News and views from the people who make SAS a great place to work

Principle 3:
Accuracy and Integrity – A bank should be able to generate accurate and reliable risk data to meet normal and stress/crisis reporting accuracy requirements. Data should be aggregated on a largely automated basis so as to minimize the probability of errors.

It seems logical that banks would want accurate, reliable data for day-to-day decisions and regulatory compliance, but what is accurate data? How do you define it, and what steps do you need to take to ensure that your data is accurate?

Data management, data quality and data governance are key themes in the 14 Principles of BCBS 239. Today’s post in our BCBS 239 series covers data accuracy and integrity. Take a couple of minutes to go back and read the previous posts in this series covering data governance and consistency. You should also stick with us as my colleagues and I cover the other 11 Principles.

Principle 3 sets the basis for risk data aggregation guidelines. The expectations are that aggregated data are accurate, reliable and reconciled with accounting data. Any differences after reconciliation ought to be explained. In addition, banks should strive for a single, authoritative source for risk data per risk type, recognition of the disparate systems employed across the enterprise and in many cases, the impracticality of developing a Holy Grail “Single Source of Truth.” This, however, does not negate the requirements of having a firm-wide view of all exposures across all risk areas.

Also important are the technologies employed in the process. The BCBS makes mention of spreadsheets because of the special risk they pose when used in lieu of suitable enterprise systems. Proper computing policies and procedures must be in place to mitigate spreadsheet risk. And care must be taken to have controls to archive spread sheets for audit purposes. As mentioned in Principle 2, the answers to who, what, when and why will be needed by regulators as well as internal and external auditors.

It quickly becomes apparent what a poor substitute spreadsheets are when you consider the totality of the principle. It encompasses:

• Data dictionaries.
• Controls.
• Access.
• Authoritative sources.
• Automation coupled with expert judgment.
• Firm-wide aggregation across risk types, processes and procedures.

These can be daunting requirements – even for firms that have invested heavily in modernizing their IT systems. This is why IT and strategic decisions should not be made independently from one another. Several point solution acquisitions made in a vacuum without a planned firm-wide strategic and architectural roadmap will undoubtedly prove costly during integration.

Systems with documented mechanisms for inter-platform communication will ultimately prove the most flexible. Configurable workflows to allow control, reconciliation and escalation are critical. To best leverage existing investments, a holistic offering will be modular enough to incorporate preexisting technologies rather than having to “rip & replace.”

SAS offers an intuitive platform that addresses each of the issues. SAS’ risk engine can aggregate data from disparate platforms; provide workflow for control; detail audit histories; and document risk data dictionaries of all terms, hierarchies and related resources and allow ease of exploration and search. And SAS^® Master Data Management integrates all of it. The SAS platform uses business rules to produce metrics showing the level of completeness of all areas of risk. SAS’s platform integrates with the most prevalent competing platforms.

Learn more about how SAS can help you address BCBS 239 compliance.

The 14 Principles of BCBS 239

Principle 2:
Data architecture and IT infrastructure – A bank should design, build and maintain data architecture and IT infrastructure which fully supports its risk data aggregation capabilities and risk reporting practices not only in normal times but also during times of stress or crisis, while still meeting the other principles.

In the previous post in this series on BCBS 239, Brooke Upton discussed Principle 1 and outlined the need for accurate trustworthy data and some steps you can take to meet the data governance requirements. In this post, I’ll discuss the need for data consistency and the place an integrated infrastructure plays.

The Basel Committee on Banking Supervision’s motivation for Principle 2 is to stress the importance of technology in meeting these requirements.  The view of the committee is that risk data aggregation and reporting (RDAR) systems are critical features of a financial institution.  So much so that they play a role in business continuity planning and ought to be subject to business impact analysis.  It is obvious and is reinforced, with hindsight of recent crises, the harmful effect upon firms that lacked these critical capabilities.

In particular, the principle calls for data consistency.  Institutional data dictionaries (metadata repositories) are important for ensuring consistent definitions, as well as documenting resources and the relationship between those resources.  For example, one should be able to search the term “liquidity” and see its definition as well as all other related terms (i.e. LCR, NSFR, etc.), tables, business rules, dashboards, processes, models and associated individuals (such as the liquidity risk committee members and data stewards).  Consistency in identifiers and naming conventions for legal entities, counterparties, customers and accounts are also expected.

Highly integrated systems are required to gain this level of consistency and clarity.  In the above data dictionary example, data must be fed from a company directory, data models, business rules and risk model repositories as well as ETL jobs.  This is not a trivial endeavor, and the master data management (MDM) and ETL systems have to be up to the task.  The enormity of the task becomes clearer when considering that legacy systems, point solutions, document management system and internally developed web systems may all be running competing database management systems or technologies with different semantics for resources access.  Even when those resources house identical data as is normally the case when data is fed to downstream niche systems.

Communication and controls become ever more important in light of these increased consistency and integration demands.  Owners of these systems (both business and IT) must be able to verify and certify all data entering and leaving their systems.  Failed audits are of concern for those institutions that cannot show the who, what, when and why of any data making its way into regulatory reports.

There is also the issue of aggregating data.  It is very common to have point solutions from niche vendors performing a specific area of risk.  The issue then becomes integrating risk measure across an enterprise that may have used differing assumptions, horizons or market data sources.  Having an aggregation engine that can combine this very complex data to show exposures at the aggregate level and drilldown to the most granular level is crucial.

SAS offers an intuitive platform that addresses each of the issues.  SAS’ risk engine can aggregate data from disparate platforms. Risk data dictionaries document all terms, hierarchies and related resources with ease of exploration and search. And MDM provides the integration of it all.  SAS’s platform integrates with the most prevalent competing platforms.

In the next post, I will discuss the requirements in Principle 3 - Data architecture and IT infrastructure. In the meantime, learn more about how SAS can help you address BCBS 239 compliance.

The 14 Principles of BCBS 239

Principle 1:
Governance – A bank’s risk data aggregation capabilities and risk reporting practices should be subject to strong governance arrangements consistent with other principles and guidance established by the Basel Committee.

My colleagues and I have written a series of posts on the principles of BCBS 239. In this post, I’ll focus on the requirements of Principle 1 and describe how high-performance analytics can support you.

BCBS Principle 1 requires that a set of governance processes are created and that management oversees these processes at the executive level. However, before these can be effectively enforced, the data needed to aggregate and report on regulatory compliance must be accurate and trustworthy. The goal of this principle is to hold executives beyond the CRO and across all lines of business accountable for a sustainable framework that will not only meet regulatory obligations but strengthen risk strategy and oversight.

The Basel Committee’s Working Group on SIB Supervision developed a questionnaire to identify the progress (or lack thereof) that global systemically important banks (G-SIBs) are making to meet the January 2016 BCBS 239 compliance deadline.

Read More »

The 14 Principles of BCBS 239

Interestingly, the Basel Committee’s Principles for Effective Risk Data Aggregation and Risk Reporting (otherwise known as BCBS 239) begins with a quote from T.S. Elliot’s The Rock:

Where is the wisdom we have lost in knowledge?

Where is the knowledge we have lost in information?

In this age of big data and risk data management, Elliot’s words from 1934 should not ring so true. But for the signatories of the Basel Accords, they peal painfully.  Hopefully, what doesn’t get lost in this post-financial crisis regulation is that those words are significant—not to IT risk—but to risk IT.

Read More »