A small business needs five Power BI governance controls, and almost nothing else: a deliberate workspace structure, access granted through groups rather than to individuals, one agreed home for measure definitions, a named owner for every scheduled refresh with alerting when it fails, and a written note when something changes. Each one is hours of effort, not weeks, and together they prevent the four ways SME reporting actually goes wrong: the wrong person seeing the wrong data, two reports disagreeing, numbers going quietly stale, and the estate becoming a mystery when one person leaves.
Everything beyond those five is optional at SME scale. Most of what's published under "Power BI governance best practices" is written for enterprises with a BI platform team, and copying it into a forty-person business produces a committee and no reports. So here's the minimum that keeps you safe, why each piece earns its place, and what you can honestly skip.
What's the minimum governance a small business needs?
Governance has a reputation problem: it sounds like process for its own sake. So it's worth being precise about what it's for. Every control on this list exists to protect one of two things: trust (the numbers are right, and agree with each other) or continuity (the estate survives any one person leaving). If a proposed rule protects neither, an SME can skip it.
Here's the full set, with the honest effort involved and what each control prevents. There's no external statistic that measures this honestly, so this is a structured decision table drawn from what I find when I audit small Power BI estates, not a survey.
| Control | One-off effort | Ongoing effort | What it prevents |
|---|---|---|---|
| Deliberate workspace structure (a live workspace people trust, separate from where work-in-progress lives) | Half a day | Nearly none | Draft numbers reaching decision makers; "which version is real?" |
| Access via security groups, not individual grants | Half a day | Minutes per joiner or leaver | Leavers keeping access; nobody knowing who can see what |
| One home for measure definitions (a shared semantic model) | Days, if it doesn't exist yet | Small, per change | Two reports defining margin differently; board meetings about whose number is right |
| Named refresh owner + failure alerting | Hours | Minutes a week | Stale numbers presented as current; failures discovered by the audience |
| Changes written down (a one-line note per change) | None | Two minutes per change | The estate becoming a mystery only one person understands |
Five rows. If your estate has all five, you're better governed than most SMEs I look at. If it's missing two or more, the gaps are already costing you something, whether or not anyone has noticed yet.
Why do workspaces and access come first?
Because they're the cheapest controls with the scariest failure modes.
The workspace rule is one sentence: reports that people rely on live in a workspace that only finished, checked work reaches, and everything half-built lives somewhere else. The moment drafts and live reports share a home, someone will open the draft, quote its number in a meeting, and the argument that follows costs more than the half-day of setup would have.
Access through groups is the same shape. Granting workspace access person by person feels quicker on day one, and it is. The bill arrives later: someone leaves, their access lingers because nobody remembers every place they were added, and eventually a spot check finds an ex-employee who could still open the management pack. With groups, a leaver comes out of one place and every door closes at once. Payroll and margin data doesn't need enterprise information-protection tooling at SME scale, but it does need this.
Row-level security, where one report shows each person only their slice, sits behind these basics. Plenty of small businesses don't need it at all, and it deserves its own decision rather than a paragraph here.
Where should your measure definitions live?
In one place, and everyone who builds reports knows where that place is.
This is the control that protects trust directly. When gross margin is defined in one shared semantic model, every report that shows margin shows the same margin, and a question about the definition has exactly one answer. When each report carries its own copy of the logic, the definitions drift, and you end up in the situation I described in six reports, six different numbers: a business where every report is defensible and no two of them agree.
Of the five controls, this is the one that can be genuinely expensive to retrofit, because it may mean consolidating models that grew separately. That's not a reason to skip it. It's a reason to stop making the problem bigger: adopt the rule that new reports build on the shared model from today, and consolidate the legacy at your own pace.
Who should own the refresh?
A named person, and the system tells them when it fails. Both halves matter.
A scheduled refresh that fails doesn't look failed to its audience. The report opens, the charts render, and the numbers are simply last Tuesday's. A decision gets made on them. Nobody finds out until something downstream doesn't add up, and by then the question isn't "why did the refresh fail" but "what else have we been deciding on stale numbers?".
The governance fix is ownership plus alerting: one named person per scheduled refresh, and a notification that reaches them when it fails, so the gap between failure and diagnosis is hours rather than weeks. The trap to avoid is refreshes running under someone's personal credentials, which is how a password change or a leaver silently takes down reporting.
