Board trust in data is earned, not declared

Boards do not trust data because a data team says the governance framework exists. They trust it when the organisation can show how a number was produced, why it is the right number, who owns it, and what happens when it fails quality expectations.

That is why governance theatre is so damaging. Committees, glossaries, and catalogues can create the appearance of control while leaving the actual decision path unchanged. A board pack still lands with contested metrics. Audit evidence is still rebuilt manually. Data owners still behave as reviewers rather than accountable stewards.

What the supervisors still find

Banking is the sector where this has been measured most carefully, because BCBS 239 gave supervisors a yardstick. The Basel Committee's most recent formal progress report, published in November 2023, assessed thirty-one global systemically important banks. Two of them fully complied with all the principles. No single principle had been fully implemented by every bank. That was ten years after publication and seven years after the original compliance deadline.

The Committee's January 2026 newsletter did not re-score the banks, but it did name the themes that keep recurring in supervisory and industry outreach. Three stand out for any board, in or out of banking.

Recurring gap	What it looks like in the boardroom	What closes it
Data lineage and traceability	A number can be reconciled but not explained; the trail runs through spreadsheets and people	Risk-based identification of Critical Data Elements, with maintained definitions, ownership and lineage at the grain each control needs
Ad hoc reporting under stress	The estate answers last quarter's questions well and this week's crisis badly	Aggregation that can be re-cut by product, geography or counterparty without a project
Cross-border and cross-entity alignment	Group and subsidiary packs disagree, and nobody can say which is right	One definition per metric, owned once, with subsidiary variances recorded rather than hidden

The same newsletter made two further points that boards should read carefully. The first is that oversight of risk data aggregation sits with the board, which is expected to obtain assurance that the practices align with organisational objectives, with management providing evidence-based updates rather than status commentary. The second is that AI adoption in risk data aggregation is still at an early stage, and that the quality of AI-driven output depends on the quality of the data it runs on. A board that is being asked to approve an AI programme is entitled to ask what the lineage gap findings mean for it.

Governance theatre has tells

Directors do not need to be data specialists to distinguish operational governance from the performed kind. Five questions expose the difference quickly.

1. Pick any number in the pack and ask who owns it. A name should come back within the meeting, and it should be somebody in the business, not the head of reporting.
2. Ask how Critical Data Elements are identified and reviewed. The answer should show materiality criteria, links to decisions and obligations, named owners, and maintained definitions and lineage. A count alone says nothing about control.
3. Ask when a quality threshold was last breached and what happened. Credible governance produces a log of breaches with named escalations. Theatre produces a green dashboard.
4. Ask how long it takes to rebuild the evidence for a regulatory submission. If the answer involves a team and a fortnight, lineage is being reconstructed rather than captured.
5. Ask which reports were retired last year. A governance function that has never retired anything is not governing; it is accumulating.

Governance that is visible in the work

Credible governance is more operational. It connects Critical Data Elements to reporting obligations and business decisions. It defines stewardship where the data is understood, not merely where the technology sits. It records lineage at a level useful for control. It creates quality thresholds that trigger action rather than commentary.

In financial services, BCBS 239 gives this work sharper edges. Aggregation, accuracy, timeliness, adaptability, and governance are not abstract principles. They become practical questions about finance, risk, customer, product, and regulatory reporting data, and the supervisory consequences of getting them wrong are no longer theoretical. Supervisors can and do require additional capital where a firm's own risk figures cannot be relied on.

The same pattern applies outside banking. A private-equity-backed business preparing for exit is measured on whether its numbers survive diligence. A listed company is measured on whether its disclosures survive audit. If the organisation cannot explain its metrics, inspect its data flow, or evidence remediation, it does not have decision infrastructure. It has reporting assets with uncertain control value.

Where to start

The first ninety days of a credible programme are not spent buying a catalogue. They are spent agreeing the decisions and obligations that matter, establishing a materiality-based process to identify their Critical Data Elements, and capturing definitions, ownership and lineage. Quality monitoring must connect thresholds to escalation, remediation and closure evidence. Tooling supports that process as scope and dependencies evolve.

Board trust is earned when governance is visible in the work: fewer reconciliations, clearer ownership, faster evidence, and decisions that can withstand scrutiny.

Sources

• Basel Committee, Progress in adopting the Principles for effective risk data aggregation and risk reporting, November 2023
• Basel Committee, Newsletter No. 36 on implementation of the BCBS 239 Principles, January 2026
• Workiva, 2026 Executive Benchmark Survey