Distinguish prudential standards from privacy rules
The Basel Framework consolidates BCBS standards. Its operational risk guidance considers governance, technology, continuity and outsourcing within an integrated risk framework. It does not prescribe a universal list of personal-data detection patterns. Local supervisory requirements determine how the framework applies to a bank.
Connect the data set to a banking activity
Choose a service such as customer onboarding, treasury reporting or loan administration. Identify the important information, processing dependencies and potential consequences of disclosure, unauthorised change or loss. Assign the risk to the process owner rather than leaving it as an isolated technology finding.
Differentiate confidentiality controls from reconciliation, availability and data-quality controls. Blocking an export may reduce disclosure risk while leaving a reporting integrity problem unresolved.
Include outsourced information flows
BCBS operational risk guidance addresses outsourcing arrangements, including data ownership and confidentiality. In practice, document which provider receives information, how the transfer is approved and how access ends. Test exceptions for operational support alongside the controls on routine sharing.
Sources: [2]
Review control evidence with the risk owner
For a selected scenario, retain the risk decision, test results and remediation owner. Check whether the control preserves required operational work and whether incident evidence reaches the appropriate risk process. A low alert count does not by itself demonstrate lower operational risk; coverage, response and residual risk need review.
Practical checklist
- Identify the applicable supervisory framework and banking process.
- Separate confidentiality, integrity and availability objectives.
- Map outsourced transfers and access termination.
- Link test evidence and residual risk to the process owner.
Applying this with TRIAS
Evaluate TRIAS discovery and DLP for specific information-handling scenarios within the bank's operational risk programme. Record supported channels, limitations and test outcomes. Capital calculations, supervisory reporting and the broader prudential assessment require separate controls and expertise.
Official sources
Last checked: . Practical examples are editorial implementation suggestions. Applicability depends on your organisation and jurisdiction.