Rising to the BCBS 239 Challenge

BCBS 239 presents banks and other financial

institutions with a significant challenge and a

unique opportunity. There are many pitfalls which

will need to be avoided for firms to create lasting

value.

A practitioner’s view by

Barney Walker,

Head of Banking

Practice, Kinaesis.

Barney Walker

Head of Banking Practice

barney.walker@kinaesis.com

Kinaesis.com

There’s no doubt that the Basel Committee on Banking

Supervision’s “Principles for Effective Risk Data

Aggregation and Risk Reporting” (BCBS 239) represents a

huge step forward in risk management practices for the

industry. However, implementation of the principles by

January 2016 presents banks with a major technology,

governance and operational challenge.

In order to comply with the principles, firms need to sort

out areas of traditional weakness – enterprise level data

quality, governance, warehousing, aggregation and

reporting processes. Enterprise data sourcing, quality and

governance are topics that have been too often ignored or

sidelined as the difficult child that we don’t quite know how

to handle. Significant catch up is needed in both technology

and in adopting an effective data management operating

model. Conversely data aggregation and reporting has often

been lavished with generous investment budgets. However,

these projects have high failure rates (partly due to failure

to solve the data challenges mentioned above). Gartner

research (1) estimates that 70% to 80% of business

intelligence projects fail to meet their business objectives.

So a perfect storm is forming: the need to correct the sins of

the past; in an area of high historic project failure; against a

fixed regulatory timeline. Banks need to act with urgency

and precision. And it’s also not just major banks that need

to get their ducks in a row. The Financial Stability Board

(FSB) (2) has made clear that these improvements will need

to be adopted by all systemically important financial

institutions (SIFIs).

However, it’s not all doom and gloom. Digging into the

principles they predominantly talk, in very clear terms, of

system and process qualities: accuracy and integrity;

completeness; timeliness; adaptability; comprehensiveness;

clarity and usefulness. Simply put, they are the excellent top

level requirements for an effective enterprise MIS system.

Any successful investment in this area will provide

significant leverage and will add lasting enterprise value.

“Strong risk management capabilities are an integral part of

the franchise value of a bank. Effective implementation of

the Principles should increase the value of the bank. ” (3)

This paper explains BCBS 239 in more detail and makes

recommendations for how firms can accelerate adoption

and deliver a high performance data management

infrastructure.

BCBS 239 – a recap

The BCBS 239 principles cover four closely related topics (a

one page BCBS 239 “primer” with a full list of the principles

is included at the end of this paper):

1. Overarching governance and infrastructure – Firms need

to put in place strong governance and ownership for their

data aggregation and risk reporting framework. An effective

operating model needs to be implemented covering people,

policies, process, organisation and infrastructure. The

infrastructure must support all reporting requirements for

normal and stress or crisis situations.

2. Risk data aggregation capabilities – Robust, high

performance systems are needed to ensure risk reports are

accurate, timely and complete. The platform also needs to

be flexible and adaptable. It needs to meet the evolving

internal reporting needs of the firm and external reporting

requirements of supervisory bodies. Enterprise data

dictionaries need to be documented. Comprehensive

controls around data sourcing and quality must be put in

place, including reconciliation to all sources and single

sourcing of each type of risk where feasible.

3. Risk reporting practices – This set of principles, very

closely intertwined with data aggregation capabilities,

focuses on making the risk reporting and management

process effective and practical. As the BCBS 239 document

puts it "data alone does not guarantee that the board and

senior management will receive appropriate information to

make effective decisions about risk." The scope covers

reporting and management of all significant risk areas, with

each risk area needing to be broken down into all significant

components. Risk reports also need to cover any significant

related measures, for example regulatory and economic

capital. And it's not just about current and historic reporting.

Forward looking assessments of likely trajectory of capital

and risk profile need to be part of the solution. The reporting

must be useful, clear, comprehensive, timely, produced at

an appropriate frequency and supported by an effective

operating model.

4. Supervisory review, tools and cooperation - The principles

will be backed by regular supervisory review, in addition to

the independent review structure that firms are expected to

establish. Where implementation is found to be deficient,

supervisory bodies will set remedial actions, including capital

add-ons, as both a mitigant and an incentive under pillar 2.

Barney Walker

Head of Banking Practice

barney.walker@kinaesis.com

Kinaesis.com

Aren’t these just basic good business practices?

