Data lineage and governance for regulatory reporting

For an insurer, a single reported number typically passes through:

1. Source/operational systems: policy administration (premiums, coverage terms), claims systems (reserves, payments), reinsurance systems (ceded amounts).

2. Data warehouse or lake: where records are extracted, transformed, and loaded (ETLETLETL (Extract, Transform, Load) is a data integration process that pulls data from sources, reshapes it into a consistent format, and writes it into a target system.Voir la définition complète →).

3. Actuarial models: reserving engines, capital models (e.g., internal models or standard formula under Solvency II).

4. Reporting layer: the tool that populates QRTs (Quantitative Reporting Templates) or NAIC's Annual Statement schedules.

Lineage documentation answers three questions for every reported figure: where did it originate, what happened to it, and who touched it.

Why regulators care specifically about this

Two regulatory regimes anchor this lesson:

• Solvency II (EU, in force since 2016, overseen by EIOPA and national regulators like BaFin in Germany or the ACPR in France) requires insurers to submit QRTs and an annual RSR (Regulatory Supervisory Report) and SFCR (Solvency and Financial Condition Report). Its "Pillar 3" reporting requirements explicitly demand data qualitydata qualityThe degree to which data is fit for purpose: accurate, complete, consistent, timely, valid and unique. Poor quality data undermines analytics, reporting and AI.Voir la définition complète → standards: accuracy, completeness, and appropriateness (Article 19 of the Delegated Regulation 2015/35).
• NAIC requirements in the US, applied state-by-state, govern the Annual Statement, RBC (Risk-Based Capital) filings, and since 2020 the expanding use of NAIC's own dataown dataData collected directly from your own customers and prospects through your own channels: your most reliable and privacy-compliant source.Voir la définition complète → collection and analysis tools. There is no single federal equivalent to Solvency II; US oversight is state-based, coordinated through NAIC standards.

Both regimes converge on the same expectation: insurers must be able to demonstrate, on request, how a number was produced. This is often called "data traceability" or "auditability."

The EIOPA guidelines on internal governance explicitly list data lineagedata lineageData lineage maps how data moves and transforms across systems, from origin to consumption, showing where it came from, what changed it, and where it goes.Voir la définition complète → documentation as a supervisory expectation, not just a best practice.

The anatomy of a lineage gap

A gap happens when any link in the chain is undocumented or unverifiable. Common real-world culprits:

• Manual spreadsheet adjustments between the warehouse and the actuarial model, with no version control or sign-off log.
• System migrations (a common event after M&A) where historical mapping logic is lost.
• Unclear ownership of "gross vs. net of reinsurance" fields, causing double-counting or omission.
• Undocumented business rules inside ETLETLETL (Extract, Transform, Load) is a data integration process that pulls data from sources, reshapes it into a consistent format, and writes it into a target system.Voir la définition complète → code, e.g. a currency-conversion rateconversion rateThe percentage of visitors or prospects who complete a desired action (purchase, sign-up, contact form), calculated as conversions divided by total opportunities.Voir la définition complète → hardcoded years ago and never revisited.

A simplified lineage record for our example number might look like this:

That last line matters as much as the technical trail: governance is not just IT, it is accountability.

Governance roles and control metrics

Governance frameworks assign responsibility so lineage doesn't rely on institutional memory. Standard structure:

• Data owner: accountable for a data domain (e.g., Head of Underwriting owns policy data).
• Data stewardData stewardA business-side owner responsible for the quality, consistency and appropriate use of data in their domain.Voir la définition complète →: operationally manages quality and definitions day to day.
• Data quality committee: reviews metrics and approves remediation priorities, often reporting to a Chief Data Officer.

Metrics that boards and regulators actually look for (figures below are illustrative industry benchmarks, treat as estimates, not universal thresholds):

| Metric | What it measures | Typical target (estimate) |

|---|---|---|

| Lineage coverage | % of critical data elements (CDEs) with documented end-to-end lineage | 90%+ for CDEs feeding regulatory reports |

| Data quality issue closure rate | % of identified DQDQThe degree to which data is fit for purpose: accurate, complete, consistent, timely, valid and unique. Poor quality data undermines analytics, reporting and AI.Voir la définition complète → issues remediated within SLA | 85-95% within quarter |

| Manual adjustment ratio | % of reported figures touched by a manual (spreadsheet) step | Lower is better; many insurers target under 10% |

| Critical Data Element (CDE) count | Number of fields formally classified as regulatory-critical and under tightened control | Varies by firm; often several hundred to a few thousand |

Worked example: Suppose an insurer has 1,200 CDEs feeding its Solvency II QRTs. An internal audit finds full lineage documentation for 1,050 of them.

