Skip to content

FRM Exam Part I · Principles for Effective Data Aggregation and Risk Reporting

Risk Data Aggregation Capabilities in BCBS 239

Updated 11 October 2026 · Fact-checked

Risk data aggregation capabilities are a bank's ability to collect, combine and analyse risk data across the group. BCBS 239 sets four principles: Principle 3 accuracy and integrity, Principle 4 completeness, Principle 5 timeliness, Principle 6 adaptability. To answer questions, match the scenario's failure to the right principle.

Understand Risk Data Aggregation Capabilities

Risk data aggregation means defining, gathering and processing risk data so a bank can measure its performance against its risk tolerance and appetite. It covers sorting, merging and breaking down data by business line, legal entity, asset type, industry, region and other groupings. The aim is that senior management and the board see one reliable picture of risk.

The Basel Committee published BCBS 239 after the 2007-2009 crisis. Many banks could not quickly work out total exposure to a single counterparty or product across the group. The principles are grouped. Overarching governance and infrastructure comes first (Principles 1 and 2). Risk data aggregation capabilities are Principles 3 to 6. Risk reporting practices are Principles 7 to 11. Supervisory review comes last (Principles 12 to 14).

The four capability principles each answer a different question:

  • Principle 3, accuracy and integrity: Is the data right? Aggregation should be largely automated to reduce errors. Controls over risk data should be as strong as those over accounting data. Data should be reconciled with sources such as accounting records. Approximations are acceptable only if they are reliable and documented.
  • Principle 4, completeness: Is all material risk captured? Data should cover all material risks across the group, by entity, business line, asset type, industry and region. It is not about perfect granularity. Gaps must be identified and explained.
  • Principle 5, timeliness: Is it fast enough? A bank should produce aggregated risk data quickly, especially in stress and crisis. Timing needs depend on the risk and the report.
  • Principle 6, adaptability: Can it flex? A bank should produce data on demand for ad hoc requests, new risks, regulatory changes and stress scenarios, and customise it for different users.

A useful memory device is the question each principle asks: right, all, fast, flexible. Data architecture and IT infrastructure sit under Principle 2 and support all four. The architecture must be robust enough to deliver these capabilities in normal times and in stress.

The exam rarely asks for numbers here. It gives a short scenario and asks which principle is breached, or which statement is correct or incorrect. Your job is to match the symptom to the principle.

Key formulas to remember

Principle 3: Accuracy and integrity
Right: automated aggregation + reconciliation + accounting-level controls
Manual workarounds, unreconciled data and weak controls point here. Approximations must be reliable and documented.
Principle 4: Completeness
All material risks, across entities, business lines, asset types, industries and regions
Missing exposures, unmapped entities or excluded portfolios point here. Gaps must be identified and explained.
Principle 5: Timeliness
Fast aggregation, especially in stress or crisis
Delays in producing group-wide exposure point here. Required speed depends on the risk and the report.
Principle 6: Adaptability
On demand, ad hoc, flexible, new risks and stress scenarios
Inability to respond to new requests or change the cut of data points here.
Memory cue
Right, All, Fast, Flexible = Principles 3, 4, 5, 6
Use it to map scenario to principle in seconds.

How to solve Risk Data Aggregation Capabilities questions

Use this method for any BCBS 239 question on risk data aggregation capabilities.

  1. 1Read the scenario and underline the symptom: wrong numbers, missing data, slow delivery, or inability to adapt.
  2. 2Ask the four questions in order: is the data right, is it all there, is it fast enough, can it flex?
  3. 3Map the symptom to the principle: wrong or unreconciled means 3, missing means 4, late means 5, rigid means 6.
  4. 4If the issue is about governance, ownership, data architecture or IT infrastructure, think Principles 1 and 2 instead.
  5. 5For true or false statements, check for absolutes such as 'always', 'only' or 'perfect'. The principles allow documented approximations and depend on risk and context.
  6. 6Check whether the stem mentions normal times, stress or crisis. The principles apply in all three, and timeliness and adaptability matter especially under stress.
  7. 7Eliminate options that describe reporting (Principles 7 to 11) when the question is about aggregation.
  8. 8Pick the option that matches the specific principle named or implied.

Quickest way: Right, All, Fast, Flexible

When to use it: Use it for any scenario question asking which principle is breached or which statement is correct.

  1. Find the single failure word in the stem: error, gap, delay or rigidity.
  2. Match it: error to 3, gap to 4, delay to 5, rigidity to 6.
  3. Scan the options for the one that names that principle or its exact remedy.
  4. Reject options that claim perfection or ignore documentation of approximations.

