PRINCIPLES FOR EFFECTIVE DATA AGGREGATION AND RISK REPORTING

 PRINCIPLES FOR EFFECTIVE DATA AGGREGATION AND RISK REPORTING

• According to the Basel Committee on Banking Supervision, risk data aggregation means “defining, gathering and processing risk data according to the bank’s risk reporting requirements to enable the bank to measure its performance against its risk tolerance/appetite.”
•  The aggregation process includes breaking down, sorting, and merging data and datasets

benefits of effective risk data aggregation and reporting systems

• increased ability to anticipate problems
• In times of financial stress, effective risk data aggregation enhances a bank’s ability to identify routes to return to financial health.
• Improved resolvability in the event of bank stress or failure.
• bank is better able to make strategic decisions, increase efficiency, reduce the chance of loss, and ultimately increase profitability

Model risks include input risk, estimation risk, valuation risk, and hedging risk.

• a special subcommittee of the Basel Committee on Banking Supervision (BCBS) published a set of 14 principles to assist banks in overhauling their data aggregation and reporting processes (BCBS 239).
• The goal of BCBS 239 is to enable banks to better measure performance against risk tolerances. The expectations put forth in BCBS 239 applies to data used in model development and is relevant to managing model risks
• Model developers must demonstrate that the data used in model development is consistent with the theory and methodologies behind the model. Models must be vetted and validated. There is regulatory guidance for model developers. The Federal Reserve provides guidance to banks on effective model risk management. 
• Standards must be consistent across departments. A bank may not understand its true risks if data is not standardized
• Banks are finding it difficult to comply with BCBS 239. Senior management and the board of directors must identify issues that are preventing effective risk data aggregation and risk reporting (RDARR) and remedy deficiencies.

Principle 1—Governance

• The governance principle suggests that risk data aggregation should be part of the bank’s overall risk management framework. To ensure that adequate resources are devoted to data aggregation and reporting, senior management should approve the framework before implementation.
• Data aggregation and risk reporting practices should be as follows:
• Fully documented.
• Independently reviewed and validated by individuals with expertise in information technology (IT) and data and risk reporting functions
• Considered when the firm undergoes new initiatives, including new product development, acquisitions, and/or divestitures
• Unaffected by the bank’s structure.
• A priority of senior management, who should support risk data aggregation and reporting processes with financial and human resources.
• Supported by the board of directors, which should remain aware of the bank’s implementation of and compliance with the key governance principles set out by the Basel Committee.

Principle 2—Data Architecture and Infrastructure

• implores the bank to devote financial and human resources to RDARR, both when the bank is financially sound and when the bank is struggling due to financial stresses.
•  Principle 2 requires the following: 
• Risk data aggregation and reporting practices should be a part of the bank’s planning processes and subject to business impact analysis.
• Banks establish integrated data classifications and architecture across the banking group. Multiple data models may be used as long as there are robust automated reconciliation measures in place
• Accountability, roles, responsibilities, and ownership should be defined relative to the data. Adequate controls should be in place throughout the life cycle of the data for all aspects of the technology infrastructure.
• Data models may be used to create information on data characteristics. The main data models (also called schemas) are as follows:
• Semantic data models. These models structure data in a logical order and include semantic information such as the basic meaning of data and the relationships between data. 
• Conceptual data models.  These models map the concepts and relationships used in databases and confirm the way humans understand systems and system objectives. 
• Logical data models. Logical data models describe data in as much detail as possible. These models are not concerned with implementation. 
• Physical data models. The components required to build a database, such as the logical database components, are defined in a physical data model. The structure of a database table, including column names and values, primary and foreign keys, and relationships among tables, are included. Physical data models translate concepts and logical data into implementable data to be used in hardware/software system platforms

Principle 3—Accuracy and Integrity

• bank should be able to generate accurate and reliable risk data to meet normal and stress/crisis reporting accuracy requirements. Data should be aggregated on a largely automated basis so as to minimize the probability of errors
• principle 3 requires the following: 
• Data aggregation and reporting should be accurate and reliable.
• Controls applied to risk data should be as robust as those surrounding accounting data. To ensure the quality of the data, effective controls should be in place when the bank relies on manual processes and desktop applications such as spreadsheets and databases.
•  Data should be reconciled with other bank data, including accounting data, to ensure its accuracy. 
• A bank should endeavor to have a single authoritative source for risk data for each specific type of risk.
• Risk personnel should have access to risk data to effectively aggregate, validate, reconcile, and report the data in risk reports. 
• The production of aggregate risk information should be timely. 
• Data should be defined consistently across the bank. The bank may maintain a dictionary of risk data concepts and terms. 
• While data should be aggregated on a largely automated basis to reduce the risk of errors, human intervention is appropriate when professional judgments are required. There should be balance between manual and automated risk management systems. 
• Bank supervisors expect banks to document manual and automated risk data aggregation systems and explain when there are manual workarounds, why the workarounds are critical to data accuracy, and propose actions to minimize the impact of manual workarounds.
•  Banks monitor the accuracy of risk data and establish plans to correct poor data quality. 

