Ten areas where an Internal Capital Adequacy Assessment Process is tested, what evidence satisfies a reviewer in each, and what a weak submission looks like — written for teams preparing a document that has to survive challenge.
In short
- Supervisors test evidence rather than conclusions, across roughly ten areas: board ownership and governance, how material risks were identified and materiality determined, the derivation and validation of quantification parameters, aggregation and the treatment of double counting and diversification, stress scenario design and severity justification, the capital plan and its reconciliation to the approved business plan, the executability of management actions, capital risk appetite and its trigger ladder, independent challenge with a documented trail, and the use test — proof that the assessment changed decisions the institution actually took.
- The recurring failure is not an absent section but a present section that asserts a position instead of evidencing how it was reached.
- The use test is the requirement that an internal capital assessment demonstrably influences the decisions an institution takes, rather than existing only as an annual document.
- Preparation time depends far more on the state of the evidence than on the state of the document.
- The common error is treating an approaching review as a writing exercise, which produces a better-argued version of the same unsupported conclusions.
On this page
- Governance and board ownership
- Material risk identification and materiality criteria
- Quantification method and parameter derivation
- Aggregation, diversification and double counting
- Stress scenario design and severity justification
- Capital planning and business plan reconciliation
- Management actions and their executability
- Capital risk appetite, triggers and escalation
- Independent challenge and validation
- Use test and decision traceability
An ICAAP is assessed less on its conclusions than on its evidence.
Reviewers rarely dispute that a bank believes its capital is adequate; what they test is whether the document shows how that belief was formed, who challenged it, what would change it, and whether the same reasoning drives actual decisions between reporting dates.
The checklist below sets out the ten areas where submissions are most consistently probed, what a reviewer is looking for in each, and the pattern that marks a weak submission — which is almost never an absent section, but a present section that asserts rather than evidences.
Governance and board ownership#
A reviewer looks for evidence that the board understands and owns the capital adequacy conclusion rather than receiving it.
That means approved terms of reference setting out decision rights across the board, the risk committee, finance, risk and treasury; minutes in which the ICAAP and its key assumptions were genuinely discussed, with recorded questions and management responses; a documented approval of capital risk appetite and of the ICAAP itself, with dates; and evidence that the board was told what the assessment does not cover.
A weak submission carries a governance chapter describing an organisation chart and a committee calendar, with minutes recording only that the document was noted and approved — the tell being that no question, objection or requested change appears anywhere in the record.
Material risk identification and materiality criteria#
A reviewer looks for a documented process that starts from the balance sheet and the business model rather than from a standard risk taxonomy, and that explains why each risk was judged material or immaterial.
Strong submissions show the assessment criteria and the thresholds behind them, the risks considered and rejected with reasons, explicit coverage of concentration, interest-rate risk in the banking book, sovereign, business and strategic, model, conduct and climate-related exposure, and a clear statement of which material risks are quantified, which are managed qualitatively within limits, and why.
A weak submission reproduces a generic risk list with no rejected candidates, no link to the bank’s own portfolio, and no explanation of how materiality was determined.
Quantification method and parameter derivation#
This is the area most often decisive, because the chosen parameters determine the answer more than any other input.
A reviewer looks for the derivation behind each capital figure — the data used, the period it covers, the confidence level and holding period chosen and why, the treatment of parameter uncertainty, evidence of independent validation, sensitivity analysis showing how the conclusion moves when key inputs are flexed, and a stated set of model limitations.
Reviewers will ask whether parameters calibrated on benign history remain appropriate under stress, and expect that question addressed explicitly.
A weak submission presents capital amounts as settled outputs with no derivation, no validation trail, no sensitivity analysis, and no acknowledgement that the historical window contains no loss event of the severity being assessed.
Aggregation, diversification and double counting#
A reviewer looks for an explicit bridge from the minimum requirement to the internal capital conclusion, with each addition derived, each overlap removed and justified, and any diversification benefit stated with its method and evidence.
Strong submissions show the aggregation under an alternative, more conservative assumption so the reader can see how much of the conclusion depends on the netting.
A weak submission sums independently quantified risks, adds the total to the regulatory requirement, and either recognises no overlap at all — inflating the number and inviting the question of why it was never questioned internally — or applies a diversification benefit with no stated basis, which reviewers treat as the more serious of the two.
Stress scenario design and severity justification#
A reviewer looks for scenarios built from the bank’s own vulnerabilities rather than borrowed wholesale, covering idiosyncratic, macroeconomic and combined stress, with a documented rationale for the severity chosen and evidence that severity was tested rather than assumed.
Strong submissions show the narrative behind each scenario, the mapping from narrative to parameters, the interaction between credit, market, funding and operational stress, and a reverse stress test identifying the combination that would exhaust the capital position or render the business model unviable.
A weak submission runs three scenarios labelled mild, moderate and severe with no explanation of why the severe case is severe, no reverse test, and macroeconomic paths borrowed unchanged from a published exercise designed for a different economy.
Capital planning and business plan reconciliation#
A reviewer looks for a multi-year projection built on the plan the board actually approved, with growth, mix, margin and cost assumptions traceable line by line to that plan, and with the capital consequences of growth shown before its earnings arrive.
Strong submissions project both sides of the ratio under stress — capital resources falling through losses and provisioning, requirements rising through rating migration and risk-weight increases — quarter by quarter, and identify the point at which each buffer would be breached.
