Workflow Management for Master Data: How to Make Approvals Fast, Verifiable, and Audit-Proof

What is Master Data Workflow Management?

Master data workflow management is the rule-based control of all master data creation, modification, lock, and archiving processes through defined roles, validation steps, and approval levels—with comprehensive logging of every decision. It determines who is authorized to request which data, which rules are automatically checked, who provides business-side approval, and when a data record is distributed to the operational systems.

Master data is a company’s long-term core data: customers, suppliers, materials, products, companies, and organizational units. You can find a detailed classification in our Master Data Guide. Unlike transaction data, master data is used by many processes simultaneously. An error during creation therefore carries over into every purchase order, every invoice, and every report.

A master data workflow typically consists of five elements:

• Trigger: an event such as “new supplier,” “change in bank account information,” or “material being phased out.”

• Request: a structured form with required fields instead of a free-form email.

• Automatic validation: validation rules, duplicate checks, and comparison with reference data.

• Business approval: one or more levels, depending on the risk associated with the change.

• Distribution and logging: transfer to the Golden Record, distribution to target systems, and an immutable audit trail.

Technically, such processes are often modeled using BPMN 2.0. This notation is an open standard developed by the Object Management Group and standardized as ISO/IEC 19510. The advantage is that both business units and IT teams are reading the same process model.

It is important to draw a distinction. Workflow management for master data is not the same as general workflow automation. A generic ticket system does not know the data record it is approving. A workflow integrated into master data management, on the other hand, sees the data model, the history, and all relationships of the object. It can therefore check whether a new supplier is a duplicate before anyone invests time in the approval process.

Why Workflow Management Is Relevant for Master Data

Master data processes seem unremarkable—until they fail. Five key metrics show why approval processes are not merely an administrative task, but a matter of quality, cost, and control.

Quality begins at the point of entry.

The 47% figure from the HBR study refers to newly created data records. That is the moment when a workflow kicks in. Validation rules that only take effect in the monthly quality report come too late.

Fraud exploits process gaps.

Business Email Compromise often targets a simple change to master data: A purported supplier reports new bank account information. Without the dual-control principle and reconfirmation, the next payment is diverted. The ACFE data confirms this pattern: Missing or bypassed controls are the most common lever.

Governance fails in day-to-day operations, not in concept.

Gartner explicitly recommends embedding data governance into business workflows and integrating it into day-to-day operations. This is exactly what a master data workflow does: it turns a policy into a process step that cannot be skipped.

Compliance requires traceability.

The GoBD requires that changes be made in such a way that “both the original content and the fact that changes were made remain recognizable.” For master data, it explicitly mentions version history with validity information. For personal master data, the GDPR also applies: Data must be factually accurate, and data controllers must be able to demonstrate compliance.

The Four Root Causes of Slow and Error-Prone Master Data Processes

When master data approvals take too long or incorrect data slips through, it’s rarely the fault of any one individual. Most often, the same four structural causes are at play.

Responsibility with No Ownership

In many companies, a supplier master record “belongs” to no one. Purchasing creates it, accounting adds payment terms, and quality management maintains certificates. Everyone is responsible for their own fields, but no one is responsible for the record as a whole. Without a designated data owner and data steward, every conflict ends up in an email loop.

Checking at the Wrong Stage

Many organizations check data quality downstream: via reports, spot checks, or data cleansing projects. This is costly because by that point, the error has already made its way into purchase orders and invoices. The check belongs at the point of entry—that is, in the request itself. Our guide to data quality describes how to systematically measure and resolve downstream quality issues.

Approval via Media Discontinuity

A request arrives via email, approval comes by phone, and the data is entered into the ERP system via copy-and-paste. Every media break costs time and creates errors. Above all, it leaves no verifiable record. Anyone who needs to prove during an audit who approved a bank account and when will then have to search through their inbox.

