Keeping Governance Alive: A Longitudinal Assessment of Data Governance Adoption and Executive Risk Reporting in Fintech Firms in Lagos

References

[1] Abraham R, Schneider J, vom Brocke J (2019). Data governance: A conceptual framework, structured review, and research agenda. International Journal of Information Management, 49, 424–438. https://doi.org/10.1016/j.ijinfomgt.2019.07.008

[2] Argyris C, Schön DA (1978). Organizational learning: A theory of action perspective. Addison-Wesley.

[3] Arner DW, Barberis J, Buckley RP (2016). The evolution of fintech: A new post-crisis paradigm? Georgetown Journal of International Law, 47(4), 1271–1319.

[4] Basel Committee on Banking Supervision (2013). Principles for effective risk data aggregation and risk reporting (BCBS 239). Bank for International Settlements, Basel. https://www.bis.org/publ/bcbs239.pdf

[5] Central Bank of Nigeria (2018). Risk-based cybersecurity framework and guidelines for deposit money banks and payment service providers. Central Bank of Nigeria, Abuja.

[6] Central Bank of Nigeria (2021). Regulatory framework for open banking in Nigeria. Central Bank of Nigeria, Abuja.

[7] Crossan MM, Lane HW, White RE (1999). An organizational learning framework: From intuition to institution. Academy of Management Review, 24(3), 522–537. https://doi.org/10.5465/amr.1999.2202135

[8] DiMaggio PJ, Powell WW (1983). The iron cage revisited: Institutional isomorphism and collective rationality in organizational fields. American Sociological Review, 48(2), 147–160. https://doi.org/10.2307/2095101

[9] Eisenhardt KM, Martin JA (2000). Dynamic capabilities: What are they? Strategic Management Journal, 21(10–11), 1105–1121.

[10] Federal Republic of Nigeria (2023). Nigeria Data Protection Act 2023. Federal Government Printer, Abuja.

[11] Feldman MS, Pentland BT (2003). Reconceptualizing organizational routines as a source of flexibility and change. Administrative Science Quarterly, 48(1), 94–118. https://doi.org/10.2307/3556620

[12] Financial Reporting Council of Nigeria (2018). Nigerian Code of Corporate Governance 2018. Financial Reporting Council of Nigeria, Abuja.

[13] Institute of Internal Auditors (2020). The IIA's three lines model: An update of the three lines of defense. Institute of Internal Auditors. https://www.theiia.org

[14] Jaakkola E (2020). Designing conceptual articles: Four approaches. AMS Review, 10(1–2), 18–26. https://doi.org/10.1007/s13162-020-00161-0

[15] Khatri V, Brown CV (2010). Designing data governance. Communications of the ACM, 53(1), 148–152. https://doi.org/10.1145/1629175.1629210

[16] Meyer JW, Rowan B (1977). Institutionalized organizations: Formal structure as myth and ceremony. American Journal of Sociology, 83(2), 340–363. https://doi.org/10.1086/226550

[17] National Information Technology Development Agency (2019). Nigeria Data Protection Regulation 2019. NITDA, Abuja.

[18] Nigeria Data Protection Commission (2025). Nigeria Data Protection Act General Application and Implementation Directive (GAID) 2025. NDPC, Abuja. https://ndpc.gov.ng

[19] Oliver C (1991). Strategic responses to institutional processes. Academy of Management Review, 16(1), 145–179. https://doi.org/10.5465/amr.1991.4279002

[20] Tallon PP, Ramirez RV, Short JE (2013). The information artifact in IT governance: Toward a theory of information governance. Journal of Management Information Systems, 30(3), 141–178. https://doi.org/10.2753/MIS0742-1222300306

[21] Teece DJ (2007). Explicating dynamic capabilities: The nature and microfoundations of (sustainable) enterprise performance. Strategic Management Journal, 28(13), 1319–1350. https://doi.org/10.1002/smj.640

[22] Teece DJ, Pisano G, Shuen A (1997). Dynamic capabilities and strategic management. Strategic Management Journal, 18(7), 509–533.

[23] Weill P, Ross JW (2004). IT governance: How top performers manage IT decision rights for superior results. Harvard Business School Press.

[24] Whetten DA (1989). What constitutes a theoretical contribution? Academy of Management Review, 14(4), 490–495. https://doi.org/10.5465/amr.1989.4308371

@article{1724137,
      author = {Onyinye Lydia Abuo},
      title = {Keeping Governance Alive: A Longitudinal Assessment of Data Governance Adoption and Executive Risk Reporting in Fintech Firms in Lagos},
      journal = {Iconic Research And Engineering Journals},
      year = {2026},
      volume = {10},
      number = {4},
      pages = {5133-5140},
      issn = {2456-8880},
      url = {https://www.irejournals.com/formatedpaper/1724137.pdf},
      abstract = {Lagos fintech companies have responded to the pressure from the regulators with data governance but the adoption has been considered as a one-off event. Policies are drafted, a data protection officer is appointed, and an audit is registered but the processes that are involved in creating these artifacts tend to become weak when the products increase, staff rotate, and attention turns to other matters. This decay will reduce the quality of the data that the executives and boards will see in executive risk reporting. The literature on data governance (Abraham et al., 2019; Khatri & Brown, 2010) describes the design of governance and how it is being adopted. It does not detail how governance lasts and no model is found between sustainment and executive risk reporting of Lagos fintechs. This conceptual review aims to fill this gap. Based on the institutional theory, organisational learning, dynamic capabilities and the three lines model, it will build the Governance Sustainment and Risk Reporting Framework (GSRRF). The four stepping stones of the framework are adoption, embedding, drift detection and renewal. There are governance activities in each stage, an executive reporting output for each stage and a review trigger for each stage. A feedback loop is illustrated to demonstrate how governance drift can be identified through risk reports, and how it can trigger renewal. The paper proposes a time-based model of governance sustainment, five propositions that can be tested in future multi-wave studies, and useful recommendations for firms, boards and regulators like Nigerian Data Protection Commission (NDPC) and Central Bank of Nigeria (CBN).},
      keywords = {Data Governance; Fintech; governance sustainment; executive risk reporting; institutional theory; dynamic capabilities; regulatory compliance},
      month = {October},
      doi = {https://doi.org/10.64388/ire1724137}
  }