Common mistakes in Risk Data Aggregation Capabilities

  • Confusing accuracy (Principle 3) with completeness (Principle 4).

    Both sound like data quality, so they blur together.

    Fix: Accuracy asks whether the data that exists is correct. Completeness asks whether all material risk data exists. Wrong value means 3. Missing exposure means 4.

  • Thinking approximations are never allowed under accuracy.

    Students assume that integrity means exact numbers every time.

    Fix: Reliable approximations are acceptable if documented and controlled, and they should not hurt decision-making.

  • Assuming completeness requires data on every possible risk and at every level of detail.

    The word 'complete' sounds absolute.

    Fix: Completeness covers material risks. Gaps may exist but must be identified, explained and reported to management.

  • Treating timeliness as meaning real-time data for all reports.

    Students overread the word 'timely'.

    Fix: Required speed depends on the nature and volatility of the risk and the purpose of the report. Stress and crisis demand faster delivery.

  • Placing data architecture and IT infrastructure under Principle 3 to 6.

    IT supports all four, so students attach it to one of them.

    Fix: Data architecture and IT infrastructure are Principle 2. It is the foundation that lets the capability principles work.

  • Mixing adaptability with timeliness.

    Both mention responding quickly to requests.

    Fix: Timeliness is general speed of aggregation. Adaptability is flexibility to produce new cuts on demand, such as ad hoc or scenario requests.

Worked examples

Example 1

A bank's group risk team finds that credit exposure figures from two subsidiaries do not match the general ledger, and staff fix the differences by hand each month. Which BCBS 239 principle is most directly weakened?

A. Principle 3, accuracy and integrity
B. Principle 4, completeness
C. Principle 5, timeliness
D. Principle 6, adaptability

Show the solution
  1. Find the symptom: figures do not match the ledger and are fixed manually.
  2. Ask the questions. Is the data right? No. The numbers are wrong and unreconciled.
  3. Manual fixes also signal weak automation. Principle 3 favours largely automated aggregation and reconciliation with accounting sources.
  4. Nothing in the stem says exposures are missing, late or inflexible, so B, C and D do not fit.

Answer: A. Principle 3, accuracy and integrity.

Example 2

After a market shock, regulators ask a bank for exposure to a specific industry across all legal entities. The data exists and is accurate, but the bank needs three weeks because it cannot reshape its standard reports. Which principle is the best match?

A. Principle 3, accuracy and integrity
B. Principle 4, completeness
C. Principle 5, timeliness
D. Principle 6, adaptability

Show the solution
  1. Find the symptom: the data is accurate and exists, but standard reports cannot be reshaped for an ad hoc request.
  2. This rules out A, since the data is accurate, and B, since the data is available.
  3. Timeliness (C) concerns general speed of aggregation. Here the delay is caused by rigidity.
  4. Principle 6 requires the bank to produce data on demand for ad hoc requests and new cuts, so D is the root cause.

Answer: D. Principle 6, adaptability.

Exam tips

  • Memorise the order: 3 accuracy and integrity, 4 completeness, 5 timeliness, 6 adaptability. Many questions simply give the number.
  • Underline the failure word in the stem and map it before reading the options.
  • Be wary of absolute wording such as 'must be perfect' or 'only automated'. The principles allow documented approximations and judgement.
  • If the stem mentions architecture, IT infrastructure or data ownership, think Principles 1 and 2 before Principles 3 to 6.
  • Under stress or crisis, expect timeliness and adaptability to be the tested ideas.

Practice questions from Principles for Effective Data Aggregation and Risk Reporting

Risk Data Aggregation Capabilities in other exams

The same ground in other exams, if you are preparing for more than one or want another angle on it.

Risk Data Aggregation Capabilities: frequently asked questions

What is the difference between accuracy and completeness in BCBS 239?

Accuracy and integrity (Principle 3) is about whether the data is correct and controlled. Completeness (Principle 4) is about whether all material risks and entities are captured. A report can be accurate but incomplete if an entity is left out.

Which BCBS 239 principles cover risk data aggregation capabilities?

Principles 3 to 6: accuracy and integrity, completeness, timeliness and adaptability. Principles 1 and 2 cover governance and data architecture. Principles 7 to 11 cover risk reporting.

Where do data architecture and IT infrastructure fit in BCBS 239?

They sit in Principle 2, not in Principles 3 to 6. The infrastructure should support the four capability principles in normal times and in stress or crisis.

How do I remember the BCBS 239 aggregation principles?

Use the cue: right, all, fast, flexible. Right is accuracy, all is completeness, fast is timeliness and flexible is adaptability. They run in order as Principles 3, 4, 5 and 6.