The OCC's Heightened Standards, found in 12 CFR Part 30, Appendix D, set expectations for risk governance at large insured national banks, federal savings associations and federal branches, specifically those with average total consolidated assets of $50 billion or more. The OCC can also apply them to smaller institutions, and banks below the threshold are still examined on risk governance.
The standards do not mention "data governance" as a stand-alone program, but sound risk governance depends on reliable data. This is what examiners tend to look for when they look at your data.
1. Accountability
Examiners want to see who owns the data behind critical reports and decisions, and how the board and senior management oversee it. Named owners and stewards, with documented responsibilities, are the baseline.
2. Three lines of defense
The standards describe a framework in which front line units own risk, independent risk management oversees it and internal audit provides assurance. For data, that means business units own their data, risk and compliance set standards and challenge, and audit tests independently.
3. Policies that connect to controls
A data policy that nobody tests does not help. Examiners look for policies mapped to controls that operate, with owners and test results. A live view of governance and compliance makes those links visible.
4. Data quality and lineage
Reliable risk and regulatory reporting needs accurate, complete and traceable data. Be ready to trace a reported number back through its transformations to source systems.
5. Evidence on demand
The test of a program is whether you can produce evidence quickly: approvals, test results, documentation, exceptions and remediation. Evidence kept in one place for each critical asset turns an exam request into a lookup.
How certification helps
Data certification packages all of the above for each critical data asset: owner, definition, policies, controls, evidence and approval. Read our primer on what data certification is, and see how it applies on our OCC data governance page.
A short self-check
- Can you list your critical data assets and name an owner for each?
- Do your data policies map to tested controls?
- Can you trace your most important regulatory numbers to source?
- Is certification and test evidence in one place and current?
- Do you know what has changed since you last certified?
If any answer is "not sure", a data management maturity assessment can show where to focus.
Stay ahead of changes
OCC guidance evolves. Tracking it with regulatory intelligence helps you adjust before examiners ask. If you would like to talk through your program, contact us.
This article is a general overview and not legal advice.