Maintaining the minimum regulatory capital ratio does not automatically prove that a bank has enough capital.

Minimum capital requirements are based on standardised regulatory methodologies. They cannot fully capture every institution-specific exposure, concentration, business-model vulnerability, control weakness or emerging risk.

A bank may satisfy its Pillar 1 capital ratios and still face material risks arising from:

• Sector concentration
• Geographic concentration
• Interest-rate movements
• Credit migration
• Funding pressure
• Operational failures
• Cyber incidents
• Model limitations
• Strategic decisions
• Rapid balance-sheet growth
• Declining profitability
• Climate-related exposures
• Weak internal controls

The Internal Capital Adequacy Assessment Process, or ICAAP, is designed to address this wider question:

Does the institution have enough capital, risk-management capability and capital-planning strength to remain viable under both expected and adverse conditions?

Basel’s Pillar 2 framework places responsibility on bank management to assess capital needs relative to the institution’s complete risk profile. Supervisors then review that assessment and may require corrective actions where capital, risk management or controls are inadequate.

Effective ICAAP training must therefore go beyond definitions.

It should help participants identify material risks, quantify capital needs, construct forward-looking capital plans, design stress scenarios, evaluate management actions, challenge assumptions and connect ICAAP outcomes with real business decisions.

What Is ICAAP?

ICAAP stands for Internal Capital Adequacy Assessment Process.

It is an institution’s internal process for assessing whether its capital is adequate relative to:

• Its current risk profile
• Its expected future risk profile
• Its business strategy
• Its operating environment
• Its risk appetite
• Its stress vulnerabilities
• Its capital-management objectives

ICAAP is part of the Basel Pillar 2 supervisory framework.

Pillar 1 establishes minimum regulatory capital requirements. Pillar 2 requires a broader assessment of institution-specific risks and capital adequacy. Pillar 3 promotes market discipline through disclosure.

The Basel Committee describes Pillar 2 as a process intended both to ensure adequate capital for the risks in a bank’s business and to encourage stronger risk-management techniques.

ICAAP should not be treated as a document prepared once a year solely for the regulator.

It should be an ongoing management process that influences:

• Strategic planning
• Budgeting
• Capital allocation
• Risk appetite
• Portfolio limits
• Product decisions
• Dividend planning
• Capital raising
• Stress testing
• Recovery planning
• Management reporting

The ECB’s ICAAP guidance similarly emphasises that ICAAP is fundamentally an internal responsibility and should be proportionate to the nature, scale and complexity of the institution.

What Is ICAAP Training?

ICAAP training is specialised banking-risk education covering the design, implementation, governance and review of the Internal Capital Adequacy Assessment Process.

A practical ICAAP training course may cover:

• Basel Pillar 2 principles
• ICAAP governance
• Material-risk identification
• Risk taxonomy
• Risk appetite
• Internal capital
• Economic capital
• Regulatory capital
• Capital planning
• Credit-risk capital
• Market-risk capital
• Operational-risk capital
• Concentration risk
• IRRBB
• Business and strategic risk
• Stress testing
• Reverse stress testing
• Scenario analysis
• Risk aggregation
• Diversification
• Management actions
• Capital buffers
• ICAAP documentation
• Independent validation
• Internal audit
• SREP preparation

The syllabus should be customised according to the institution’s jurisdiction, size, portfolio, complexity and regulatory perimeter.

A generic workshop cannot address every organisation adequately.

Why ICAAP Training Is Important

ICAAP sits at the intersection of risk, finance, strategy and governance.

When these functions work independently, the institution can produce a capital plan that appears mathematically complete but does not reflect its actual vulnerabilities.

Common failures include:

• Risk and finance using different balance-sheet forecasts
• Stress scenarios that do not reflect the institution’s business model
• Material risks being identified but not quantified or mitigated
• Capital forecasts ignoring business growth
• Management actions being assumed without testing feasibility
• Risk appetite limits not linked to capital capacity
• Internal capital being defined inconsistently
• Diversification benefits being overstated
• Stress losses being double counted
• ICAAP results not influencing business decisions
• Board approval becoming a procedural formality

ICAAP training helps relevant teams develop a shared methodology and vocabulary.

It also helps employees understand that capital is not the only response to risk. Some risks may be better addressed through:

• Exposure reduction
• Improved controls
• Hedging
• Insurance
• Pricing changes
• Portfolio limits
• Product restrictions
• Funding changes
• System improvements
• Governance action

Pillar 2 is not a mechanism for attaching capital mechanically to every possible risk.

It requires institutions to understand the risk and determine an appropriate combination of capital and non-capital mitigation.

The Four Pillar 2 Principles

The Basel Pillar 2 framework is commonly explained through four principles.

