Federal Housing Finance Agency Print
Home / Supervision & Regulation / Advisory Bulletins / Data Management and Usage
Advisory Bulletin

Data Management and Usage

Number: AB 2016-04
Pertains To: Fannie Mae & Freddie Mac
9/29/2016

ADVISORY BULLETIN

AB 2016-04

DATA MANAGEMENT AND USAGE


Purpose

This advisory bulletin communicates to Fannie Mae and Freddie Mac (the Enterprises) the Federal Housing Finance Agency’s (FHFA) supervisory expectations for the management of data, including expectations for data governance, architecture, quality, and security. Strong data management supports safe and sound operations by enabling an Enterprise to provide secure, accurate, and accessible data to meet business needs and for use in risk management and compliance processes.

Background

Data management is the development, implementation, and enforcement of policies, procedures, and standards throughout the data lifecycle that establish how data are defined, shared, stored, protected, retrieved, and purged. Strong data management enables an Enterprise to reduce its exposure to operational, financial, and reputational risks. Consistent data management methods can reduce the likelihood of operational errors, adverse business decisions, and financial loss.

FHFA’s general standards for safe and sound operations are set forth in the Prudential Management and Operations Standards (PMOS) at 12 CFR Part 1236. Standard 1 (Internal Controls and Information Systems) articulates the considerations for the board of directors and management to evaluate when establishing internal controls and information systems. FHFA expects the Enterprises to provide relevant, accurate, and timely information to decision-makers and personnel in risk management and compliance functions; to establish and test contingency arrangements for information systems storing data; and to communicate policies and procedures to all personnel with regard to their respective duties and responsibilities. Effective data management includes compliance with applicable laws and regulations and adherence to FHFA supervisory guidance.

Guidance

FHFA expects each Enterprise to have enterprise-wide data management policies, procedures, and standards. Data architecture should be integrated and provide scalable accessibility and effective utilization across the Enterprise as appropriate. Each Enterprise should establish data quality requirements so that data used for decision-making are relevant, accurate, complete, timely, and consistent. Data management practices should allow users to identify and access appropriate data for business, risk management, and compliance activities and functions. FHFA expects the confidentiality, integrity, and availability of data to be consistent with sound business practices and regulatory requirements.

Fundamental requirements in the following areas are detailed below:

  • Data Governance
  • Data Architecture
  • Data Quality
  • Data Security
  • Data Usage

Data Governance

Data governance provides the necessary framework to control and support data used in decision-making and risk management. Each Enterprise should establish a data strategy that supports organizational goals through data management, and effective policies, procedures, and standards to maintain the confidentiality, integrity, and availability of Enterprise data throughout the data lifecycle. Policies, procedures, and standards should cover, at a minimum, data architecture, data quality, data security, and data usage. Policies and procedures should establish data requirements; controls for assessing and monitoring data; assignment and coordination of individuals’ roles and responsibilities, including their authority to manage the data; and management support and accountability of data-related issues. Policies, procedures, and standards should be reviewed and updated at least annually and aligned with legal and regulatory requirements for records management.

In order to assure data oversight and accountability, an Enterprise should designate individuals to be responsible for managing data and representing the interests of relevant stakeholders. Defined responsibilities should include, at a minimum, identifying and monitoring controls for processing or storing data; managing content of both structured and unstructured data; and controlling data from internal and external sources. A senior-level management official should be responsible for and report on effective data management practices for each business unit or control function.

The Enterprises should monitor and enforce data policies, procedures, and standards. Instances of non-compliance should be identified and tracked through to resolution. Metrics to measure and communicate the effectiveness of the Enterprise’s data strategy should be developed and adopted.

Data Architecture

Data architecture should define and support data requirements and formats, direct the integration of data, and align data investments with the data strategy. An Enterprise should establish data standardization requirements across the organization that are consistent with the data strategy and that reflect the needs of business and risk management functions. Adherence to those requirements should be confirmed throughout the data lifecycle. Each Enterprise should deploy data in a way that reduces redundancy and encourages the use of a single-source system of record for each element. Data should be maintained or archived pursuant to business, legal, and risk requirements to allow for recovery or evaluation of historical data outputs, whether stored in an Enterprise’s data center or in a hosted cloud environment. The use of data virtualization should consider appropriate data synchronization and integration.

