Skip to content

FRM Exam Part II · Risk Reporting

BCBS 239 Risk Data Aggregation and Reporting Principles

Updated 11 October 2026 · Fact-checked

BCBS 239 is the Basel Committee's set of 14 principles for risk data aggregation and risk reporting. They sit in four groups: overarching governance and infrastructure, risk data aggregation capabilities, risk reporting practices, and supervisory review. Exam questions ask you to match a weakness to the correct principle.

Understand Risk Reporting Principles and BCBS 239

BCBS 239 was issued in 2013 after the 2007-09 crisis. Many banks could not quickly and accurately see their total exposures across business lines and legal entities. Good risk models were useless because the underlying data was fragmented. The principles aim to fix that.

The document is titled Principles for effective risk data aggregation and risk reporting. It has 14 principles in four groups. It was written first for global systemically important banks (G-SIBs), and national supervisors are encouraged to apply it to domestic systemically important banks too.

Risk data aggregation is the process of defining, gathering and processing risk data so a bank can measure performance against its risk tolerance. Risk reporting is what is then presented to the board and senior management. Aggregation is the engine. Reporting is the output. Keep the two apart: aggregation principles are about data, systems and capabilities; reporting principles are about the content and delivery of reports.

The four groups are:

  • Overarching governance and infrastructure (Principles 1-2): 1 Governance; 2 Data architecture and IT infrastructure.
  • Risk data aggregation capabilities (Principles 3-6): 3 Accuracy and integrity; 4 Completeness; 5 Timeliness; 6 Adaptability.
  • Risk reporting practices (Principles 7-11): 7 Accuracy; 8 Comprehensiveness; 9 Clarity and usefulness; 10 Frequency; 11 Distribution.
  • Supervisory review, tools and cooperation (Principles 12-14): 12 Review; 13 Remedial actions and supervisory measures; 14 Home/host cooperation.

The principles apply to all material risk data, in normal times and in stress or crisis. Management must be able to produce aggregated data faster in a crisis. The board and senior management own the responsibility. Data aggregation must not depend on heavy manual workarounds, and the bank should know the limits of its capabilities.

Key formulas to remember

Structure of BCBS 239
14 principles = 2 (governance and infrastructure) + 4 (aggregation) + 5 (reporting) + 3 (supervisory)
Use the counts to place a principle in its group quickly.
Aggregation principles (3-6)
Accuracy and integrity, Completeness, Timeliness, Adaptability
These concern data capability. Remember as ACTA.
Reporting principles (7-11)
Accuracy, Comprehensiveness, Clarity and usefulness, Frequency, Distribution
These concern the reports themselves and who receives them.
Aggregation vs reporting
Aggregation = data capability; Reporting = content and delivery
The most common classification test.

How to solve Risk Reporting Principles and BCBS 239 questions

Use this method on any BCBS 239 scenario question.

  1. 1Read the scenario and identify the failure: slow, wrong, missing, rigid, unclear, infrequent or poorly governed.
  2. 2Decide whether the failure sits in data aggregation (systems, data) or in the report (content, delivery).
  3. 3Match the failure to a keyword: errors or reconciliation = accuracy; missing entities or risks = completeness; delays = timeliness; cannot handle ad hoc requests = adaptability.
  4. 4For reporting failures, separate content (accuracy, comprehensiveness, clarity) from rhythm (frequency) and recipients (distribution).
  5. 5Check if ownership is the issue: board or senior management responsibility, or fragmented IT architecture, points to Principles 1 or 2.
  6. 6Eliminate options that mix up the principle group or overstate what the rule requires, such as demanding full automation.
  7. 7Pick the option that names the specific principle and the specific fix.

Quickest way: Keyword matching to the 14 principles

When to use it: When you have under 90 seconds for a classification question.

  1. Underline the symptom word in the stem.
  2. Map it: errors = accuracy; gaps = completeness; delays = timeliness; ad hoc requests = adaptability; unreadable = clarity; wrong readers = distribution.
  3. Ask: is this about data or the report? That narrows to Principles 3-6 or 7-11.
  4. Choose the option matching both group and keyword.

Common mistakes in Risk Reporting Principles and BCBS 239

  • Confusing aggregation accuracy (Principle 3) with reporting accuracy (Principle 7).

    Both have the word accuracy in the name.

