Product Manager – Product Analytics & Strategy, American Express
Operational risk events are usually explained after the damage is done. We asked a different question: did our data governance metrics warn us in advance?
Where we started
American Express had reported operational-risk events, but there was no clear view of how many were caused by data issues, or whether existing governance metrics would have flagged them early.
The goal was to find out if we had enough metrics to detect risk beforehand — not to explain it better after the fact.
How I got there
Two years of operational-risk events that occurred and were reported.
Down to the events that were data-related.
Each event to a pillar of the data taxonomy: stewardship, quality, fit for purpose, sensitivity, architecture.
Whether a metric already existed to detect and report that risk.
Where no metric existed, size the potential damage and decide whether to build one.
What made it defensible
A gap became a “build a metric” candidate only if the estimated impact breached both thresholds:
Metric exists?
Yes → No action.
No → Assess the impact.
Thresholds breached?
Yes → Design the new metric and take it to leadership.
No → Monitor.
The taxonomy
Nobody clearly owns the dataset, so nobody answers for it or fixes it when it breaks.
Records that are incomplete, duplicated, stale or simply wrong at the point of use.
Data that exists, but cannot support the report, model or submission it is used for.
Personal or restricted data exposed, over-shared or handled outside policy.
Fragile pipelines and undocumented dependencies that fail quietly downstream.
What we built
What it measures: completeness of mandatory fields in transaction records.
(Complete transaction records / Total transaction records) × 100
Mandatory fields
Example: 500,000 daily transactions, 750 incomplete → 99.85%
Why it matters: every incomplete record costs time to investigate, and completeness below 99.5% risks regulatory reporting failures.
What it measures: how well data meets regulatory reporting requirements.
0.4 × Format Compliance + 0.3 × Timeliness + 0.3 × Accuracy
Example (Basel III style): 98 / 100 / 95 → 97.7
Escalation bands
Figures shown are illustrative and do not represent actual American Express data.
Getting it approved
The metrics went to senior leadership with the evidence behind them: the two years of events, the gaps in early-warning coverage, and the impact sizing behind each threshold.
Approval came from translating a data gap into the two things leadership weighs — money and people — rather than presenting a framework in the abstract. The metrics were approved before being put in place.
Looking back