BCBS 239 & report mapping
BCBS 239 asks a plain question: can you show which data your risk reports depend on, and whether that data is under control? This capability maps every CDE to the reports and principles that rely on it, so your posture is computed from the graph and backed by evidence at every link.
Every CDE is linked to the regulatory and management reports that consume it, with the links drawn from lineage evidence rather than declared mappings alone.
Coverage is shown by principle: for each BCBS 239 principle, you see the CDEs and reports it touches and exactly where the gaps sit.
A gap shows as a gap: a report line with no mapped CDE, or a mapped CDE with no owner, surfaces as a finding instead of staying invisible.
Mappings from your existing self-assessments are imported as claims and reconciled against what the parser actually found.
A per-report view answers examiner questions: pick a report and see every CDE it stands on, along with the control status of each.
One evidence pack per report assembles CDEs, owners, attestations, and lineage from the graph when the exam letter arrives.
Map
Lineage connects each CDE to every report line it feeds, with the parsed code as proof.
Reconcile
Declared mappings are checked against the evidence, and every difference is flagged for review.
Compute
Posture per report and per principle is derived directly from the graph, so it always matches the evidence underneath it.
Assemble
Evidence packs are generated per report for exams, internal audit, and the second line.
“Which data does this report actually depend on?”
Pick the report, and the per-report view shows every CDE it stands on along with the control status of each. The links come from lineage evidence, with the parsed code attached as proof.
“Show me your BCBS 239 posture, and how do you know it's true?”
Posture per report and per principle is computed from the graph, and every link is backed by parsed code and lineage evidence. Declared mappings are reconciled against that evidence, so what you present is what the evidence supports.
“If this field breaks, which regulatory reports are affected?”
Lineage connects each CDE to every report line it feeds, so you trace from the field to every regulatory and management report that consumes it. The impact is read from the graph, not reconstructed after the fact.
Start with proof, not a promise.
There are three ways in, and each one earns the next. You approve the exit criteria before we spend any more of your time or budget.
A 60-minute working session
Bring one report that is expensive to prove. We walk the mechanism against it. Nothing is required from your side.
A two-week guided sandbox
Your team works hands-on against a synthetic sample bank. It requires zero access to your systems and zero procurement.
A six-week proof on your systems
We use read-only metadata across five systems and one priority report, scored against criteria both sides sign first. The decision it produces is yours.