Governing investment data under regulation

# Governing investment data under regulation

A prospective client asks a simple question: "How did you calculate the 12.4% return you put in the pitch deck?" If your firm cannot reconstruct that figure from source data within hours, showing every input, adjustment, and approval, you have a governance problem, not a math problem.

Regulators ask the same question, only with subpoena power. This lesson is about building the controls, lineage, and audit trails that let you answer confidently before anyone asks.

Why performance data is a regulated asset

A marketed track record is not just marketing. It is a factual claim about past results that three regimes scrutinize:

• GIPS (Global Investment Performance Standards): A voluntary but widely adopted set of standards, maintained by the CFA Institute, for calculating and presenting investment performance fairly. Claiming compliance and getting it wrong is a serious credibility and legal risk.
• MiFID II: The European Union framework governing investment services. Its rules require that marketing communications be "fair, clear, and not misleading," with records retained to prove it.
• SEC Marketing Rule: The US rule (formally the amended Rule 206(4)-1 under the Investment Advisers Act) that governs how registered advisers advertise performance. It sets specific requirements for net-of-fees presentation and prescribed time periods.

The common thread: every number you show must be reproducible, substantiated, and retained. That is a data problem before it is a compliance problem.

The anatomy of a performance figure

Take that 12.4% return. It is the end of a pipelinepipelineAll active sales opportunities across the stages of the sales process, together with their combined potential value and probability of closing.View full definition → with many failure points.

Inputs:

• Position and transaction data from the portfolio accounting system
• Security prices from a market data vendor
• Corporate actions (dividends, splits, mergers)
• Fee schedules and cash flow timing
• FX rates for multi-currency portfolios

Transformations:

• Time-weighted or money-weighted return calculation
• Composite construction (grouping portfolios run to a similar strategy)
• Gross-to-net fee adjustments
• Benchmark alignment

Each step is a place where an error, an undocumented override, or a stale price can silently corrupt the marketed number. Governance means making each step visible, controlled, and replayable.

Data lineageData lineageData lineage maps how data moves and transforms across systems, from origin to consumption, showing where it came from, what changed it, and where it goes.View full definition →: the reproducibility backbone

Data lineageData lineageData lineage maps how data moves and transforms across systems, from origin to consumption, showing where it came from, what changed it, and where it goes.View full definition → is the documented trail showing where a data point came from and every transformation it passed through. For performance data, good lineage lets you answer: "Which price file, which fee schedule, which calculation version produced this composite return on this date?"

A concrete test: pick any figure in a client presentation from 18 months ago. Can you regenerate it exactly, using the data and code as they existed then? If a vendor later restated a price, or someone patched the return engine, naive reproduction will produce a different number and undermine your credibility.

The fix is point-in-time (bitemporal) data: storing both when an event occurred and when you recorded it. This lets you query the data "as it was known" on any past date.

-- Reconstruct a composite return as it was known on 2024-06-30,
-- ignoring later restatements
SELECT composite_id, return_pct, calc_version
FROM composite_returns
WHERE composite_id = 'GLOBAL_EQ'
  AND period_end   = '2024-05-31'
  AND knowledge_date <= '2024-06-30'  -- as-of the marketing date
ORDER BY knowledge_date DESC
LIMIT 1;

The knowledge_date column is what separates a defensible archive from a rolling number that quietly changes under you.

Controls that stop bad numbers early

Lineage tells you what happened. Controls stop errors before they reachreachThe number of unique people exposed to your message in a given period. Unlike impressions, reach counts each person once, no matter how often they see it.View full definition → a client deck. Build them at each pipelinepipelineAll active sales opportunities across the stages of the sales process, together with their combined potential value and probability of closing.View full definition → stage.

Input validation:

• Price tolerance checks: flag any security moving more than a set threshold versus the prior day unless a corporate action explains it.
• Completeness checks: confirm every holding has a price before the return runs.
• Cash reconciliation: portfolio cash must tie to the custodian statement.

Calculation controls:

• Version-lock the return engine. Any code change to the calculation logic triggers review and is tagged so you know which version produced which figure.
• Independent recalculation: a second system or team recomputes a sample of returns.

Composite controls (GIPS-specific):

• Documented, consistently applied rules for which portfolios enter a composite and when.
• No cherry-picking: you cannot quietly drop a poorly performing account to flatter the composite. GIPS requires you to include all fee-paying, discretionary portfolios that fit the strategy.