The BCBS 239 principles form the foundations of how to

manage risk effectively in a large financial institution. In

addition to this need for a step change improvement in risk

management practices, profitability also remains a major

issue. Financial firms face huge challenges generating

adequate returns. With diminishing margins and increasing

capital needs there is a much greater requirement for

information that will drive profitable business activity and

efficient use of scarce resources. Measures such as return

on regulatory and economic capital, return on equity and

balance sheet usage are no longer just ethereal concepts

discussed periodically at board meetings and commented

on in annual reports. They are key metrics needed to run

and control businesses on a daily basis at all levels of

management.

It’s clear when studying the BCBS 239 principles that

successful implementation will provide the framework for

these broader management reporting needs. So yes –

these are just basic good business practices. However, it

doesn’t mean that implementing them is straightforward.

Especially if they are an after-thought.

Easier said than done

Although the BCBS 239 principles seem like common sense

and good business practice, it doesn’t diminish the

challenge of righting the data and information wrongs that

have built up over many years. Even those firms that

invested in enterprise data warehouses before the crisis,

found difficulty in extracting the joined up information that

they needed. There were quality and coverage problems.

Systems weren’t able to adapt to the vastly different

demands of managing a firm in a crisis situation. Reporting

took too long and it couldn’t be tailored fast enough. It

lacked the coverage needed and it was rife with data

quality problems and inconsistencies.

In Deloitte’s global risk management survey, eighth edition

(4), published in 2013, banks were asked to assess their

current risk management and infrastructure capabilities,

with some sobering results. Although 72% of banks rated

themselves as very effective at managing risk overall, serious

concerns persist over risk management systems, data and

infrastructure. Systems for managing operational and

enterprise risk were rated as very effective by only 38% and

32% of banks respectively. The results for risk data

capabilities were even worse. Only 31% rated data quality

capabilities very effective, 28% rated data governance very

effective, 21% rated data standards very effective and just

20% rated data management very effective. The survey

highlighted the banks’ most pressing concerns about their

risk management IT systems. Notably 40% of banks were

extremely or very concerned about quality and management

of risk data and 34% were extremely or very concerned

about the ability of their risk technology to adapt to

changing regulatory requirements.

The problem with this survey with respect to BCBS 239 is

that the principles are holistic. You cannot be considered to

have effective overall risk management without all of the

pieces, including data strategy and infrastructure, being

effective. To say a firm has very effective risk management

but deep concerns over data management and quality is an

oxymoron.

Another challenging aspect of the BCBS 239 principles is

that, although they provide an excellent framework, they are

very broad and do not present a set of specific measurable

requirements that firms must implement in order to comply.

These two factors should sound alarm bells for those with

implementation responsibility.

When you put the laundry list of requirements together the

scale of the challenge becomes clear. To summarise, the

solution must cover:

• Implementation of an effective operating model that

covers data quality, governance, reporting process

and risk management that supports effective

executive review and decision making.

• Covering all significant types of risk including credit

risk, market risk, liquidity risk and operational risk.

• With all risk areas broken down into their significant

factors.

• Plus all significant related measures included, for

example regulatory and economic capital.

• Presented together in a useful, clear, comprehensive

and timely manner.

• Produced at an appropriate frequency.

• Catering for normal and stress or crisis conditions.

• Backed by robust data quality controls including

reconciliation to all sources.

• Also backed by a comprehensive data dictionary

covering all key data, models, calculations and

approximations.

Add in the need to be adaptable and flexible enough to

cater quickly for emerging new risks and you have a

Barney Walker

Head of Banking Practice

barney.walker@kinaesis.com

Kinaesis.com

somewhat hair-raising combination of requirements. With

regulatory deadlines approaching there is a significant risk

that some requirements are de-prioritised or that solutions

fail to deliver anywhere near their potential value.

Reaching the bright light at the end of the tunnel

Major financial firms already have programs in place to

reach compliance with BCBS 239. The technology and

operating model challenges are solvable. They can be

overcome by ensuring the project team has the right expert

skills and experience. Past performance shows us that this is

not a domain for generalists – specialist skills and practical

experience of implementing high performance data and

reporting infrastructures are needed to succeed. Proven

methodologies, particularly in analysing data requirements

and solutions need to be followed.

In many cases focus and acceleration is needed, particularly

in the three areas described below.

Clear measurable and testable requirements – Without

defining quantified, testable requirements covering the full

scope of the program firms will have little chance of

successfully complying with the principles. Industry surveys

regularly point to poor requirements quality as the primary

cause of project failure, for example Meta Group research

found that 60% - 80% of project failures can be attributed

directly to poor requirements gathering, analysis and

management. Given that the BCBS 239 principles are high

level, unquantified and non-prescriptive (in terms of how

they should be implemented) this step is critical.

