Your ICAAP should reflect your risk management process and how you identify and control the risks you face as a business. It is the responsibility of your Governing Body to understand the risks you face as a business, ensure you have processes in place to manage them, be able to articulate these and determine if you have enough capital to cover your material risks. Firms who have treated the ICAAP as a once a year exercise and have not gone through adequate risk assessment or challenges are finding, to their cost, that this falls below the regulator’s expectations.

As a minimum, the ICAAP should identify the major sources of known and potential risks your business faces, articulate your risk appetite, assess the impact if the risk materialises and take into account stress and scenario testing. It should consider the impact of potential adverse events and stresses on your risk profile and capital adequacy. The ICAAP document is the evidence that a firm has a process in place to consider these risks and the impact on the firm’s solvency.

Stress testing is often not done well and we see firms with either a weak or no stress test framework, resulting in poor test selection, tests not being sufficiently “severe but plausible” and limited governance or challenge around results. You need to make sure that your stress tests include a firm wide and market stress and that you have considered correlation and aggregation in the results.


Banks and CRD IV Investment firms are subject to regular Supervisory Review and Evaluation Process (SREP) reviews. For Banks, a review of their ICAAP by the regulator is not new but, for some investment firms, they may be receiving feedback on their ICAAP document for the first time. Often, the news is not good and firms emerge with a large capital add on. Once the capital add on has been calculated, you will not be able to negotiate until the next scheduled SREP visit.

There are some common themes emerging from SREP visits:

  • Incorrect calculation of Pillar 1 numbers
  • The ICAAP does not accurately describe the firm’s risk management process
  • Operational risks are not fully captured or calculated in sufficient detail
  • Liquidity is not covered
  • Wind down plans/recovery plans are not integrated into the ICAAP
  • Poor stress testing section.

Our Prudential Team has the skill sets and experience to help you. We see ICAAPs and associated regulatory feedback for a large range of firms and can use this knowledge to help you update your ICAAP process and documentation and we can provide training.

Share this