If nobody internal wants to own this, it's the exact problem the monitoring tier of my care plan exists for: from £250 a month you get refresh failures caught and alerted as they happen, diagnosed within 24 hours, plus a scored monthly health report so a slow decline shows up as a trend line rather than a crisis. But whether you buy it or run it yourself, someone must own it. "The refresh is scheduled" is not the same as "the refresh is watched".
What can a small business safely skip?
Quite a lot, and saying so out loud saves you from framework guilt.
A governance committee. At SME scale, governance is a set of habits owned by named people, not a meeting. The five controls above need an owner each, and they can all be the same person.
Certification and endorsement workflows. Power BI has formal machinery for marking datasets as certified. Useful at enterprise scale; at SME scale, the workspace rule already tells people what to trust.
A deployment pipeline. Dev, test and production stages with automated promotion are the grown-up version of the workspace rule. Worth adopting when you have multiple builders shipping frequent changes. Until then, two workspaces and discipline do the job.
Naming-convention documents beyond one page. Agree that reports and measures get plain-English names, write ten examples down, stop.
A data catalogue. When you have one shared model and a written change log, the catalogue is those two things. Buying a tool to index an estate of fifteen reports is overbuild.
The test for any addition is the same one the five controls passed: does it protect trust or continuity, in a business your size? If the honest answer is "it would at ten times our scale", it can wait until you're ten times the scale.
How do you know if your governance is already failing?
You don't need an audit to spot the symptoms. Anyone in the business can check these four this afternoon: whether two reports give different answers to the same question, whether anyone can name who owns the main refresh and would know within a day if it failed, whether a recent leaver's access was actually removed, and whether last month's report changes are written down anywhere.
If those checks come back clean, your minimum governance is working; keep it boring. If they don't, and you'd rather have the whole estate scored against a written standard than guess at how deep it goes, that's what my £950 Health Check does: 48 checks across six areas, and security and access is one of the six, checked rather than assumed.
Common questions
What does Power BI governance mean for a small business?
The small set of habits that keeps reporting trustworthy and survivable: a workspace structure that separates live reports from work-in-progress, access managed through groups, measure definitions held in one shared model, a named owner with alerting on every scheduled refresh, and changes written down. It protects two things, trust in the numbers and continuity when people leave, and at SME scale it needs no committee.
Do we need a data governance framework for Power BI?
Not at small-business scale. Published frameworks are written for organisations with platform teams and hundreds of reports, and adopting one wholesale mostly produces documents. The five controls in this post cover the failure modes SMEs actually hit. Adopt heavier machinery when your scale genuinely demands it, not before.
How should Power BI workspace access be managed?
Through security groups rather than individual grants. Put people in groups, give the groups workspace roles, and joiners and leavers become one-step changes. Individually granted access is how ex-employees end up still able to open reports months after leaving, because nobody remembers every workspace they were added to.
Who should own scheduled refreshes?
A named person per refresh, with an alert that reaches them on failure, and the refresh running under service credentials rather than someone's personal login. A failed refresh shows stale numbers that look current, which is more dangerous than an error message. If nobody internal wants the job, monitoring can be bought: my Watch tier does exactly this from £250 a month, as of September 2026.
What is workspace structure in Power BI and why does it matter?
It's the deliberate separation of finished, trusted reports from drafts and experiments, at minimum two workspaces. It matters because the alternative is decision makers opening half-built work and quoting its numbers. It's the cheapest control on the list: half a day to set up, and close to zero effort thereafter.
How do I stop two Power BI reports showing different numbers?
Put the definitions in one place. When every report builds on one shared semantic model, a measure like gross margin is defined once and every report inherits it. When each report carries its own logic, drift is a matter of time. If reports already disagree, trace both figures to their definitions and collapse them into the shared model rather than patching the symptom.
Is Power BI governance expensive to set up?
Four of the five controls are hours to half-days of one-off effort with minutes of upkeep. The exception is consolidating measure definitions into one shared model, which can be real work if your estate grew organically. Even there, the cheap version starts today: new reports build on the shared model, and legacy models get consolidated at your own pace.
Care plan and Health Check prices are from my published support and Health Check pages, September 2026. All figures exclude VAT where applicable.