Principle 1: Banks Must Assess Their Capital Adequacy

Banks should maintain a process for assessing their overall capital adequacy relative to their risk profile and a strategy for maintaining capital levels.

This principle forms the foundation of ICAAP.

Principle 2: Supervisors Must Review the Assessment

Supervisors should review and evaluate the bank’s internal capital assessment, capital strategy, monitoring capability and compliance with regulatory ratios.

Principle 3: Banks Should Operate Above Regulatory Minimums

Supervisors generally expect banks to maintain capital above minimum regulatory requirements and may require additional capital based on the bank’s risk profile.

Principle 4: Supervisors Should Intervene Early

Supervisors should act before capital falls below the level required to support the bank’s risks and may require rapid corrective measures.

These principles are reflected in RBI’s published Basel III ICAAP guidance for Indian banks. That guidance describes ICAAP as the process through which banks assess capital adequacy relative to their risk profile and maintain a capital strategy.

ICAAP and SREP: What Is the Difference?

ICAAP and SREP are connected but different.

ICAAP

ICAAP is owned by the institution.

It represents management’s assessment of:

• Material risks
• Internal capital needs
• Capital resources
• Future capital position
• Stress resilience
• Management responses

SREP

SREP stands for Supervisory Review and Evaluation Process.

It is conducted by the supervisory authority.

The supervisor evaluates:

• The institution’s ICAAP
• Risk profile
• Governance
• Control environment
• Capital adequacy
• Liquidity adequacy
• Business-model sustainability
• Corrective actions

The bank should not design its ICAAP solely to predict the supervisor’s conclusion.

ICAAP must represent the institution’s own credible assessment.

A weak ICAAP attempts to defend the current capital position.

A strong ICAAP actively identifies where that position may become inadequate.

ICAAP Is More Than Pillar 1 Plus Extra Capital

A common mistake is to begin with Pillar 1 risk-weighted assets and add arbitrary percentages for several additional risks.

That approach may be simple, but it is often intellectually weak.

ICAAP should examine:

• Which risks are material
• Whether Pillar 1 captures them adequately
• Whether the risk can be quantified
• Whether the methodology is reliable
• Whether capital is the correct mitigant
• Whether risk interactions are relevant
• Whether the result remains adequate under stress
• Whether the institution can execute its business plan

The RBI’s published ICAAP guidance describes the process as covering appropriate risk identification and measurement, adequate internal capital relative to the risk profile and continued development of suitable risk-management systems.

Core Modules in an ICAAP Training Programme

1. ICAAP Governance

Governance determines whether ICAAP is a genuine management process or a regulatory-reporting exercise.

Training should cover:

• Board responsibility
• Senior-management responsibility
• ICAAP ownership
• Committee structure
• First, second and third lines of defence
• Approval authority
• Challenge and escalation
• Methodology governance
• Model governance
• Capital adequacy statements
• Documentation standards
• Annual review
• Trigger-based review

The management body should understand and challenge ICAAP assumptions rather than merely approve the final document.

ECB guidance places overall ICAAP responsibility on the management body and expects key elements such as governance, risk inventory and quantification methodologies to receive appropriate approval and challenge.

A corporate workshop should therefore include separate modules for:

• Technical teams
• Senior management
• Board or board-level committees

The board does not need to reproduce every model calculation. It does need to understand the principal assumptions, limitations, vulnerabilities and management implications.

2. Risk Inventory and Risk Taxonomy

ICAAP begins with a complete inventory of risks.

Possible categories include:

• Credit risk
• Counterparty credit risk
• Market risk
• Operational risk
• Concentration risk
• IRRBB
• Liquidity-related capital risk
• Business risk
• Strategic risk
• Reputational risk
• Model risk
• Cyber risk
• Legal risk
• Compliance risk
• Pension risk
• Residual risk
• Securitisation risk
• Climate-related financial risk

The risk taxonomy should reflect the institution’s business model.

A retail lender, investment bank, cooperative bank and specialised mortgage lender should not use identical risk inventories without adjustment.

Training should explain how to identify risks through:

• Product analysis
• Process analysis
• Balance-sheet analysis
• Risk registers
• Incident data
• Audit findings
• Regulatory findings
• Stress-testing results
• Strategic plans
• Expert workshops
• Emerging-risk monitoring

ECB’s February 2025 clarification reiterates the importance of a complete risk inventory linked to the institution’s underlying risk-profile assessment.

3. Materiality Assessment

Not every identified risk requires a complex capital model.

The organisation must determine which risks are material.

Materiality may be assessed through:

• Current exposure
• Potential loss
• Earnings volatility
• Capital impact
• Strategic significance
• Control weakness
• Stress vulnerability
• Regulatory concern
• Reputation impact
• Future business growth

A risk may be material even when historical losses are low.

