Metrics that measure a bank's data governance maturity

# Metrics that measure a bank's data governance maturity

A regulator walks into a US G-SIB (Global Systemically Important Bank) for a routine BCBS 239 exam. They don't ask "do you have a data governance policy?" Every bank says yes. They ask: "Show me the dashboard that proves your critical data elements passed quality checks last quarter, and who owned the fix when they didn't." If the bank can't produce that scorecard in real time, the exam gets harder fast.

This is the shift happening across banking in 2026: governance is no longer proven by policy documents. It's proven by metrics.

Why documentation isn't enough anymore

BCBS 239 ("Principles for Effective Risk Data Aggregation and Risk Reporting") was issued by the Basel Committee on Banking Supervision in 2013, after the 2008 crisis exposed banks that couldn't even tell regulators their total exposure to Lehman Brothers overnight. It set 14 principles, but principles don't self-enforce. Supervisors (the Federal Reserve, the ECB's Single Supervisory Mechanism, the UK's PRA) now expect banks to show measurable, tracked evidence of compliance.

That evidence takes the form of governance metrics. Three matter most.

Metric 1: data ownership coverage

What it is: the percentage of critical data elements (CDEs) that have a named, accountable data owner.

A CDE is a field that matters for risk, regulatory reporting, or capital calculation, things like loan-to-value ratio, counterparty legal entity identifier (LEI), or risk-weighted asset inputs. Not every field in a bank's systems is a CDE. A typical retail bank might tag 200 to 500 fields as critical out of tens of thousands.

Why it matters: an unowned data element is an orphan. When it breaks, no one is accountable for fixing it, and it often doesn't get fixed until an audit finds it.

Benchmark: mature banks target 95%+ ownership coverage on CDEs (estimate, commonly cited internally, not a published regulatory threshold). Banks in early-stage governance programs often sit at 50 to 70%.

Worked example:

A bank identifies 400 CDEs across retail and wholesale lending.
340 have an assigned data owner recorded in the data governance tool.
Coverage = 340 / 400 = 85%.
The remaining 60 are flagged as a governance gap and typically show up as a finding in the next internal audit.

Metric 2: issue remediation time

What it is: the average time from when a data quality issue is logged to when it's resolved and verified.

Banks log data issues in tools like Collibra, Informatica Axon, or internally built issue-management platforms. Each issue gets severity-tiered (critical, high, medium, low) similar to an IT incident.

Why it matters: speed of remediation is a proxy for whether governance is a living process or a paperwork exercise. A bank that logs 10,000 issues a year but takes 18 months to close them isn't governing data, it's cataloguing problems.

Benchmark (industry estimates, not official figures):

Critical issues: target closure within 30 to 45 days.
High severity: 60 to 90 days.
Backlog aging: mature programs keep less than 10% of open issues older than 6 months.

European banks under the ECB's supervisory expectations often report remediation timelines in their internal model risk and data quality dashboards reviewed during Targeted Review of Internal Models (TRIM)-style exercises.

A simple calculation: if a bank opens 500 critical issues in a year and closes 420 within the 45-day target, its on-time remediation rate is:

On-time rate = closed_on_time / total_opened
420 / 500 = 84%

Anything consistently below roughly 80% tends to draw supervisory attention, because it signals the remediation process can't keep pace with issue discovery.

Metric 3: critical data element pass rate

What it is: the percentage of CDEs that pass automated data quality (DQ) rules (completeness, accuracy, timeliness, consistency) in a given reporting cycle.

This is the metric most directly tied to regulatory reporting confidence. If the field "customer risk rating" feeds into a Comprehensive Capital Analysis and Review (CCAR) submission in the US, or COREP/FINREP returns in Europe, its pass rate tells you how much you should trust that number.

Typical DQ dimensions checked:

Completeness: is the field populated?
Validity: does it match expected format/range (e.g., LEI is 20 alphanumeric characters)?
Accuracy: does it reconcile against a golden source?
Timeliness: was it refreshed within the required SLA (service-level agreement)?

Benchmark: leading banks report CDE pass rates above 98% for Tier 1 regulatory reporting fields (estimate). A pass rate in the low 90s or below on a CDE feeding capital or liquidity reporting is generally treated as a red flag requiring escalation to the Chief Data Officer.

Simple SQL-style logic for a pass rate check

sql

SELECT
  COUNT(CASE WHEN dq_status = 'PASS' THEN 1 END) * 100.0 / COUNT(*) AS pass_rate
FROM cde_quality_checks
WHERE reporting_date = '2026-03-31'
  AND cde_flag = TRUE;

This is the kind of query that feeds a governance dashboard reviewed monthly by a Data Governance Council, a cross-functional committee (risk, compliance, IT, business lines) that most large banks now run as standard practice.

Vérification des acquis

1. What is the core shift in how regulators assess BCBS 239 compliance in 2026 compared to earlier approaches?

2. Why was BCBS 239 originally introduced by the Basel Committee?

3. A bank has thousands of data fields across its systems but only tags 300 as 'critical data elements' (CDEs). What is the reasoning behind this selective tagging?

CHOIX MULTIPLES

4. Select ALL correct answers about why 'data ownership coverage' is considered an important governance metric.

Sélectionnez toutes les réponses correctes.

CHOIX MULTIPLES

5. Select ALL correct answers about what a regulator is likely evaluating when reviewing a bank's data governance maturity under BCBS 239.

Sélectionnez toutes les réponses correctes.

Putting the three metrics together

None of these numbers means much alone. A bank can have 95% ownership coverage but a 40% pass rate, meaning owners exist but aren't fixing anything. The real signal is the combination:

| Metric | Healthy signal | Warning signal |

|---|---|---|

| Ownership coverage | 95%+ | Below 80% |

| Remediation on-time rate | 80%+ | Below 60% |

| CDE pass rate | 98%+ (Tier 1 fields) | Below 95% |

Regulators reviewing BCBS 239 compliance, or in the US, examiners looking at Federal Reserve SR 11-7 model risk guidance and related data controls, increasingly ask for these three together, sometimes trended over 8 to 12 quarters, to see whether governance is improving or just holding steady.

A useful public reference for how supervisors think about this is the Bank of England's and PRA's published supervisory statements on risk data aggregation, which echo BCBS 239 expectations:

Measuring data quality with banking dimensions and DQ scorecards

Benchmarking analytics performance in banking

Metrics that measure a bank's data governance maturity

Why documentation isn't enough anymore

Metric 1: data ownership coverage

Metric 2: issue remediation time

Metric 3: critical data element pass rate

Simple SQL-style logic for a pass rate check

Putting the three metrics together

What "good" looks like in practice

Key Takeaways

Metrics that measure a bank's data governance maturity

Why documentation isn't enough anymore

Metric 1: data ownership coverage

Metric 2: issue remediation time

Metric 3: critical data element pass rate

Simple SQLSQLSales Qualified Lead: a prospect the sales team has validated as ready for direct outreach and a proposal, having passed clear qualification criteria.Voir la définition complète →-style logic for a pass rate check

Putting the three metrics together

What "good" looks like in practice

Key Takeaways

Simple SQL-style logic for a pass rate check