New ECB guidelines on risk data aggregation and risk reporting

Figure 2: BCBS 239 - timeline

In the guide, seven major areas have been highlighted by the supervisor:

1. The responsibility of a bank’s management body
2. The scope of application of the data governance framework
3. Key roles and responsibilities for data governance
4. The implementation of a group-wide integrated data architecture
5. The effectiveness of data quality controls
6. The timeliness of internal risk reporting
7. Effective implementation programs

1. Responsibility of a bank’s management body

The ECB stresses the crucial role that the management body plays in ensuring effective risk identification, management, monitoring, and reporting, as well as adopting suitable internal control mechanisms. Inadequate knowledge, training or experience in RDARR and IT topics, or a lack of awareness of underlying risks can result in insufficient or ineffective improvements. Therefore, including the management body’s understanding of the RDARR topics into the fit and proper assessments is also among the measures considered by the ECB.

Figure 3: Summary of recommendations - responsibilities of the management body

2. Scope of application of the data governance framework

As per the ECB’s guidelines, banks should create a robust data governance framework to effectively handle risk identification, management, monitoring, and reporting. This framework should be all-encompassing, covering all material legal entities, risk categories, business lines, as well as financial and supervisory reporting processes, spanning the entire data lifecycle from inception and capture to aggregation and reporting.

Banks should clearly outline the scope of application of their data governance framework by explicitly identifying the included reports, models, risk data, and critical data elements. Additionally, they should establish transparent, proportional, and measurable criteria for determining the inclusion of material legal entities.

Figure 4: Summary of recommendations - sufficient scope of application

3. Key roles and responsibilities for data governance

The supervisor outlines the essential components needed to establish an effective data governance framework at both group and subsidiary levels. Banks are urged to clearly define the roles and responsibilities within the data quality area, as well as assign ownership for data quality across business, control, and IT functions.

Figure 5: Summary of recommendations - effective data governance framework

4. Implementation of a group-wide integrated data architecture

In order to ensure data quality for the risk, supervisory and financial reporting, the ECB points out the need of implementing an integrated data architecture at the group level. Special focus is put on data dictionaries covering main business concepts. The implementation of data taxonomies should be thoroughly documented and geared towards the provision of essential information required for guiding the institution and overseeing its risk management.

Figure 6: Summary of recommendations - integrated data architecture

5. Effectiveness of data quality controls

The ECB highlights that in order to ensure effective and comprehensive data quality controls, as well as the resolution of significant data quality problems, group-wide policies and procedures should be integrated into the broader risk management or data governance framework. This integration enhances transparency in terms of data quality risks within the defined scope.

Figure 7: Summary of recommendations - group-wide data quality management and standards

6. Timeliness of internal risk reporting

The sixth focus point of the regulator accentuates how effective risk management and identification rely on accurate, complete, and timely data. “To manage risks effectively, the right information needs to be presented to the right people at the right time”. The timeliness of risk reporting depends on two factors: how often reports are generated and the time required to create them.

The internal risk reporting frequency should be aligned with the dynamics of potential changes in risk figures. The time it takes to create a report affects risk management similarly. If an institution takes longer to generate risk reports, it prolongs the period during which the risk situation is uncertain and increases the chances of delayed responses. For the first time, a clear expectation of producing monthly and quarterly risk reports within 20 working days is communicated.

Figure 8: Summary of recommendations - timeliness of internal risk reporting

7. Effective implementation programs

Banks not yet adhering to the best practices outlined in the BCBS 239 Principles are urged to take appropriate steps to implement them. An implementation plan should be developed to address any gaps and weaknesses identified through both internal and external evaluations, which may include on-site inspections conducted by the ECB.

Figure 9: Summary of recommendations - effective implementation programs