Every bank says its data is reliable. Data certification is how a bank proves it.
Data certification is the process of formally verifying and approving a data asset as accurate, owned, governed and fit for its intended use, with the evidence and the sign-off recorded. The result is not an opinion. It is a documented record that can be shown to an auditor, an examiner or a board committee.
Why banks need data certification
Regulatory reports, capital calculations, risk models and customer decisions all depend on data. When an examiner asks "how do you know this number is right?", an answer such as "the team checks it" does not hold up. A certified data asset has a recorded answer: who owns it, what policies and controls apply, what evidence supports it and who approved it.
Certification also changes how a bank works internally. Instead of re-proving the same data before every audit, teams keep a current record and refresh it when something changes. That shifts audit preparation from a periodic scramble to a routine lookup.
What a certified data asset includes
A certified asset typically has:
- A clear definition. What the data means in business terms, and where it is used.
- An accountable owner. A named person responsible for its quality and changes.
- Mapped policies and controls. The rules that apply and the controls that enforce them.
- Supporting evidence. Quality results, test records, lineage and documentation.
- An approval. A recorded sign-off that all requirements were met, with a date.
If any of these is missing, the asset may be well managed, but it cannot yet be shown to be. That gap between "managed" and "provable" is exactly what certification closes.
The four stages of data certification
A simple, repeatable workflow keeps certification manageable. CoComply uses four stages:
- Identified. The asset is registered and its initial metadata captured, including where it is used and which reports depend on it.
- Defined. Business context, ownership and requirements are documented, so everyone agrees what the data means and what "good" looks like.
- Governed. Policies are mapped, controls assigned and evidence collected. This is where most of the work happens.
- Certified. All requirements are met, approvals obtained and the asset is certified.
Each stage works as a gate. An asset cannot move forward until the requirements for the current stage are met, which is what makes the end result credible. You can see each stage in more detail on our data certification software page, and track assets through the pipeline with certification progress tracking.
What to certify first
You do not need to certify everything. Start with critical data: the elements that feed regulatory reporting, risk measurement and key decisions. A useful test is to ask what would happen if this data were wrong. If the answer is a restated filing, a misstated risk number or customer harm, it belongs on the list.
Our guide to critical data elements explains how to decide which ones qualify. For banks working to Basel standards, the BCBS 239 data certification checklist shows how certification evidence maps to the eleven principles.
Certification is not a one-time event
Certification can lapse when the world changes. A system migration, a merger, a reorganization or a new regulation can all affect whether an asset still meets its requirements. Good programs define re-certification triggers up front and track them, rather than relying on an annual scramble.
Common triggers include:
- A change to the source system or the way the data is transformed.
- A change of owner or a reorganization of the owning team.
- A control failure or a significant data quality issue.
- A new or amended regulatory requirement.
- A scheduled review date.
Tracking regulatory change is part of this. Our overview of what regulatory intelligence is explains how banks keep up with rules that might trigger a re-certification.
Data certification and data quality
Data certification and data quality are related but not the same. Quality measures how good the data is. Certification confirms that someone has taken responsibility, that controls operate and that the evidence supports the claim. Quality results are one input to certification. We cover the distinction in data certification vs data quality.
Common mistakes to avoid
- Certifying too much. A long list dilutes attention. Start with the assets that matter most.
- Treating certification as a document. A signed form without operating controls does not stand up to examination.
- Leaving ownership vague. If nobody can be named, the asset is not ready to be certified.
- Keeping evidence in scattered places. Evidence in email and shared drives cannot be produced quickly.
- Never re-certifying. A certificate that is two years old and unchanged tells an examiner little.
Getting started
Pick a small set of high-impact assets, name owners, agree the requirements for each stage and run them through the workflow. Replace spreadsheet trackers with a live view of stage, owner and evidence as soon as you can, because that is where audit readiness is won or lost.
Once the first assets are certified, expand to the next tier, connect certification to your policies and controls, and use a maturity assessment to see where governance is still weakest.
If you want to see how this works in practice, talk to our team about certifying your critical data assets.