Data – Firms need to face up to the realities of their data. If

your data is broken you just need to fix it. It isn’t just a

technology fix. Firms need to understand their data fully,

documenting definitions and standards in an enterprise

data dictionary. A detailed understanding of data lineage,

ownership, temporality and data life-cycle is needed. This

definition should drive definition and implementation of an

operating model for managing quality and instituting

effective data governance. Data, methodologies and

calculation need to be harmonized through the silos of the

organisation. Definitions and populations of point in time

cuts of data need to be carefully documented and

controlled. This requires advanced data modeling expertise,

proven data management methodologies and practical

experience of solving enterprise reporting challenges.

Architecture – The BCBS 239 principles pose particular

challenges due to the scale and coverage of data, the timely

manner in which it’s needed and the need to be adaptable

and flexible. It is unlikely that one size fits all and that there is

a single technology solution for the majority of firms. The right

approach is to use a combination of best of breed

technologies in a layered approach that supports both the

functional and non-functional requirements. Between each of

these layers, a very careful and considered integration needs

to exist. Interactions and data flows need to be carefully

planned to ensure that the system delivers. Expertise in high

scale data management architectures, metadata

management, data analytics and reporting is needed to

navigate to the right solution.

Conclusions

The principles and their implementation need to be a top

priority and focus for banks. Gaps exist in areas such as data

strategy and infrastructure. Firms must put the right expertise

in place to close these gaps quickly. The BCBS 239 text is very

clear on ownership - the board and senior management are

responsible for putting the solution in place, understanding its

capabilities and limitations and continuing to maintain it.

Practices across different firms will be compared by

supervisory bodies - the implication being that benchmarks

will be set based on best in class implementation across the

industry. So failure to keep up with the Joneses will have a

cost. However, successful implementation will create

significant lasting value.

How Kinaesis can help customers with BCBS 239

At Kinaesis we combine expertise in high scale data

management architectures, metadata management and data

analytics with proven information architecture methodologies

and deep experience of risk data and finance. From

assessment of where our customers are against the Kinaesis

Enterprise Information Maturity (EIM) Model to delivery

based on the Kinaesis Best Practice Methodology we use out

of the box components and templates to accelerate

customer’s projects and ensure value delivery. Kinaesis offer

proven data services to accelerate delivery and to reduce the

risk and cost of your programme. This includes metadata

management (data governance, modelling and lineage), rich

data management (data life-cycle, state, temporal design) and

data insight (data visualisation, metrics and analytics).

To speak with one of our experts contact us on 020 7347

5666 or info@kinaesis.com

Barney Walker

Head of Banking Practice

barney.walker@kinaesis.com

Kinaesis.com

Biography

Barney is the Head of Banking Practice for Kinaesis and

brings over 20 years’ experience in risk, data, business and

technology, gained within the banking industry. Barney has

held senior positions at J.P. Morgan, including Head of Rates

and Public Finance Technology and Head of Proprietary

Trading Technology and Operations, and UBS where he was

co-head of Group Finance Technology. Barney has many

years of experience of working with trading businesses and

enterprise divisions to develop and deliver value. He has

extensive expertise in risk, data, accounting, regulations,

legal and compliance.

References

1. Gartner Inc. Predicts 2012: Business Intelligence Still

Subject to Nontechnical Challenges. gartner.com. [Online]

December, 2013.

2. Financial Stability Board (FSB). Intensity and Effectiveness

of SIFI Supervision - Progress report on implementing the

recommendations. http://www.financialstabilityboard.org

[Online] October, 2011.

3. Bank for International Settlements (BIS). Principles for

effective risk data aggregation and risk reporting BCBS 239.

http://www.bis.org [Online] January, 2013.

4. Deloitte . Global risk management survey, eigth edition.

http://www.deloitte.com [Online] July, 2013.

About Kinaesis

Kinaesis are leading independent practitioners in the delivery

of high performance data architectures, enterprise information

management and on-demand risk analytics solutions for

Financial Services. We help our customers tap into huge

volumes of complex data, unlock its value and bring agile

decision making and real-time insight, into key business

processes. We are specialists in complex, high-volume, global

environments, servicing the extreme analytics and reporting

needs of many thousands of end users, based on terabytes of

data and billions of rows per day.

.

BCBS 239 - a primer.

