On 30 September 2026 the PRA reported what it found when it finally looked at the governance of the data behind expected credit loss provisions. Critical data element frameworks and lineage records cover core model execution and stop there.
In brief: on 30 September 2026 the Prudential Regulation Authority published its thematic feedback on IFRS 9 expected credit loss accounting, the first of these reviews to examine the governance of the underlying data rather than the models that consume it. The recurring weakness is a perimeter problem: critical data element frameworks, lineage records and quality controls cover core model execution and stop before the post-model adjustments and monitoring that now carry much of the judgement. Firms have one reporting cycle to close the gap, because the PRA has asked auditors to report on progress for its 2027 review.
The PRA gave firms a year of notice on this question, which makes a thin answer harder to explain away.
In its letter of 30 September 2025 the PRA said it planned to use the next round of written auditor reporting to explore the governance of source data, data flows and data aggregation, naming accountability for data risk, the completeness and accuracy of critical data elements, data quality policies, aggregation complexity and oversight of cloud-based and third-party solutions. The letter of 30 September 2026, again from David Bailey, Executive Director for Prudential Policy, to the chief financial officers of selected PRA-regulated deposit-takers, is what that exercise found. It draws on the written auditor reports received in 2026 under Chapter 8 of the Auditors Part of the PRA Rulebook, and its annex runs to 79 paragraphs, with paragraphs 8 to 25 on data governance and 26 to 42 on model risk.
The headline is reassuring. Auditors found no pervasive risk of material misstatement arising from ECL data, and the PRA reports continuous improvement in capabilities, controls and governance. The detail is less comfortable: the maturity and consistent application of firms' frameworks varied, and the variation falls in a pattern. Chart 1 shows aggregate ECL coverage at major UK deposit-takers across 2019 Q4 to 2026 Q2 at its lowest level since before Covid. The PRA is careful to say this does not in itself indicate under-provisioning. It does mean each remaining judgement carries more weight than it did three years ago.
The perimeter is drawn in the wrong place
Read the annex as one finding repeated under five headings. In each case the control exists, and in each case it covers the model and not the work surrounding it.
Control
What the PRA saw in better practice
Where it stopped
Critical data elements
Sensitivity analysis stressing model inputs against quantitative thresholds, qualitative criteria for items such as macroeconomic variables, and periodic attestation of the CDE inventory after changes to models, systems or reporting
CDE frameworks often did not cover material data used outside core model execution, including post-model adjustment calculations and model monitoring
Accountability
Ownership assigned at individual CDE level covering monitoring, remediation and attestation, cross-functional governance committees, and documented formal hand-offs between data providers and data users
Accountability fragmented across systems, teams and locations, with unclear hand-offs creating control gaps and reliance on downstream review and key personnel
Data quality controls
A central inventory linking each CDE to its controls and owners, automated validation and reconciliation, controls at source and at key transfer points, and independent second-line review
Heavy reliance on manual reconciliation and recurring manual remediation in legacy systems and non-core portfolios, alongside unresolved general IT control weaknesses including privileged access
Data lineage
Centrally maintained end-to-end lineage from source system to model use and reporting, reviewed after changes, with controls and owners mapped and manual adjustments governed
Lineage held by individual system or control owners rather than consolidated, with gaps for some legacy models and for data used in monitoring and post-model adjustments
Third-party data
A formal third-party risk framework covering assessment and ongoing monitoring, with service auditor findings reviewed against complementary internal controls
The PRA encourages firms to keep oversight of third-party sourced, processed or hosted ECL data under review, including the scope and timeliness of external assurance
The middle column describes a mature governance programme. The right-hand column is what happens when that programme was scoped around a model inventory instead of a decision. Post-model adjustments are where a firm records what the model cannot see, which is precisely the data that should sit inside the perimeter.
Monitoring has become software, and software was not in the inventory
The model risk section lands in the same place from a different direction. The PRA says model risk controls must keep pace with increasingly automated and data-intensive monitoring, and spells out what that means: controls over the monitoring tools and their code, the quality and lineage of monitoring data, and the completeness of model inventories and change records.
That is a material change in what a model inventory has to contain. Monitoring is the control that tells a firm a model has stopped working, so if the monitoring pipeline is uncontrolled code reading unlineaged data, the firm has the appearance of a detective control rather than the control. The weaker practice makes the consequence concrete: monitoring misaligned with the segmentation the model was designed around, applied only at aggregate level, thresholds too broad to trigger timely investigation, and back-testing that did not separate model performance from error in the economic forecast. Pre-adjustment monitoring was the main instrument and post-adjustment monitoring was less consistently formalised, which means firms were watching the model they had already corrected rather than the correction.
None of the underlying expectations are new
This is the part a board should find clarifying rather than alarming. The letter creates no obligations. It footnotes the ones that already exist and shows where they were not applied.
Existing expectation
What the 2026 letter adds
SS1/23 model risk management principles, current version effective 23 April 2026
Cited for data integrity in model and adjustment processes, monitoring as an active control, and model risk governance. The inventory point attaches here
BCBS 239 principles on risk data accuracy and integrity
A tighter scope test: lineage and quality controls have to follow the data to the point of use, including manual and adjustment layers
SM&CR accountability
Fragmented ownership and undocumented hand-offs are now named as a supervisory finding, not a maturity observation
SS5/25 on managing climate-related risks, published December 2025
Footnoted in the climate section, where good practice included unique property identifiers joining internal data to EPC and flood risk datasets
The PRA has also told firms what the next cycle will test. It has asked auditors for their views on firms' progress in these areas for the 2027 review, and encourages firms to assess themselves and share the result with their auditors. Separately, it has asked auditors how firms identify and monitor credit risk in private market exposures and reflect changes in ECL in a timely way, citing difficulty in aggregating exposures and in obtaining reliable data on complex, interconnected and correlated risks. That is the next data perimeter, named a year ahead in the same way this one was.
Five questions before the next board meeting
Does our critical data element inventory include the data used in post-model adjustments and in model monitoring, or does it stop at model execution?
Can we produce one consolidated lineage view from source system to reported provision, or do we assemble it from what system owners hold?
Who owns each critical data element by name, and is the hand-off between data provider and data user documented and controlled?
Are our monitoring tools, their code and their input data inside the model inventory and change control, and when did validation last review them?
When our auditors are asked next year to assess our progress, what would we want to show them, and what are we doing about it this quarter?
A provision is a judgement the board signs, and the data perimeter decides whether that judgement is evidenced or merely asserted.