Summary An Internal Capital Adequacy Assessment Process (ICAAP) is either a live capital decision-making tool or an annual submission that nobody consults between filings. The difference is governance. This article sets out how to design an ICAAP that supports real board and executive decisions on capital.
What ICAAP is for ICAAP articulates the bank's own view of the capital it needs to support its strategy, given its risk profile, business model and stress environment. It is not a regulatory arithmetic exercise; the Pillar 1 capital calculation is the floor, not the ceiling. ICAAP addresses what Pillar 1 does not — concentration, interest-rate risk in the banking book, pension, strategic and reputational risk — and the interactions between them.
Governance around ICAAP The board owns the ICAAP. It approves the methodology, the scenarios, the risk appetite embedded in it, and the resulting capital plan. It does not draft it, but its ownership is meaningful only if it can challenge the assumptions. ICAAP governance therefore includes an executive review layer (typically the executive risk committee and ALCO), a second-line challenge layer coordinated by the CRO office, and periodic independent validation of the material components — most notably the models, scenarios and aggregation methodology.
Scenario design Scenarios are where ICAAP quality is most often lost. Scenarios that are too mild produce comfortable numbers and offer no decision-useful information; scenarios that are unmoored from the bank's risk profile produce numbers the business cannot act on. Effective ICAAP scenarios are anchored in the bank's material vulnerabilities, use consistent macro paths across risk types, and translate into P&L, capital and liquidity outcomes that the business recognises.
Connecting to decisions The ICAAP output should be visible in real decisions: capital planning, dividend and buy-back proposals, business-line strategic reviews, pricing calibration, and appetite recalibration. A bank whose capital decisions cannot be traced back to the ICAAP is running two capital narratives — the regulatory one and the actual one — and the actual one is undocumented.
Use test in practice Supervisors increasingly assess the "use" of ICAAP, not just its content. Evidence of use includes committee minutes referencing ICAAP outcomes, capital allocations that reflect stress outcomes, and remediation actions triggered by ICAAP findings. Absence of such evidence is a supervisory finding regardless of the document's quality.
CRO and board implications The CRO should present ICAAP as a coherent story: this is our risk profile, these are the scenarios that stress it, this is what the numbers do, and these are the actions we would take. Boards should push back on ICAAPs that read as compliance narratives rather than decision documents.
Practical implementation Multi-year ICAAP roadmap with methodology owners; annual challenge cycle with executive and board sessions dedicated to scenario design; independent validation of pillars and aggregation; explicit "use test" register tying ICAAP outputs to decisions; documentation standards that assume supervisory scrutiny.
Limitations No ICAAP eliminates the possibility of unexpected losses. It provides a defensible, board-owned view of capital needs given a defined set of scenarios, with limitations and uncertainties made explicit.
Related reading See [Banking Risk](/expertise/banking-risk), [Financial Risk](/expertise/market-liquidity), [Enterprise Risk](/expertise/enterprise-risk) and [Model Risk](/expertise/model-risk).
Frequently asked questions
What ICAAP is for?
ICAAP articulates the bank's own view of the capital it needs to support its strategy, given its risk profile, business model and stress environment. It is not a regulatory arithmetic exercise; the Pillar 1 capital calculation is the floor, not the ceiling. ICAAP addresses what Pillar 1 does not — concentration, interest-rate risk in the banking book, pension, strategic and reputational risk — and the interactions between them.
What should risk leaders know about governance around ICAAP?
The board owns the ICAAP. It approves the methodology, the scenarios, the risk appetite embedded in it, and the resulting capital plan. It does not draft it, but its ownership is meaningful only if it can challenge the assumptions. ICAAP governance therefore includes an executive review layer (typically the executive risk committee and ALCO), a second-line challenge layer coordinated by the CRO office, and periodic independent validation of the material components — most notably the models, s...
What should risk leaders know about scenario design?
Scenarios are where ICAAP quality is most often lost. Scenarios that are too mild produce comfortable numbers and offer no decision-useful information; scenarios that are unmoored from the bank's risk profile produce numbers the business cannot act on. Effective ICAAP scenarios are anchored in the bank's material vulnerabilities, use consistent macro paths across risk types, and translate into P&L, capital and liquidity outcomes that the business recognises.
What should risk leaders know about connecting to decisions?
The ICAAP output should be visible in real decisions: capital planning, dividend and buy-back proposals, business-line strategic reviews, pricing calibration, and appetite recalibration. A bank whose capital decisions cannot be traced back to the ICAAP is running two capital narratives — the regulatory one and the actual one — and the actual one is undocumented.
What should risk leaders know about use test in practice?
Supervisors increasingly assess the "use" of ICAAP, not just its content. Evidence of use includes committee minutes referencing ICAAP outcomes, capital allocations that reflect stress outcomes, and remediation actions triggered by ICAAP findings. Absence of such evidence is a supervisory finding regardless of the document's quality.