One workflow for everything

The opposite is just as harmful: Every change goes through the same three approval stages—whether it’s a phone number or an IBAN being changed. The result is overburdened approvers, backlogs, and people finding ways around the system. If you apply the same strict standards to everything, you end up not checking anything thoroughly.

It’s not a tool problem—it’s a responsibility problem

The obvious reaction to slow approvals is to look for a better tool. But a workflow tool only automates what has already been decided. If it’s unclear who approves a change, the tool simply automates that ambiguity.

A master data workflow is responsibility codified.
Each stage answers a question: Who is authorized to submit a request? Who performs the technical review? Who bears the risk? Who is authorized to override the decision in exceptional cases? Only once these questions are answered is technical modeling worthwhile.

The latest Gartner survey supports this view. Cultural resistance carries more weight than a lack of budget. Gartner also recommends establishing governance as a shared responsibility between business and technology—not as a purely IT task.

For Heads of Data and Governance Leads, this means: The first workshop should not focus on a tool demo, but on the role model. Our article on the role of data administration in organizational data management describes which roles in data management have proven effective.

Approach: Setting Up Master Data Workflows in Seven Steps

The following procedure has proven effective for master data workflow management. It starts with the events, not the software.

Step 1: Take Inventory of Events and Data Objects

For each data domain, list all events that trigger a workflow: creation, modification, extension to a new company or plant, lock, and archiving. Note how often each event occurs per month. This shows where automation has the greatest impact.

Step 2: Classify Attributes into Risk Categories

It is not the data record that determines approval, but the attribute that has been changed. A phone number is non-critical; bank account information is highly critical. The following table shows a typical pattern. The turnaround times are industry benchmarks for guidance, not standards.

Step 3: Define the Role Model

A streamlined role model is sufficient for most master data workflows:

• The requester submits the change request and provides the supporting documents.

• The data steward performs a business-related review, cleans up the data, and clarifies any questions.

• The data owner is responsible for the domain and approves critical changes.

• An approver from the business unit (e.g., Controlling, Compliance) is involved only for defined attributes.

The key is the separation of duties: The person who submits a request must not be the one to approve that same change. The system must technically enforce this, not merely recommend it.

Step 4: Move Validation to the Point of Entry

Any rule that can be checked automatically belongs in the request: required fields, format checks (e.g., IBAN check digit), duplicate checks against the golden record, and comparisons with reference lists. The data steward should only check what a machine cannot determine.

Step 5: Define Routing, SLAs, and Escalation

Set a service-level time for each approval stage. If it expires, the workflow automatically escalates to a substitute or the next level. Parallel approvals—such as purchasing and accounting simultaneously—significantly shorten turnaround time compared to sequential chains.

Step 6: Ensure an audit trail and historical data retention

Every action is logged: who, when, what, old value, new value, and reason. Master data is versioned with validity periods, ensuring that reports based on specific cut-off dates remain possible. This meets the historical data retention requirements of the GoBD and answers any audit question in minutes rather than days.

Step 7: Measure and Refine Workflow KPIs

Without key performance indicators, workflow optimization remains a matter of gut feeling. The following KPIs form a robust foundation:

Best Practices for Master Data Workflows

Start with a high-frequency process.
In most companies, supplier or material creation occurs on a daily basis. The benefits become apparent quickly, and the organization learns the new procedure through a familiar scenario.

Make the request form so thorough that follow-up questions become unnecessary.
Most delays do not occur during approval but rather when clarifying incomplete requests. Context-dependent required fields and default values from the Golden Record reduce the rejection rate.

Always confirm bank details outside the channel.
If a change notification arrives via email, confirmation should be sent using a previously stored phone number—never using the contact information provided in the same message. The workflow documents this step as a mandatory task.

Define substitutes as mandatory.
A workflow that comes to a standstill when the data owner is on vacation quickly loses acceptance. Substitution rules belong in the workflow configuration, not in the out-of-office message.

Let business units design the workflows.
When process owners can customize workflows themselves, the model remains close to reality.