Principle 4—Completeness

• a bank should be able to capture and aggregate all material risk data across the banking group. Data should be available by business line, legal entity, asset type, industry, region and other groupings, as relevant for the risk in question, that permit identifying and reporting risk exposures, concentrations and emerging risks.”
• Principle 4 requires the following:
• Both on- and off-balance sheet risks should be aggregated. 
• Risk measures and aggregation methods should be clear and specific enough that senior managers and the board of directors can properly assess risk exposures. However, not all risks need to be expressed in the same metric. 
• Bank risk data should be complete. If risk data is not complete, the bank should identify and explain areas of incompleteness to bank supervisors.  

Principle 5—Timeliness

• a bank should be able to generate aggregate and up-to-date risk data in a timely manner while also meeting the principles relating to accuracy and integrity, completeness and adaptability
• Principle 5 requires the following:
• Risk data aggregation should be timely and should meet all requirements for risk management reporting
• Systems should be in place to produce aggregated risk data quickly in stress/crisis situations for all critical risks.

Principle 6—Adaptability

• a bank should be able to generate aggregate risk data to meet a broad range of on-demand, ad hoc risk management reporting requests, including requests during stress/crisis situations, requests due to changing internal needs and requests to meet supervisory queries
• Principle 6 requires the following:
• Data aggregation capabilities should be adaptable and flexible. Adaptable data makes it easier for managers and the board of directors to conduct stress tests and scenario analysis
• A bank should be able to pull out specifics from aggregated risk data
• Effective risk reporting practices include 
• clear, complete, timely, and accurate data; 
• and reporting of risk data to the right people at the right time. In other words, the key decision-makers should have access to the data in a timely fashion to allow for good decision-making. 

Principle 7—Accuracy

• risk management reports should accurately and precisely convey aggregated risk data and reflect risk in an exact manner. Reports should be reconciled and validated
• Principle 7 requires the following:
• Risk reports should be accurate and precise
• To ensure the accuracy of risk reports, 
• the bank should define the processes used to create risk reports; 
• create reasonableness checks of the data;
•  include descriptions of mathematical and logical relationships in the data that should be verified; 
• and create error reports that identify, report, and explain weaknesses or errors in the data.
• The bank should ensure the reliability, accuracy, and timeliness of risk approximations (e.g., scenario analysis, sensitivity analysis, stress testing, and other risk modeling approaches). 
• The board of directors and senior managers should establish precision and accuracy requirements for regular and stress/crisis risk reports. 
• Bank supervisors expect banks to impose accuracy requirements on risk data (both regular and stress/crisis) commensurate with and analogous to accounting materiality

Principle 8—Comprehensiveness

• risk management reports should cover all material risk areas within the organization. The depth and scope of these reports should be consistent with the size and complexity of the bank’s operations and risk profile, as well as the requirements of the recipients
• Principle 8 requires the following:
• Reports should contain position and risk exposure information for all relevant risks
• Risk reports should be forward-looking and should include forecasts and stress tests. The bank’s risk appetite/tolerance should be discussed in the context of emerging risks
• Bank supervisors should be satisfied that the bank’s risk reporting is sufficient in terms of coverage, analysis, and comparability across institutions.

Principle 9—Clarity and Usefulness

• risk management reports should communicate information in a clear and concise manner. Reports should be easy to understand yet comprehensive enough to facilitate informed decision-making. Reports should include meaningful information tailored to the needs of the recipients 
• Principle 9 requires the following:
• reports should be tailored to the end user and should assist them with sound risk management and decision-making
• Reports will include risk data, risk analysis, interpretation of risks, and qualitative explanations of risks
• The board of directors should ensure that the bank is operating within its risk tolerance/appetite and should therefore make sure that it is asking for and receiving relevant risk information to make the determination. The mix of quantitative data versus qualitative data is important.
•  Risk data should be classified, and the bank should develop an inventory of terms used in risk reports. 
• Bank supervisors will confirm periodically that the risk data is clear, relevant, and useful for decision-making. 

Principle 10—Frequency

• board and senior management should set the frequency of risk management report production and distribution. The frequency of reports should be increased during times of stress/crisis.
• Principle 10 requires the following:
• The frequency of reports will vary depending on the recipient (e.g., the board, senior managers, and risk committee members), the type of risk, and the purpose of the report. The bank should periodically test whether reports can be accurately produced in the established time frame both in normal and stress/crisis periods. 
• In stress/crisis periods, liquidity, credit, and market risk reports may be required immediately in order to react to the mounting risks. 

Principle 11—Distribution

• risk management reports should be distributed to the relevant parties while ensuring confidentiality is maintained