may own the very same policy documents. This is the same trap I wrote about in the first article of this series, where a country can own a magnificent constitution and still run on knowing the right clerk. The difference is not in the text; it is in what actually answers the question when the question arrives.

So run the test. Pick the three most important recurring decisions in your data estate:

• Who gets access to something sensitive.
• Who settles what a key term really means.
• Who signs off a change to a critical system.

For each one, write down not what the policy says should happen, but what actually happens. Does a rule answer the question, or does a particular person have to be reachable, willing, and in a good mood?

Count the decisions that run on who-you-know rather than what-the-rule-says. That count is your real maturity score.

Why the count matters

A decision that depends on a person rather than a rule is not just slower. It is fragile in a way that stays invisible until the worst moment.

The person who holds the keys is helpful, so nobody minds asking. The person who knows what the numbers really mean is generous with their time, so nobody writes it down. It all works, right up until the Friday that person hands in their notice, and the organisation discovers how much of its governance was actually one individual’s goodwill. Goodwill is not a control; it holds only while the person is willing, available, and still in the building.

There is a second cost, and it is the one that gets executive attention. When a decision belongs to a person rather than a documented role, you cannot prove to an auditor, a regulator, or a court that it was made correctly. You can only say that the person we trusted made it. In a world where privacy and security laws tighten every year, an unprovable decision is itself a liability, whatever its quality.

What the count is telling you

If your three decisions all run on rules, be glad, and be honest about whether that would still be true on the day the rule became inconvenient for the most senior person in the building.

If two of the three depend on a person rather than a rule, you have not failed an assessment. You have found something more useful than a score: the exact place where the work starts. The fix is not a bigger framework or a new tool. It is moving each of those decisions, one at a time, from a person to a role, writing down the rule under which the role decides, and keeping the record as decisions are made.

That is smaller than a governance program, and that is the point. A program can be postponed for years. Moving one decision from a person to a role can start on Monday.

Try the test this week. I am genuinely curious what most organisations count, and I suspect the honest answers would surprise the people who commissioned the frameworks.

The who-you-know test comes from Chapter 2 of my upcoming second book, where it sits inside a larger argument: a maturity score is a photograph, but governance is a muscle, a capability you keep alive rather than a state you reach. The chapter goes on to what that capability actually produces, and the one hard test I now apply to my own work before I call it finished. The whole book is built from a real council engagement, where the method was applied in full. More soon.

Remove Tech Debt. Uplift Governance.