1,240 DQ Rules, 43,000 Exceptions, and a Regulatory Finding
A retail bank's Basel/credit-risk data quality program has 1,240 rules. Last quarter they generated 43,000 exceptions; 68% were closed as 'no action' and 14% were never triaged. The three stewards also own remediation projects and can spend about six hours a week on rule triage. A recent regulatory review criticized the bank for not demonstrating that data used in the capital calculation is complete and accurate. Meanwhile business teams complain that the DQ dashboard is 'all red' and ignore it. The bank has budget for two additional FTEs next year and a mandate to show measurable improvement in two quarters. The CRO wants a smaller, defensible set of controls tied to critical data elements (CDEs). The current rule catalogue grew bottom-up from source-system checks, and no rule is mapped to a report line or regulatory requirement.
1. Reduce the 1,240 rules to a defensible control set. State the selection criteria, the target size, and the evidence that would satisfy a regulator.
Read the worked answer
The catalogue is a list of checks, not a control framework. Start from the capital calculation and work backwards. Identify the critical data elements that feed exposure, collateral, rating, default status, and the report lines they support. Then select rules that provide evidence over those CDEs.
Selection criteria:
- Materiality and regulatory linkage. The rule must trace to a report line, a regulatory requirement, or a material financial process.
- CDE coverage. Each critical data element needs at least one completeness, accuracy, and timeliness control where relevant.
- Actionability. There must be a named owner, a threshold, and a remediation path. A rule that produces 68% 'no action' outcomes is not a control.
- Root-cause coverage. Prefer a smaller number of rules that detect systemic causes over many rules that duplicate symptoms.
- Precision. Estimate the proportion of exceptions that are genuine defects; retire or retune rules with very low precision.
A defensible target is roughly 40–60 Tier 1 controls for the capital process, plus a Tier 2 operational monitoring set. Tier 1 controls get owners, thresholds, evidence retention, and service levels. The rest are retired, consolidated, or moved to observability.
Evidence for the regulator: a rule-to-control-to-CDE-to-report-line lineage, control descriptions, test results for the last four quarters, exception and remediation logs, owner sign-offs, and a clear statement of limitations. The narrative should show that the bank knows which data matters and can prove the controls operated.
2. With three stewards, six hours each per week, and 43,000 exceptions, what triage model would you implement? Be specific about automation, thresholds, and staffing.
Read the worked answer
The arithmetic rules out manual triage: 18 steward-hours per week cannot process 43,000 exceptions, and the current model is failing visibly. Separate rule health from exception handling.
First, automate classification. Cluster exceptions by rule, source system, and root-cause signature; measure rule precision and volume trend. Rules with very low action rates should be retuned or retired rather than triaged. High-volume, low-risk rules can move to sampling or to threshold-based alerting on change, not per-record alerts.
Second, tier the exceptions. Tier 1 covers capital-calculation CDEs and any item with a plausible regulatory or financial statement impact. These get full case management, a named owner, and a five-day triage service level. Tier 2 covers operational monitoring and can be handled by data owners in the business, with stewards reviewing only trends and recurring causes.
Third, use the two new FTEs for rule engineering and root-cause analysis, not for triage. They should reduce volume by fixing feeds and transformations and by building automated matching and suppression. Stewards retain decision rights on definitions and priority.
Targets by the end of two quarters: 90% of Tier 1 exceptions triaged within five days, total exception volume down by 60%, and fewer than 10% of exceptions closed as 'no action.' Report these alongside the number of rules retired, because a smaller actionable set is the actual improvement.
3. Business teams ignore the 'all red' dashboard. Redesign the DQ scorecard so it drives action and supports the regulatory narrative.
Read the worked answer
An all-red dashboard carries no information because it does not distinguish material from immaterial failure. Redesign around fitness for purpose and materiality.
- Score at CDE and process level, not by averaging all rules. Show pass rates for the critical data elements in the capital calculation, with explicit thresholds. A single weighted score hides which element failed.
- Separate control operation from data defects. One section should show whether the control ran and produced evidence; another should show the defect rate and trend. A control can operate correctly while detecting a high defect rate.
- Use thresholds and trends. Define amber and red by impact and duration, not by any exception existing. Show the prior period and the direction of travel.
- Attach an owner and a decision. Every red item needs an owner, a cause hypothesis, a remediation action, and a due date. The scorecard should be a decision queue, not a wall of counts.
- Use materiality-weighted views for executives. Executives need the value or report line at risk, not 43,000 rows.
Governance: review monthly with the CRO, log decisions, and track closure. For the regulatory narrative, link each scorecard line to its control, CDE, and report line, and retain the evidence. The goal is to show that the bank detects, explains, and remediates issues in material data, not that every rule is green.