Back-Book Exposure

A new obligation lands with an application date 14 months out. It requires that every customer record carry an explicit, timestamped basis for a particular processing activity. The programme sequences the work sensibly: analysis, then the processing changes, then the data capture, then migration. The capture change ships in month 11.

By then the organisation has created another eleven months of records without the field. The compliance problem has quietly become two problems — a system change and a remediation of several million existing records — and only one of them was in the plan.

Why it matters

Most regulatory programmes are planned as system changes, and the system change is usually the easy part. The expensive part is the stock of records that predate it, because you cannot ask a customer in 2026 what they consented to in 2024, and you cannot infer a basis that was never recorded.

The exposure is a function of time, and the only lever is when the capture change ships. Every month of delay adds a month of new records to the remediation set at the business's full transaction rate. That makes capture the highest-value thing to ship first, even though it is the least visible deliverable and produces no demonstrable compliance on its own.

Implementation patterns

• Size it before sequencing anything. Records created per month multiplied by months until the capture change ships, plus the existing stock within the retention period. A business creating 400,000 records a month that ships capture in month 11 has added 4.4 million records to the problem by choice.
• Ship capture first and separately. Write the new field from day one even when nothing reads it yet. It is a small, low-risk change and it stops the stock growing.
• Allow a provisional value with a reason code. "Not captured", "defaulted", "migrated" are legitimate states; silently writing a guess is not, because the guess is indistinguishable from a real value in an audit.
• Decide the remediation route per cohort, not globally. Active customers can be asked on next interaction. Dormant customers may be cheaper to close or to exclude from the activity. Records outside the retention period should be deleted rather than remediated.
• Count the back book as a reportable number. A monthly figure of records lacking the field, trending down, is what a regulator and a board can both read.
• Check the obligation's retrospective reach. Some obligations apply only to new records, which turns a remediation project into nothing. Establish this in week one, because it changes the programme's size by an order of magnitude.

Industry example

Data-protection regimes make the pattern concrete. India's Digital Personal Data Protection Act, passed in 2023, sets consent and notice requirements that apply to personal data a fiduciary holds, and firms preparing for it found the same shape: the system change to capture consent is weeks, and the back book of existing data subjects is the programme.

The Reserve Bank of India's payment data direction of 6 April 2018 shows the other variant, where the exposure is location rather than a missing field: data already stored abroad had to be brought into scope within six months, and the volume of that existing stock, not the design of the new pipeline, determined how hard the deadline was.

Failure scenarios

• Capture shipped last, so the organisation spends the programme manufacturing more of the problem it is being paid to solve.
• Defaults written silently. Every record now has a value and none of them is trustworthy, which is worse than a null because the gap is no longer visible.
• Remediation planned as one campaign against millions of records with no cohort strategy, so it competes with the system work and finishes after the deadline.
• Retention never examined. Records being remediated are outside the period they should have been held for, so the work was both unnecessary and itself a breach.
• No trend reported, so nobody notices the stock is growing faster than remediation is clearing it.

Trade-offs

Shipping capture early costs a schema change and a write path before anyone can use the data, which looks like effort with no deliverable attached and is politically hard to fund. It also forces decisions — what values are permitted, what a provisional state means — earlier than the analysis would naturally produce them.

What it buys is a bounded problem. The alternative trades a small early cost for an unbounded later one, and the later one arrives with a deadline attached and no option to extend.

When not to use it

The concept does not apply when the obligation is purely forward-looking and the regulator has said so, or when the retention period is short enough that the back book clears itself before the application date — a 90-day retention and an 18-month runway means doing nothing is a valid plan, and saying so saves a programme.

It is also the wrong frame where the records are few and high-value. Two thousand institutional clients can be contacted individually; the cohort arithmetic is overhead, and a spreadsheet and a relationship manager will beat any pipeline.

Interview question

Q: A new obligation applies in 14 months and requires a field you do not currently capture. The programme plan ships the data-capture change in month 11, after the processing changes. What do you say, and what number do you bring?

What a strong answer covers: computing records created per month times months of delay; arguing capture first because it is the only lever on a growing stock; permitting provisional values with reason codes rather than silent defaults; splitting remediation by cohort including deletion as an option; checking whether the obligation is retrospective at all before sizing anything; and reporting the back book as a monthly trend.

Quick check

Quiz: A firm creates 400,000 records a month and plans to ship the new capture field in month 11 of a 14-month programme. How much of the remediation set is self-inflicted? About 4.4 million records, all of them avoidable by shipping the capture change first.

Flashcard: Why is data capture the first thing to ship in a regulatory programme, even though it proves nothing on its own? — Because the back book grows at the business's full transaction rate until it ships. Capture is the only lever on the size of the remediation, and no later work can recover information that was never recorded.