Gareth Isaac<\/a>, Director and Principal Consultant, Ortecha<\/a>, a DCAM<\/span> Authorized Partner
Mark McQueen<\/a>, EDM Council, Senior Advisor-DCAM<\/p>\n\n\n\n\n\n\n\n
Executive Summary<\/h1>\n\n\n\nObjective<\/h2>\n\n\n\n
One of the most significant regulatory directives following the 2008 financial crisis has been the introduction of the Principles for Effective Risk Data Aggregation and Risk Reporting<\/em> or BCBS 239<\/a>. The Principles outlined in this directive require banks to establish sound information infrastructures to support their risk and risk reporting functions. As part of creating the required control environment, a common practice in the financial services industry is the establishment of CDEs or Critical Data Elements<\/em>.<\/p>\n\n\n\n In spite of this focus on CDEs by the financial service industry, in the 2017 Data Management Industry Benchmark Study conducted by the EDM Council, the management of CDEs was identified as a top challenge universally across the industry. Members report that there is uncertainty regarding the exact definition of a CDE<\/span>, how is it designated, or how it should be used to satisfy the control requirement.<\/p>\n\n\n\n Subsequently, the EDM Council conducted 14 in-depth interviews with member firms to frame the issue. The research was organized to gain insight into how organizations define critical data, the process<\/span> to identify critical data, and the implications for heightened levels of control on critical data. The research revealed both the purpose and approach to CDE<\/span> management remained fragmented and siloed to each organization. To address this, the EDM Council formed a CDE<\/span> Best Practice workgroup. The workgroup was charged with establishing a Best Practice for the identification and management of critical data covering these three objectives.<\/p>\n\n\n\n The Best Practice provides processes, procedures, and tools for the execution of the identification of critical data all aligned and integrated with the EDM Council Data Management Capability Assessment Model (DCAM) Framework<\/a>.<\/p>\n\n\n\n This document covers Objective 1 and Objective 2. Objective 3 will be included in a later publication.<\/p>\n\n\n\n The concept of a Critical Data Element<\/span> (CDE<\/span>) originated within the Financial Service Industry. In 2013 the BCBS 239 Principles were published. Principle<\/span> 1 introduced the phrase ‘identify data critical to risk data aggregation.’ This phrase is now commonly referred to as identifying CDEs even though BCBS 239 does not use the term<\/span>.<\/p>\n\n\n\n Since that time, financial organizations have struggled to execute a process<\/span> to identify CDEs. There are confusion and variation in the method and the resulting CDEs.<\/p>\n\n\n\n To further understand the issue of managing CDEs, the Best Practice Work Group<\/span> developed a set of questions to understand the current state and establish the intended scope for the Best Practice.<\/p>\n\n\n\n The framing questions listed above were used to learn more about actual experiences banks had with implementing CDEs. Fourteen EDM Council member organizations were interviewed. What was learned about the current state of CDE<\/span> management is summarized in the following section, the full report titled CDE Member Research Interim Report<\/a> was published in November 2017 and is available to EDM Council members.<\/p>\n\n\n\n The member organizations selected for interviews were those that the EDM Council had an awareness of their efforts to manage CDEs. A high degree of engagement was validated but with significant variation across the organizations in CDE<\/span> definition, volume, the process<\/span> for identifying, and, the level of data management rigor applied to manage CDEs. Even from mature efforts, there was confusion and lack of confidence in how to manage CDEs with little to no consistency<\/span> across the organization.<\/p>\n\n\n\n One of the most significant challenges is the lack of consistency<\/span> in distinguishing a granular data<\/span> attribute from a derived or calculated business measure. Many firms are using the same terminology to describe logical concepts, business objectives, calculation processes, derived elements, and physical expression. The concepts described above are all real and essential things<\/em> – but they are not the same thing – and by calling them all critical data elements leads to significant confusion.<\/p>\n\n\n\n General agreement that the business process<\/span> defines criticality existed across the organizations. Still, there was a lack of acknowledgment of all the business processes that may be consuming the same data. Their approach did not include the concept of a data supply chain. Also, the full range of stakeholders of the data often was not included in determining criticality. As a bright spot, some organizations recognized the identification of criticality as a negotiation between the data producer<\/span> and the data consumer<\/span>.<\/p>\n\n\n\n Some organizations had attempted to quantify criticality by applying a matrix formula to calculate an objective<\/em><\/strong> criticality measurement. Without exception, this absolute measurement was abandoned for more subjective analysis. (See section: Measuring Criticality: Art or Science<\/a><\/em>)<\/p>\n\n\n\n The designation of a data element<\/span> as critical means it is covered by the organizational policy<\/span> and standards resulting in increased data management rigor to achieve a heightened level of control.<\/em><\/strong> The following were common themes across the firms involved in the initial interviews and the subsequent analysis by the Best Practice Work Group<\/span>. However, while the issues were consistent, the execution of each theme had a high variation across the organizations.<\/p>\n\n\n\n The Data Management function<\/span> Stakeholders include:<\/p>\n\n\n\n![\"\"](\"http:\/\/www.dcamportal.org\/wp-content\/uploads\/2019\/11\/CDE-Objectives.png\")
<\/figure><\/div>\n\n\n\nKey Observations<\/h2>\n\n\n\n
\n\n\n\nMore Information<\/strong><\/h2>\n\n\n\n
\n<\/div><\/div>\n\n\n\nIssue<\/h1>\n\n\n\n
Industry Current State<\/h2>\n\n\n\n
Current State Finding 1: No Consistent Definition of a CDE<\/h3>\n\n\n\n
Current State Finding 2: Inconsistent Process for Designating CDEs<\/h3>\n\n\n\n
Current State Finding 3: Undefined Guidelines for Managing Criticality<\/h3>\n\n\n\n
Best Practice<\/h1>\n\n\n\n
Stakeholders<\/h2>\n\n\n\n
![\"\"](\"https:\/\/i0.wp.com\/www.dcamportal.org\/wp-content\/uploads\/2019\/11\/CDE-Diagram-1-BE-DE-Construct-cropped-1.png?resize=699%2C594\")
<\/a>