Version control for workflows.
The process itself also changes. Document which workflow version was in effect at what point in time. In an audit, it’s not just what was approved that counts, but according to which rule.

Four Approaches to Master Data Workflows

Today, companies typically manage master data approvals in one of four ways. The table compares them based on the criteria that matter most to governance leads.

The table shows a clear pattern: The more heterogeneous the system landscape, the more important it becomes to have the workflow and data model in one place. This is precisely the approach taken by the Goldright Agile Data Manager.

How the Goldright Agile Data Manager Implements Master Data Workflows

The Agile Data Manager is the multi-domain MDM platform of the Goldright Enterprise Suite. It consolidates master data from isolated sources into a validated golden record—and uses this exact dataset to control the maintenance and approval processes. This means that workflows and data are not stored in two systems, but in one.

Business Process Engine in BPMN.
The Agile Data Manager’s Business Process Engine controls and automates data maintenance and approval workflows based on BPMN. The workflow designed by the business unit and IT during a workshop can thus be executed directly—without needing to be translated into a separate ticket system.

Multi-level approvals and the dual-control principle.
Approval levels can be tiered according to risk. Routine changes undergo a streamlined review, while sensitive attributes such as bank account information or tax ID numbers are subject to the dual-control principle. In this way, the risk class model from Step 2 becomes a technically enforced rule.

Integrated governance.
Ownership and responsibilities are managed centrally within the platform. The Enterprise Suite’s authorization model extends down to the level of individual data objects and attributes. Who is authorized to request, review, or approve is no longer a matter of agreement but of configuration.

Approvals with Full Data Context.
Because the workflow runs on the Golden Record, data stewards and data owners see not just a form, but the actual data record with its relationships and provenance. Data cleansing and reconciliation are automated, and data lineage remains fully traceable.

Timestamp History and Audit Security.
Every change is documented and logged. The timestamp history enables reports based on specific dates—the technical solution to the GoBD requirement to log master data with validity information.

Distribution via Configurable APIs.
Approved data flows into ERP, CRM, and BI systems via bidirectional interfaces. The Enterprise Suite is also available in the SAP Store. There is no need to manually enter approved data into the target system.

AI under the same rules.
Through the AI Assistant and native MCP integration, AI applications access the Golden Record—subject to authorization checks and documented in the audit trail. AI thus becomes part of the controlled process rather than a workaround that bypasses it..

The following overview maps the requirements from the solution approach to the functions of the Agile Data Manager:

Case Study: Material Master Data Creation at a Mechanical Engineering Company

An anonymized sample project from MDM practice.

Initial Situation

A medium-sized machinery manufacturer with multiple plants creates new material master records every week. The design department initiates the process using an Excel template. Purchasing, production planning, controlling, and sales each add their respective views one after the other. Each department waits for the previous one to finish. Incomplete templates are returned via email, and duplicates are not noticed until the order is placed.

Diagnosis

All four root causes are evident. No one is responsible for the material master data as a whole. Verification takes place downstream. Each handoff represents a change in medium. And every material goes through the same chain, whether it’s a standard part or a safety-critical assembly. Inconsistent material master data is a typical bottleneck for demand planning and production in the manufacturing industry.

Implementation with the Agile Data Manager

The project team first defines the role model: one data owner for the “Material” domain and one data steward per plant. Roles and permissions are stored in the Agile Data Manager’s integrated governance system. The Excel template is replaced by a workflow modeled as a BPMN process in the Business Process Engine. All business units update their views directly in the Golden Record within the same workflow, rather than passing files back and forth. Approval is tiered based on risk: standard parts go through a single approval level, while safety-critical assemblies follow the dual-control principle with additional approval by Quality Assurance. Approved materials are transferred to the ERP system via configurable APIs.

Result

Every approval is documented in a traceable, time-stamped history. Queries are resolved within the workflow rather than via email. Duplicates are visible in the Golden Record before a material is ordered. And the material master serves as the single source of truth for all plants. More important than any individual figure: The company now measures lead time and the first-time-right rate and can make targeted improvements.

