4.3 Data infrastructure

Institutions should ensure that the stress testing programme is supported by an adequate data infrastructure.

To ensure that a proper data infrastructure has been put in place, institutions, including those that are not global systemically important institutions (G-SIIs), should endeavour to also refer, to the extent appropriate, to the principles for effective risk data aggregation and risk reporting of the Basel Committee on Banking Supervision⁷ .

⁷ http://www.bis.org/publ/bcbs239.pdf

Institutions should ensure that their data infrastructure has the capacity to capture the extensive data needs of their stress testing programme and that they have in place mechanisms to ensure their continuing ability to conduct stress testing as planned in accordance with the programme.

Institutions should ensure that the data infrastructure allows for both flexibility and appropriate levels of quality and control.

Institutions should ensure that their data infrastructure is proportionate to their size, complexity, and risk and business profile, and allows for the performance of stress tests covering all material risks that the institution is exposed to.

Institutions should devote sufficient human, financial and material resources to guarantee the effective development and maintenance of their data infrastructure, including information technology systems.

Institutions should also consider stress testing data infrastructure as part of their overall information technology infrastructure and should give adequate consideration to business continuity planning, the identification of long-term investments and other IT processes.

Data aggregation capabilities for stress testing purposes

Institutions should maintain and keep up-to-date accurate and reliable risk data to conduct reliable stress tests and should also have in place a dedicated process for aggregating and producing such data.

Institutions should ensure that their aggregation of risk data is characterised by accuracy and integrity, completeness, timeliness and adaptability.

Institutions should ensure that data are aggregated on a largely automated basis so as to minimise the probability of error. In particular, a thorough reconciliation and controls system should be in place.

Institutions should have the capacity to guarantee the completeness of risk data. For that purpose, institutions should ensure that risk data also fully capture off-balance-sheet risks and are easily attainable at any level of the institution. Materiality, in terms of existent and potential risk, should be factored in.

Institutions should be able to produce aggregated risk information on a timely basis to meet all reporting requirements throughout the process of stress testing following different quality assurance and challenge stages; for that purpose, institutions should develop an efficient structure that ensures timeliness.

Institutions should be able to generate aggregate data to meet a broad range of on-demand requests arising both from internal needs in the institution and externally from supervisory queries.

Reporting practices for stress testing purposes

Institutions should ensure that their risk reporting process:

• a) is completely supported by data aggregation capabilities;
• b) accurately and precisely conveys aggregated risk data and reflects risk in an exact manner;
• c) covers all material risks and, in particular, allows the identification of emerging vulnerabilities that could potentially be further assessed even in the same stress testing exercise;
• d) offers or is able to offer additional information regarding main assumptions, tolerance levels or caveats; and
• e) communicates information in a clear and concise manner including meaningful information tailored to the needs of the recipients.