A $52 billion-asset bank on the East Coast completed 2,400 data governance certifications last year. By its own metrics, the program was a success. By its examiners' assessment, it was a liability. The OCC's 2024 findings noted that certifications were being produced mechanically, with renewal rates above 98 percent, a statistical impossibility if any genuinely critical review was occurring. The bank was certifying motion, not mastery.
This is certification fatigue. It is the governance equivalent of risk washing, and it is spreading through Tier 2 banks as programs mature past their useful initial energy and settle into ritual.
The Symptoms
Certification fatigue does not announce itself. It creeps in through four patterns:
The rubber stamp. Renewal rates that never dip below 95 percent. If nearly every certification is renewed, either your data is miraculously flawless or your review process is not actually reviewing anything. In banking, it is always the latter.
The time shift. Certifications that were once completed weeks ahead of deadline now arrive hours before. The review window compresses from a thoughtful process to a last-minute scramble. The quality of the review degrades proportionally.
The scope creep. Certification programs that started with 50 critical data elements now cover 800, because adding elements feels like progress. The marginal elements get rubber-stamped. The critical ones get less attention because the total workload is unsustainable. More coverage paradoxically means less governance.
The decoupling. Certifications that once triggered real conversations about data quality, ownership gaps, and policy misalignment now generate silence. The certification is filed. The meeting is not held. The problem is not surfaced. The process is complete. The governance is not.
The Root Cause
Certification fatigue is not a motivation problem. It is a design problem. Most certification programs are structured as periodic events, not as continuous governance. The certification happens at a point in time, produces a document, and then nothing happens until the next cycle.
During the gap between cycles, the context changes. Data owners move. Systems migrate. Quality thresholds shift. The certification decays from the moment it is signed. By the time the next cycle arrives, the certification is already stale. The reviewer faces a choice: recertify the current state (which requires investigation) or renew the existing certification (which requires a signature). The path of least resistance is renewal. And so the cycle degrades.
The Cost Beyond Compliance
The hidden cost of certification fatigue is credibility loss with regulators. Examiners are not naive. They see renewal rates. They notice when every certification sails through review. They understand that a 98 percent renewal rate means the review process is not functioning. The next step is an MRA or a finding about governance effectiveness, and those are harder to remediate than any individual data quality issue.
There is also an internal credibility cost. Business line leaders who participate in certification cycles that never surface real problems learn that governance is a paperwork exercise. They stop bringing issues forward. They stop investing in data quality. The governance program becomes a compliance tax that everyone pays and nobody values.
Redesigning the Cycle
The fix is to shift from periodic certification to continuous governance. Instead of certifying at a point in time and letting the certification decay, build a system that monitors certification validity continuously. When context changes, the certification flags itself for review. When quality thresholds shift, affected certifications surface automatically. When data owners change, their certifications enter a recertification queue.
This changes the reviewer's experience entirely. Instead of facing 800 certifications at renewal time, the reviewer only sees the ones that have actually changed since the last certification. The review volume drops. The review quality increases. The process becomes sustainable because it is targeted, not blanket.
The CoComply Position
CoComply's certification model is continuous, not periodic. Certifications are tied to live context. When something changes, the certification flags for targeted review. Renewal is no longer a blanket exercise. It is a precision intervention that only fires when there is actually something to review. This eliminates the mechanical renewal trap and keeps the review process honest.
A Quick Test of Your Program's Health
Pull your certification renewal rate for the last cycle. If it is above 90 percent, your review process is not working. A functioning review process should surface genuine issues at least 10 to 20 percent of the time. If everything passes, nothing is being examined. If nothing is being examined, your certifications are compliance theater. The examiner already knows this. The question is whether you will fix it before they say it in writing.