Übertragbarkeit

The same approach works for supplier setup, customer master data, or maintaining organizational structures. Our article on product master data illustrates just how important clean material data is for day-to-day operations.

Pitfalls: What Goes Wrong with Master Data Workflows

Digitizing the current process exactly as it is.
If you simply transfer the existing email chain into a workflow tool, you end up with a faster version of a bad process. Question every step: What risk does it address?

Too many approval levels.
Each additional level extends the turnaround time and dilutes responsibility. Three approvals often mean that everyone relies on the other two.

Unmonitored emergency bypasses.
Urgent cases always arise. But if the bypass isn’t logged and reviewed afterward, it becomes a backdoor. ACFE statistics show how often bypassed controls are the cause of losses.

Workflow without data context.
An approver who sees only a form cannot assess whether the “new” supplier already exists under a different name. Display the history and related data records during the approval step.

Lack of visibility into target systems.
A perfectly approved data record is of little use if it has to be manually transferred to the ERP system. Distribution is part of the workflow.

AI without governance.
Gartner expects GenAI to accelerate the time-to-value of governance and MDM programs by 40% by 2027. AI suggestions for classification or duplicate detection are valuable—but they should be included in the workflow as a verification step, not as an unchecked direct change. For high-risk AI, the EU AI Act requires documented data preparation steps such as cleansing, updating, and enrichment anyway.

Conclusion: Master Data Workflow Management Is Governance in Action

Master data workflow management is not merely an administrative issue. It is where governance policies first intersect with day-to-day operations. This is where it is determined whether quality rules take effect before an error occurs, whether critical changes—such as bank details—are effectively controlled, and whether every decision can be substantiated during an audit.

The data is clear. Nearly half of newly created data records contain critical errors. Fraud exploits missing or bypassed controls. And governance fails more often due to culture than to budget—which is why Gartner recommends embedding it directly into workflows.

The path to achieving this begins not with a tool, but with accountability. By clarifying roles, classifying attributes by risk, moving verification to the point of entry, and measuring the right KPIs, organizations can make approvals both faster and more secure. A workflow that operates directly on the Golden Record bridges the gap between process and data: every approval sees the full context, every change is logged, and every distribution is centralized.

Companies that set up their master data workflows in this way achieve more than just efficiency. They create a robust foundation for compliance, automation, and AI applications that rely on reliable data.

Your next step: Use the Governance Maturity Check to assess the current scope of your roles, approvals, and controls. Or talk to us about how the Agile Data Manager maps your master data workflows.

Sources

ACFE – Association of Certified Fraud Examiners: Occupational Fraud 2024: A Report to the Nations - acfe.com

Bundesministerium der Finanzen: GoBD – BMF-Schreiben vom 28.11.2019, Rz. 58 und 111 - PDF

European Union: Regulation (EU) 2016/679 (DSGVO), Art. 5. - eur-lex.europa.eu

European Union: Regulation (EU) 2024/1689 (AI Act), Art. 10. - artificialintelligenceact.eu

FBI Internet Crime Complaint Center: 2024 IC3 Annual Report, 2025. - ic3.gov

Gartner: Gartner Predicts 60% of Organizations That Ignore Data Governance Culture Challenges Will Fail to Govern AI Successfully by 2027, Pressemitteilung - gartner.com

Gartner: Gartner Predicts 80% of D&A Governance Initiatives Will Fail by 2027 - gartner.com

Gartner: Data Quality: Why It Matters and How to Achieve It (Research 2020) - gartner.com

Nagle, T.; Redman, T. C.; Sammon, D.: Only 3% of Companies’ Data Meets Basic Quality Standards, Harvard Business Review - hbr.org

Object Management Group: Business Process Model and Notation (BPMN) 2.0.2, ISO/IEC 19510. - omg.org