Charta is on Google Play: practise on the go. Get the app
Charta

Summarize the central principles of governance covering both risk data aggregation and risk reporting.

FRM® Part I · Foundations of Risk Management · Principles for Effective Data Aggregation and Risk Reporting · FRM1.FR.7.c

The idea

Governance is the first and overarching principle of the Basel Committee framework for risk data aggregation and risk reporting. The board and senior management are responsible for ensuring that aggregation capabilities and reporting practices are subject to strong governance, consistent with the other principles. In practice the capabilities are fully documented and subject to high validation standards. That includes independent validation by people who do not produce the data. The board and senior management must understand the limitations that prevent full aggregation and approve plans to fix them. They must provide adequate resources and assign data ownership. They must also consider the effect on aggregation of strategic decisions such as acquisitions and IT changes. The principles cover outsourced processes too, because the bank stays responsible. Exam point: responsibility sits with the board and senior management, never with IT alone or the vendor.

A practice question

From the question bank, with the reason each wrong option is wrong.

Who is ultimately responsible for ensuring that a bank's risk data aggregation capabilities and risk reporting practices are subject to strong governance?

  1. The information technology department, because it owns the systems that produce the dataWhy not: Assigns a governance duty to the system owner. Responsibility sits with the board and senior management.
  2. The external auditor, who must certify the risk data every year before reports are releasedWhy not: The external auditor is not the owner of the data process. Governance responsibility lies inside the bank.
  3. The board and senior management - correct
  4. The supervisor, through periodic review of the data capabilities of the bankWhy not: Supervisors review compliance but do not hold the bank's governance responsibility.

The first principle assigns responsibility to the board and senior management. IT, auditors and supervisors have roles, but governance is not delegated to them.

A harder one

A bank outsources part of its risk data processing to a specialist vendor. How do the governance principles apply?

  1. Responsibility passes to the vendor under the contract, so the board is relieved of oversight of the dataWhy not: Outsourcing does not transfer responsibility. The bank remains accountable for its data capability.
  2. They apply to outsourced processes as well, and the bank remains responsible for meeting them - correct
  3. Outsourcing is permitted only if the vendor is itself a regulated bank, since only banks can process risk dataWhy not: Invents a restriction. The principles do not limit outsourcing to regulated banks.
  4. Only the vendor's own internal audit needs to validate the data, and the bank's validation function has no roleWhy not: Treats the vendor as the sole validator. The bank must still ensure and validate, with independence.

The principles cover outsourced arrangements: the bank cannot hand its governance responsibility to a vendor and must ensure the standards are met.

The hardest tier

A bank plans to acquire another institution. Which action best shows the governance principle for risk data aggregation being applied?

  1. Assessing the effect on aggregation capability as part of due diligence and ensuring the integration plan addresses it - correct
  2. Assessing the effect on aggregation only after the deal has closed and the two sets of systems are mergedWhy not: Wrong timing. Governance expects the effect on capability to be considered in strategic decisions beforehand.
  3. Delegating every data decision to the IT function so that the board's role ends with approving the priceWhy not: Delegates away board and senior management responsibility. Governance cannot be left to IT.
  4. Waiving the principles for the acquired entity until it becomes profitable for the groupWhy not: No such exemption exists. The standard applies regardless of how profitable an entity is.

Strategic decisions such as mergers and IT changes should take account of their effect on aggregation capability, with board and senior management ownership. Leaving it to after the deal or to IT fails that.

In the app: 6 practice questions on this outcome, spaced review that brings it back before you forget it.

Start free →

More in Principles for Effective Data Aggregation and Risk Reporting