Background

BCBS 239 is a set of regulations from the Basel Committee on Banking Supervision. Entitled “Principles for Effective Risk Data

Aggregation and Risk Reporting” it is aimed at addressing weaknesses in Banks’ ability to identify and manage bank-wide risks. The

financial crisis that began in 2007 exposed catastrophic weaknesses in banks’ ability to aggregate risk exposures in an accurate and

timely manner. The resultant impact on risk management decision-making “had severe consequences to the banks and to the stability

of the financial system as a whole.” (3) The principles were released in January 2013, with a deadline for implementation by global

systematically important banks (G-SIBs) of January 1, 2016. The principles are not only applicable to G-SIBs, the Financial Stability

Board (FSB) has clearly stated its intention that a time line is set for other firms, particularly systematically important financial

institutions (SIFIs), to meet these standards (2).

The Principles (3)

The principles cover four closely related topics. The principles are listed within the four topics below:

Overarching governance and infrastructure - Strong governance, risk data architecture and IT infrastructure.

1. Governance – A bank’s risk data aggregation capabilities and risk reporting practices should be subject to strong governance

arrangements consistent with other principles and guidance established by the Basel Committee.

2. Data architecture and IT infrastructure – A bank should design, build and maintain data architecture and IT infrastructure

which fully supports its risk data aggregation capabilities and risk reporting practices not only in normal times but also during

times of stress or crisis, while still meeting the other Principles.

Risk data aggregation capabilities - Strong risk data aggregation capabilities and accurate reflection of risks.

3. Accuracy and Integrity – A bank should be able to generate accurate and reliable risk data to meet normal and stress/crisis

reporting accuracy requirements. Data should be aggregated on a largely automated basis so as to minimise the probability of

errors.

4. Completeness – A bank should be able to capture and aggregate all material risk data across the banking group. Data should

be available by business line, legal entity, asset type, industry, region and other groupings, as relevant for the risk in question,

that permit identifying and reporting risk exposures, concentrations and emerging risks.

5. Timeliness – A bank should be able to generate aggregate and up-to-date risk data in a timely manner while also meeting the

principles relating to accuracy and integrity, completeness and adaptability. The precise timing will depend upon the nature

and potential volatility of the risk being measured as well as its criticality to the overall risk profile of the bank. The precise

timing will also depend on the bank-specific frequency requirements for risk management reporting, under both normal and

stress/crisis situations, set based on the characteristics and overall risk profile of the bank.

6. Adaptability – A bank should be able to generate aggregate risk data to meet a broad range of on-demand, ad hoc risk

management reporting requests, including requests during stress/crisis situations, requests due to changing internal needs

and requests to meet supervisory queries.

Risk reporting practices – An effective operating model.

7. Accuracy - Risk management reports should accurately and precisely convey aggregated risk data and reflect risk in an exact

manner. Reports should be reconciled and validated.

8. Comprehensiveness - Risk management reports should cover all material risk areas within the organisation. The depth and

scope of these reports should be consistent with the size and complexity of the bank’s operations and risk profile, as well as

the requirements of the recipients.

9. Clarity and usefulness - Risk management reports should communicate information in a clear and concise manner. Reports

should be easy to understand yet comprehensive enough to facilitate informed decision-making. Reports should include an

appropriate balance between risk data, analysis and interpretation, and qualitative explanations. Reports should include

meaningful information tailored to the needs of the recipients.

10. Frequency - The board and senior management (or other recipients as appropriate) should set the frequency of risk

management report production and distribution. Frequency requirements should reflect the needs of the recipients, the

nature of the risk reported, and the speed at which the risk can change, as well as the importance of reports in contributing to

sound risk management and effective and efficient decision-making across the bank. The frequency of reports should be

increased during times of stress/crisis.

11. Distribution - Risk management reports should be distributed to the relevant parties and while ensuring confidentiality is

maintained.

Supervisory review, tools and cooperation – Strong supervisory oversight.

12. Review - Supervisors should periodically review and evaluate a bank’s compliance with the eleven Principles above.

13. Remedial actions and supervisory measures - Supervisors should have and use the appropriate tools and resources to require

effective and timely remedial action by a bank to address deficiencies in its risk data aggregation capabilities and risk

reporting practices. Supervisors should have the ability to use a range of tools, including Pillar 2.

14. Home/host cooperation - Supervisors should cooperate with relevant supervisors in other jurisdictions regarding the

supervision and review of the Principles, and the implementation of any remedial action if necessary.