More than a third of systems lacked proper controls over data collection, processing or analysis. Data quality considerations must be embedded in routine risk identification and management.