Data models define the Enterprise’s technical requirements for data and the structure to support those requirements. Data modeling, in conformance with established standards, can support reliable data quality and reduce disparate data. In order to standardize data and track the flow of data, both business and technical metadata should be used to describe data characteristics for purposes of organization, collection, storage, and usage. Metadata can improve business collaboration, integration, and efficiency by providing organizational understanding of data and the business processes used by the Enterprises.

Data Quality

An Enterprise should take steps designed to ensure that data are of an acceptable quality to meet business requirements and control function needs. Data should be sufficiently accurate, complete, timely, and consistent to enable the Enterprise to generate reliable results, such as for reporting and risk modeling. An Enterprise should have comprehensive data quality management policies and procedures that include outlining roles and responsibilities regarding the collection, dissemination, and maintenance of data, both created and acquired; defining data quality requirements for created data; defining data quality checks for acquired data; and requiring a mechanism for assessing and verifying data quality, data quality metrics, and data conformance requirements.

Data should be validated at different points in the lifecycle to assure it meets integrity requirements. An Enterprise should have a methodology for identifying and addressing data inconsistencies, problems, and defects. An Enterprise should design and implement controls intended to ensure quality of data in use, at rest, and moving through applications or databases. Data standardization should consider the relationships of data and how to maintain integrity of data from multiple sources. Tools and techniques should be employed to assure conformity to data quality standards. Data used for decision making should have auditable trails to confirm the quality of data.

Data Security

Data must be protected against unauthorized and inappropriate use, modification, disclosure, and purging. Each Enterprise should have policies and procedures for monitoring and managing data security that are intended to ensure confidentiality, integrity, and appropriate availability of data. This includes the creation and maintenance of data classifications and controls consistent with the internal standards established in data governance, data architecture, and data quality management.

Data security management should contain specific security requirements established for categories of data, such as personally identifiable information, intellectual property, and non-public information. Data security controls should be commensurate with the security requirements. Each Enterprise should have procedures and processes to ensure that the controls are documented, reviewed, and tested related to those requirements. In order to secure data, an Enterprise should maintain a comprehensive inventory of databases and contents to identify and protect their data and dataflow. An Enterprise should identify and implement encryption controls that are consistent with industry standards and supervisory guidance.

Data Usage

Data management enables relevant data to be used by an Enterprise to meet its business needs; manage business risks; and support risk management and compliance functions. Enterprise data, whether generated internally or acquired, should be available to business and risk functions to provide comprehensive, clear, and useful outputs. Reporting or risk modeling processes should accurately aggregate data and be able to be reconciled and validated. Reliance on manual processes to manipulate data should be limited to reduce the possibility of human error. Each Enterprise should establish procedures intended to ensure that reports conveying the same data are consistent enterprise-wide. Sufficient controls should be implemented to appropriately protect the confidentiality of distributed information derived from data.

Related Guidance

Information Technology Investment Management, Federal Housing Finance Agency Advisory Bulletin AB-2015-06, September 21, 2015.

Cyber Risk Management Guidance, Federal Housing Finance Agency Advisory Bulletin AB-2014-05, May 19, 2014.

Operational Risk Management, Federal Housing Finance Agency Advisory Bulletin AB-2014-02, February 18, 2014.

Model Risk Management Guidance, Federal Housing Finance Agency Advisory Bulletin AB- 2013-07, November 20, 2013.

12 CFR Part 1236 Prudential Management and Operations Standards, June 8, 2012.

Safety and Soundness Standards for Information, Office of Federal Housing Enterprise Oversight Policy Guidance PG-01-002, December 19, 2001.

Advisory bulletins communicate guidance to FHFA supervision staff and the regulated entities on specific supervisory matters pertaining to the Federal Home Loan Banks, the Office of Finance, Fannie Mae, and Freddie Mac. This advisory bulletin is effective immediately upon issuance. Contact Kari Walter, Senior Associate Director, Office of Governance, Compliance, and Operational Risk at Kari.Walter@fhfa.gov or Annie Golden, Supervisory Risk Analyst, Office of Governance, Compliance, and Operational Risk at Annie.Golden@fhfa.gov with comments or questions pertaining to this bulletin.
Attachments:
© 2020 Federal Housing Finance Agency