DNB publishes an artcle with the outcome of an investigation, conducted in 2023, into the management of data quality by Dutch pension funds before, during, and after the transition. Despite the funds claiming adherence to the Good Practice guidelines for data quality assurance, the study revealed that not all have implemented steps 1 to 3 of the Good Practice.
Step 1:
Some data quality policies lacked compliance with recent regulations, and crucial elements were inadequately detailed, impacting assessment against established frameworks. This includes criteria for identifying critical data elements (KDEs), the justification for Maximum Permitted Deviation (MTA), and the execution of (additional) data analyses.
Step 2:
Risk analyses did not consistently occur at the KDE level, lacking insight into gross risks and resulting control measures. An incomplete risk analysis increases the risk of inadequate data quality control. Pension funds sometimes reference the effectiveness of control measures from an ISAE3402 assurance report, which has a different materiality for the financial statement audit. Moreover, these measures may not focus on the accuracy and completeness of data quality required for the transition, and not all processes relevant to data quality are within the scope of ISAE3402.
Step 3:
Data analyses and sub-observations are not always coherent with previous steps and did not always logically follow risk analyses, posing a risk to the justification of the scope. Ensuring coverage of all critical data elements and detailing principles for additional tasks were identified as crucial.
To ensure net risks fall within tolerances, DNB recommends an evaluation focusing on the coherence of risk assessment with data analysis results and Maximum Permitted Deviation.
Please note that the investigation is limited to steps 1 to 3 of the Good Practice. For more information on the steps and associated activities, please see Good practice assurance of data quality by pension funds.