Marketing controls:

• A checklist enforcing net-of-fees presentation and the prescribed time periods the SEC Marketing Rule requires.
• Sign-off workflow: compliance approves the exact figures and the disclosure language before publication.

The CFA Institute publishes the full standards and guidance; the GIPS Standards resources are free and worth bookmarking as the authoritative source.

Audit trails: proving who did what

An audit trail is an immutable, timestamped log of every action taken on the data and the process. When a regulator asks how a figure was produced, the audit trail is your evidence.

For each marketed number, you should be able to show:

• The source data snapshot used (with version or knowledge date)
• The calculation code version
• Any manual override, who made it, why, and who approved it
• The compliance sign-off, with timestamp
• The final published document containing the figure

Manual overrides deserve special attention. They are legitimate (a vendor price is obviously wrong, so an analyst corrects it) but they are also where fraud and error hide. Every override should be logged, justified, and approved by someone other than the person making it (segregation of duties). An override with no recorded reason is exactly what an examiner circles.

Retention: keeping proof long enough

Both MiFID II and the SEC Marketing Rule impose record-keeping obligations. The precise retention periods and formats depend on your jurisdiction, entity type, and the specific record, so confirm current requirements with compliance counsel rather than assuming a single number.

The governance principle is stable regardless of the exact period: retain the full reconstruction package, not just the final PDF. That means the data snapshot, the calculation version, and the approval log, stored so they cannot be silently altered. A marketing document you can show but cannot substantiate from source is a liability, not an asset.

Putting it together: a governance operating model

Controls, lineage, and audit trails only work if someone owns them. A workable model assigns clear roles:

Data owners are accountable for the accuracy of a data domain (for example, the head of portfolio accounting owns transaction data). Data stewards run the day-to-day quality checks. Compliance owns the marketing sign-off and the mapping of controls to specific rules. A GIPS verifier (an independent third party) can review your claim of compliance, which many firms use to strengthen credibility with institutional clients.

Tie each control to the rule it satisfies. A simple control-to-regulation mapmapUsing software to automate repetitive marketing tasks and campaigns, enabling personalisation at scale across channels like email, web, and social.View full definition → turns a vague policy into an auditable system:

| Control | Satisfies |

|---|---|

| Net-of-fees presentation check | SEC Marketing Rule |

| "Fair, clear, not misleading" review | MiFID II |

| Composite inclusion rules | GIPS |

| Point-in-time reconstruction | All three |

| Override approval log | All three |

When an examiner arrives, you hand them this mapmapUsing software to automate repetitive marketing tasks and campaigns, enabling personalisation at scale across channels like email, web, and social.View full definition → and the evidence behind each row. That is the difference between a scramble and a routine exam.

A practical starting sequence

If your firm is early on this, sequence the work:

1. Inventory every performance figure that gets marketed and trace its pipelinepipelineAll active sales opportunities across the stages of the sales process, together with their combined potential value and probability of closing.View full definition →.

2. Fix reproducibility first: implement point-in-time storage and version-locking so numbers stop drifting.

3. Add input and calculation controls at the highest-risk stages (pricing, composite construction).

4. Formalize audit trails and override approvals.

5. Map controls to regulations and layer in compliance sign-off.

Reproducibility is the foundation. Controls and audit trails are worth little if the underlying number cannot be regenerated in the first place.

Key Takeaways

• Every marketed performance figure is a regulated factual claim; you must be able to reconstruct it exactly from source data, controls, and approvals.
• Use point-in-time (bitemporal) data and version-locked calculation code so figures do not silently change after publication.
• Build controls at each pipelinepipelineAll active sales opportunities across the stages of the sales process, together with their combined potential value and probability of closing.View full definition → stage (input validation, independent recalculation, GIPS composite rules, net-of-fees marketing checks) to stop errors before they reachreachThe number of unique people exposed to your message in a given period. Unlike impressions, reach counts each person once, no matter how often they see it.View full definition → a client.
• Log and independently approve every manual override; unexplained overrides are exactly what examiners target.
• MapMapUsing software to automate repetitive marketing tasks and campaigns, enabling personalisation at scale across channels like email, web, and social.View full definition → each control to the specific regime it satisfies (GIPS, MiFID II, SEC Marketing Rule) so a regulator or client question becomes a routine, evidence-backed answer.