Risk data aggregation capabilities and risk reporting practices must sit under strong governance consistent with the Committee's other principles (SRP36 now points to the Corporate governance principles for banks, July 2015). The board and senior management promote the identification, assessment and management of data quality risk inside the overall risk management framework, which includes agreed service levels for outsourced and in-house risk data processes and the firm's policies on data confidentiality, integrity and availability; they review and approve the group framework and resource it. The capabilities and practices are fully documented and independently validated against the Principles by staff with IT, data and reporting expertise, separate from internal audit (second line, not third); considered in every new initiative, with acquisition due diligence assessing the target's capabilities, the board weighing the impact before proceeding and a timeframe set for integration; and not hindered by legal structure or geography at any consolidated or sub-consolidated level. Senior management knows the coverage, technical and legal limits on full aggregation, builds their remedy into the IT strategy and funds critical data initiatives; the board sets its own reporting requirements, knows those limits and follows implementation and ongoing compliance. Across all Principles: the board oversees senior management's ownership of implementation within a timeframe agreed with the supervisor, and any trade-off between Principles is exceptional (urgent or ad hoc requests on new risks), never material to risk decisions, known to decision-makers and governed by policy, with its impact explainable.
This control maps to 4 controls across 3 other frameworks. If you already hold one of them, the evidence you collected for it is the starting point here rather than new work.
Every mapping shown was judged rather than inferred from wording similarity, and the ones that failed review are published too. See the coverage reports and what was rejected.
The graph holds this control, the 4 it maps to, and the evidence behind each claim, over MCP and REST.