Nine Days to Answer a One-Line Question
During a supervisory review, a regional bank was asked a simple question about a figure in its capital report: where did it come from? Not whether it was correct — just how it was assembled. The team expected to answer in an afternoon.
It took nine days. The final explanation was a deck of manual annotations, spreadsheet screenshots, and the recollections of two analysts who happened to still work there. The number was accurate the whole time. The bank simply couldn't prove it — and in a regulated environment, a number you cannot trace is treated as a number you cannot trust.
Traceability That Lives in People, Not Systems
The usual approach is to capture lineage once — mapped during a project, documented in a diagram, then left to age as pipelines change around it. When a regulator asks how a figure was built, the organization goes digging: reconstructing the path from code, memory, and reconciliations rather than reading it from a living record.
This is not a technology problem. It is a governance design problem. Lineage is treated as documentation produced on request instead of a standing property of the data itself, so the map and the territory drift apart the moment the first pipeline is modified. The cost surfaces exactly when it hurts most. BCBS 239 expects an institution to trace risk figures back to source and demonstrate the path, and a stress event demands the same answer under pressure. When traceability lives in tribal knowledge, every such request becomes a fire drill — and "we're confident it's right" is not the same as "here is how it was built."
The CoComply Approach
CoComply treats lineage as continuous, captured infrastructure rather than a diagram someone maintains by hand. The specific gap — being unable to explain, on demand, how a reported number was produced — is closed by capturing lineage directly from the movement and transformation of data, so every figure carries a traceable path from statement back to source transaction, including the business rules applied along the way.
That turns a nine-day reconstruction into a lookup. Because the path is recorded as the data travels it, and kept current as pipelines change, CoComply's governance model can answer "where did this come from" the moment the question is asked. When a supervisor or an incident forces it, the lineage is already assembled rather than excavated after the fact.
Defensibility Is Built Once, Not Rebuilt Every Time
A number the organization can explain instantly is a number it can defend. One it has to reconstruct is a liability waiting for the next question.
The institutions that hold up under scrutiny aren't the ones with the most accurate figures. They're the ones that can prove, on demand, exactly how each figure came to be.