Most approaches to data risk begin at the data layer: assets, schemas, catalogues. They produce detailed inventories, but they sit too far from the business processes where risk is created, managed, and owned.
Starting from the process
Business leaders do not think in data assets. They think in processes. That is where accountability sits. That is where data risk becomes real.
When you start from the business process, you can see which obligations apply at each step, where data creates risk, and what controls are required. This is not a new layer of governance. It is a fundamentally different place to start.