A weak submission projects a capital ratio that never falls materially, holds risk-weighted assets flat through a severe downturn, and rests on a forecast the commercial teams would not recognise.
Management actions and their executability#
A reviewer looks for each action to state its capital benefit, its execution time, the trigger that would set it in motion, the approvals it would require, and evidence that it would still be available in the scenario that made it necessary.
Strong submissions show the stressed trajectory both before and after management actions and explain the difference action by action, and they disclose where an action depends on the same asset, market or counterparty as another.
A weak submission lists capital issuance and portfolio disposals as available at scale in a scenario that has just repriced the bank’s risk, counts the same portfolio twice for two different purposes, and gives no execution timeline against a stress that moves faster than the actions do.
Capital risk appetite, triggers and escalation#
A reviewer looks for an appetite expressed in quantitative terms that could actually be breached, a ladder of thresholds between the management buffer and the regulatory minimum, pre-agreed responses attached to each level, and evidence that a threshold has been monitored, reported and — where relevant — acted upon.
Strong submissions show the reporting pack in which the metrics appear, the frequency, and at least one instance of escalation or a documented near-miss.
A weak submission states an appetite in language that no plausible outcome could breach, sets its only trigger immediately above the regulatory minimum, and shows no monitoring evidence between annual approvals.
Independent challenge and validation#
A reviewer looks for challenge that left a trace — a risk function with the standing and the data to disagree with the producers of the assessment, documented validation of models and key parameters by a party independent of their development, an internal audit opinion on the ICAAP process itself, and a record of what changed as a result.
Strong submissions include the challenge log: the questions raised, by whom, and the resolution.
A weak submission asserts that the framework was independently reviewed without naming the reviewer, the scope or the findings, and shows a document that emerged from the process identical to the one that entered it.
Use test and decision traceability#
The last area is the one that determines how the rest is read.
A reviewer looks for evidence that the ICAAP influenced decisions the institution actually took — a growth target moderated, a limit tightened, a price changed, an acquisition deferred, a distribution reduced, a portfolio de-risked — each traceable back to a specific finding in the assessment.
Strong submissions provide dated examples with the papers behind them.
A weak submission describes integration with strategy in general terms and offers no instance in which the assessment changed anything, which reviewers treat not as a documentation gap but as the answer to whether the framework is a management tool or an annual deliverable.
Frequently asked
What do supervisors look for in an ICAAP review?
Supervisors test evidence rather than conclusions, across roughly ten areas: board ownership and governance, how material risks were identified and materiality determined, the derivation and validation of quantification parameters, aggregation and the treatment of double counting and diversification, stress scenario design and severity justification, the capital plan and its reconciliation to the approved business plan, the executability of management actions, capital risk appetite and its trigger ladder, independent challenge with a documented trail, and the use test — proof that the assessment changed decisions the institution actually took. The recurring failure is not an absent section but a present section that asserts a position instead of evidencing how it was reached.
What is the ICAAP use test?
The use test is the requirement that an internal capital assessment demonstrably influences the decisions an institution takes, rather than existing only as an annual document. Satisfying it means being able to point to dated, traceable instances — a growth target moderated because the stressed trajectory did not support it, a limit tightened after a concentration finding, a price changed, an acquisition deferred, a distribution reduced — each linked back to a specific conclusion in the assessment. Where no such instance exists, reviewers generally treat the whole framework as documentation rather than management, which affects how every other section is read.
How long does it take to prepare a bank for an ICAAP review?
Preparation time depends far more on the state of the evidence than on the state of the document. Where models, validation records, challenge logs and decision trails already exist, assembling a defensible submission is a matter of weeks. Where the gaps are evidential — parameters with no derivation, minutes that record approval but no discussion, management actions with no execution analysis, no instance of the assessment changing a decision — the remediation is a governance programme running over one or more full annual cycles, because several of the required artefacts can only be created by doing the work properly once. The common error is treating an approaching review as a writing exercise, which produces a better-argued version of the same unsupported conclusions.
What is the most common reason an ICAAP submission is criticised?
The most common criticism is that the assessment asserts rather than evidences: material risks listed without showing how materiality was determined, capital figures presented without their derivation, severity described as severe without the calibration behind it, and independent challenge claimed without a record of any question ever being raised. Closely behind sit two structural findings — a capital plan that never falls materially under stress, usually because risk-weighted assets were held flat, and management actions that would be unavailable in exactly the scenario that calls for them. All of these are governance findings rather than modelling ones, which is why they appear in institutions with capable quantitative teams.
The programme behind this article
Work through this material with the practitioners who wrote it.
Advanced ICAAP, Stress Testing & Capital Planning Masterclass
An advanced masterclass that takes the ICAAP from binder to boardroom: capital and liquidity stress testing that survives supervisory challenge, documentation regulators accept, and economic capital allocated where it earns — carried through capital planning, risk appetite and the use test.
View the programme →ICAAP Masterclass: Preparing, Regulatory Review & Deployment
The ICAAP built step by step through case studies — framework, report structure, stress and reverse stress testing, and the SREP link supervisors probe.
View the programme →Enterprise Risk Frameworks, ICAAP/ILAAP & Supervisory Stress Testing Masterclass
A two-day executive masterclass on making ERM, risk appetite, ICAAP, ILAAP and stress testing work as one integrated, board-owned, supervisory-defensible architecture — frameworks that drive capital, liquidity and credit decisions rather than sit in annual documents.
View the programme →