Lineage coverage = 1,050 / 1,200 = 87.5%

If the internal target is 90%, this insurer has a gap of 2.5 percentage points, roughly 30 fields, that must be remediated before the next filing cycle. That gap becomes the audit finding.

The BCBS 239BCBS 239Principe du Basel Committee on Banking Supervision imposant aux grandes banques une traçabilité stricte des données de risque, ayant catalysé la création de nombreux postes de CDO dans le secteur bancaire. connection

Though written for banks, the Basel Committee's BCBS 239BCBS 239Principe du Basel Committee on Banking Supervision imposant aux grandes banques une traçabilité stricte des données de risque, ayant catalysé la création de nombreux postes de CDO dans le secteur bancaire. principles ("Principles for effective risk data aggregation and risk reporting," 2013) are widely used by insurance data teams as a governance template because they are more granular than Solvency II text itself. Key principles directly transferable: data must be accurate, complete, timely, and adaptable, and firms must be able to reproduce reports and trace them to source without material delay, generally interpreted by practitioners as being able to fulfill an ad hoc regulator request within days, not weeks.

Building a lineage program: practical steps

1. Classify CDEs first. Don't try to document lineage for every field in the warehouse. Start with fields that flow into QRTs, SFCR narrative figures, and RBC calculations.

2. Automate capture where possible. Modern ETLETLETL (Extract, Transform, Load) is a data integration process that pulls data from sources, reshapes it into a consistent format, and writes it into a target system.Voir la définition complète → and data catalogdata catalogA centralized inventory of an organization's data assets, enriched with metadata, that helps people find, understand, and trust the data they need.Voir la définition complète → tools (e.g., Collibra, Informatica, Apache Atlas) can auto-generate technical lineage from pipelinepipelineAll active sales opportunities across the stages of the sales process, together with their combined potential value and probability of closing.Voir la définition complète → metadatametadataDonnées sur les données, informations décrivant le contexte, la structure, la provenance et les caractéristiques d'un asset de données (auteur, date, format, source, définition)., reducing reliance on manual documentation that goes stale.

3. Log every manual touchpoint. If an actuary adjusts a number in Excel before it enters the model, that step needs a timestamp, a name, and a rationale.

4. Test lineage, don't just document it. Run periodic "trace-back" exercises: pick a random reported figure, and have someone outside the original team reconstruct its lineage using only the documentation. If they can't, the documentation has failed its real test.

5. Tie remediation to governance metrics, and report those metrics to the board risk committee, not just to IT.

🎬 [VIDEO: "What is Data LineageData LineageData lineage maps how data moves and transforms across systems, from origin to consumption, showing where it came from, what changed it, and where it goes.Voir la définition complète →?" - youtube.com - a short, accessible explainer on data lineagedata lineageData lineage maps how data moves and transforms across systems, from origin to consumption, showing where it came from, what changed it, and where it goes.Voir la définition complète → concepts applicable across regulated industries, useful for non-technical viewers before diving into insurance specifics]

Key Takeaways

• Data lineageData lineageData lineage maps how data moves and transforms across systems, from origin to consumption, showing where it came from, what changed it, and where it goes.Voir la définition complète → is the traceable path of a number from source system to regulatory filing; lineage gaps are the most common finding in Solvency II and NAIC data audits.
• Solvency II (EIOPA-governed, EU) and NAIC's state-based US framework both require insurers to demonstrate accuracy, completeness, and traceability of reported figures, not just produce the right final number.
• Govern with clear roles: data owners, data stewards, and a data quality committee, and measure with concrete metrics like lineage coverage and manual adjustment ratio.
• A worked example: 1,050 documented CDEs out of 1,200 total gives 87.5% lineage coverage, below a common 90% internal target, and that shortfall is exactly what regulatory examiners flag.
• BCBS 239, though bank-originated, is widely borrowed by insurers as a granular, practical governance standard for data aggregation and reporting integrity.