    Fix: Principle 3 is about data sources, controls and reconciliation. Principle 7 is about the reports being precise, reconciled and validated for the reader.

  • Treating BCBS 239 as only an IT project.

    Data architecture is the most visible theme.

    Fix: Principle 1 puts responsibility on the board and senior management, and governance covers the whole framework, not just systems.

  • Thinking timeliness means real-time data for all risks.

    The word timely sounds like instant.

    Fix: The standard is that the bank can produce data as soon as needed, with faster production in stress or crisis. The required speed depends on the risk and its volatility.

  • Placing Frequency and Distribution under aggregation.

    Students remember them as process topics.

    Fix: Both belong to risk reporting (Principles 10 and 11).

  • Saying BCBS 239 applies only in normal conditions.

    Students focus on routine reporting.

    Fix: The principles apply in stress and crisis too, and adaptability supports ad hoc requests.

  • Believing manual processes are banned.

    The text stresses automation and reducing manual workarounds.

    Fix: Manual processes are acceptable if controlled, but heavy reliance on them weakens the bank's compliance. Look for the answer that reduces risk through controls and automation.

Worked examples

Example 1

A bank's credit exposure report omits a subsidiary's derivative positions because that entity's system is not linked to the group data warehouse. Which BCBS 239 principle is most directly breached?
A. Timeliness
B. Completeness
C. Distribution
D. Frequency

Show the solution
  1. The failure is missing data from one entity, so it is a data problem, not a report delivery problem.
  2. That rules out Distribution and Frequency, which are reporting principles.
  3. Timeliness is about speed, but nothing here says data is late.
  4. Completeness requires capturing all material risk data across the group, including all entities and positions.
  5. The missing subsidiary positions are a completeness gap.

Answer: B. Completeness (Principle 4).

Example 2

Senior management asks for an ad hoc exposure breakdown by country and counterparty during a market shock. The bank needs three weeks because the data must be rebuilt manually. Which capability is weak, and which group of principles does it belong to?
A. Clarity and usefulness, risk reporting
B. Adaptability, risk data aggregation
C. Review, supervisory
D. Data architecture, governance

Show the solution
  1. The need is a flexible, on-demand cut of data during stress.
  2. Being able to meet ad hoc requests and generate data across different dimensions is adaptability (Principle 6).
  3. Adaptability is one of the four aggregation capability principles (3-6).
  4. Clarity concerns report readability, and nothing suggests the content is unclear.
  5. Review is a supervisory principle and is not relevant to the bank's internal capability.
  6. Data architecture is related, but the question asks for the specific capability that fails, which is adaptability.

Answer: B. Adaptability (Principle 6), within risk data aggregation capabilities.

Exam tips

  • Memorise the principle numbers and group counts: 2, 4, 5 and 3.
  • Questions usually describe a symptom and ask which principle is breached. Match the keyword, then check the group.
  • Watch for the aggregation versus reporting distinction. It is the most common trap.
  • Remember that BCBS 239 was aimed first at G-SIBs and applies in both normal and stress periods.
  • Reject options that say the principles require full automation or real-time data for every risk.

Practice questions from Risk Reporting

Risk Reporting Principles and BCBS 239 in other exams

The same ground in other exams, if you are preparing for more than one or want another angle on it.

Risk Reporting Principles and BCBS 239: frequently asked questions

What are the 14 principles of BCBS 239?

They are grouped into governance and infrastructure (Principles 1-2), risk data aggregation capabilities (3-6), risk reporting practices (7-11) and supervisory review and cooperation (12-14). The individual names run from governance through accuracy, completeness, timeliness, adaptability, comprehensiveness, clarity, frequency, distribution, review, remedial actions and home/host cooperation.

What is the difference between risk data aggregation and risk reporting?

Risk data aggregation is the process of defining, gathering and processing risk data to measure performance against risk tolerance. Risk reporting is the presentation of that information to the board and senior management. Aggregation is about data capability; reporting is about report content and delivery.

Who must comply with BCBS 239?

The Basel Committee designed it first for G-SIBs, which were expected to comply by a set timeline after publication. Supervisors are encouraged to apply it to domestic systemically important banks as well.

Does BCBS 239 apply during a crisis?

Yes. The principles apply in normal times and in stress or crisis. A bank should be able to produce accurate aggregated risk data quickly when conditions change.