CP10 (Full Document) - European Banking Authority

302. The information used in credit risk modelling is usually complex and
extensive. Institutions should assign enough resources to allow for
the possibility of expanding databases without the risk of losing
information. Institutions should aim to reduce the risk of human
error by increasing the automation of all material procedures used in
the quantification of the capital requirement. Sufficient IT support of
IRB data should not be interpreted in a way, however, that
institutions have to store their complete data history ’online‘ and
have all input data available at the push of a button, but that all data
should be stored in a suitable way and should be ready to access
within an appropriate time frame.
Audit review
303. Internal Audit of data quality should include at least the following: an
annual review of controls, periodic sampling of data, and review of
system reconciliations. For external data and pooled data, this work
should be done to the fullest extent possible.
3.4.2. Data quality standards and consistency with accounting data
304. Institutions should define their own standards for ensuring data
quality and should strive to improve these standards over time. They
should measure their performance against these standards.
Institutions should work on an ongoing basis to ensure that their
data is of high enough quality to support their risk management
processes and the calculation of their capital requirements. This
could include reviewing the structure of input data to identify outliers
or implausible values, changes from previous periods, and the
amount of missing data. The review should also indicate whether the
integrity of data is being maintained.
305. Regular reconciliation against accounting data could provide an
additional quality check. Institutions need to identify and explain
material divergences that come to light in the reconciliation. Full
reconciliation may not be possible, as risk data may differ from
accounting data for good reasons (for example, ‘Conversion Factor’
has no equivalent in accounting), but should be performed when
possible. In any case, institutions should perform consistency checks
that include an audit trail of data sources, total and record count
checks when data move between systems, recording of data that are
excluded or introduced at different stages of data manipulation, etc.
Significant discrepancies should be investigated.
306. There should be minimum checks including a periodic review by an
independent party to confirm that data are accurate, complete, and
appropriate. For example, data quality could be reviewed by
replicating the preparation of data (including collection and
transformation) and the outputs of models, using the same
databases and algorithms used by the institution. This could be done
on a sample basis. Supervisors could assess specific parts of this
Page 69 of 123