For example, cyber risk may have limited historical internal-loss data but still create severe potential financial and operational consequences.

Training should distinguish between:

• Risk identification
• Materiality assessment
• Risk quantification
• Capital allocation
• Risk mitigation

These are related steps, but they are not interchangeable.

4. Risk Appetite and Capital Adequacy

ICAAP should be connected to the institution’s risk-appetite framework.

Training may cover:

• Capital targets
• Capital limits
• Early-warning thresholds
• Risk capacity
• Risk appetite
• Risk tolerance
• Management buffers
• Recovery triggers
• Regulatory minimums

These levels should form a coherent hierarchy.

For example:

1. Operating target
2. Management buffer
3. Risk-appetite threshold
4. Early-warning level
5. Recovery trigger
6. Regulatory minimum

The exact structure depends on the institution.

The key requirement is consistency.

A capital target cannot be credible when it conflicts with the risk-appetite framework, recovery plan or strategic forecast.

ECB supervisory clarification stresses the interconnection between ICAAP, risk appetite and recovery planning, including consistency between thresholds, governance and management actions.

5. Regulatory Capital and Internal Capital

ICAAP training should clearly distinguish regulatory capital from internal capital.

Regulatory Capital

Regulatory capital is defined under applicable prudential regulations and may include:

• Common Equity Tier 1
• Additional Tier 1
• Tier 2
• Regulatory adjustments
• Deductions
• Capital buffers

Internal Capital

Internal capital represents the capital resources the institution considers available to absorb losses from its own economic perspective.

The institution must define:

• Eligible internal-capital components
• Loss-absorption capability
• Permanence
• Availability
• Valuation
• Transferability
• Double counting
• Group restrictions

Internal capital should not be defined opportunistically merely to make the ICAAP ratio look stronger.

Training should require participants to reconcile:

• Accounting equity
• Regulatory own funds
• Available financial resources
• Internal capital

6. Normative and Economic Perspectives

Many advanced ICAAP frameworks distinguish between normative and economic perspectives.

Normative Perspective

The normative perspective examines whether the institution can comply with regulatory and supervisory capital requirements over the planning horizon.

It may project:

• CET1 ratio
• Tier 1 ratio
• Total capital ratio
• Leverage ratio
• Risk-weighted assets
• Capital buffers
• Regulatory deductions
• Profit and losses
• Provisions
• Distributions

Economic Perspective

The economic perspective assesses risks and capital adequacy based on the institution’s internal economic view.

It may consider:

• Economic value changes
• Unexpected losses
• Internal risk measures
• Economic capital
• Hidden losses
• Concentration effects
• Risk interactions
• Internal capital resources

The two perspectives should inform each other.

For example, an economic-value loss that does not immediately affect regulatory capital may eventually affect accounting profit, capital resources or business sustainability.

For ECB-supervised institutions, current supervisory clarification expects forward-looking assessments under both normative and economic perspectives, including baseline and adverse scenarios.

That specific terminology and horizon should not be copied mechanically into every jurisdiction. Local regulatory requirements must be checked.

7. Capital Planning

Capital planning is central to ICAAP.

A credible capital plan should incorporate:

• Opening capital position
• Profit projections
• Dividend policy
• Balance-sheet growth
• Risk-weighted assets
• Credit migration
• New products
• Acquisitions
• Capital issuance
• Maturities
• Regulatory changes
• Accounting changes
• Stress losses
• Management actions

Capital planning should answer:

• How much capital will the institution need?
• What will drive that requirement?
• How much capital will be available?
• What happens if earnings are lower?
• What happens if RWAs increase?
• What happens if capital issuance fails?
• What happens if the business grows faster?
• What happens under stress?

RBI’s published ICAAP guidance calls for an explicit board-approved capital plan setting out capital objectives, planning horizons and responsibilities.

8. Business Planning and ICAAP Integration

The ICAAP forecast must be connected to the approved business plan.

Relevant drivers may include:

• Loan growth
• Deposit growth
• Product mix
• Geographic expansion
• Pricing
• Net interest margin
• Fee income
• Operating expenses
• Credit costs
• Risk-weight density
• Securitisation
• Asset sales
• Digital investment

The risk function should challenge whether the business plan is internally consistent.

For example:

• Can aggressive loan growth be achieved without weakening underwriting?
• Will deposit growth support asset growth?
• Does the capital plan include higher operational-risk exposure?
• Are credit losses consistent with the risk profile?
• Are stressed margins realistic?
• Can planned capital actually be raised?

ICAAP is weak when finance supplies the forecast and risk simply applies stress percentages afterward.

9. Stress Testing

Stress testing is one of the most important ICAAP components.

The Basel Committee treats stress testing as a critical element of risk management and a core supervisory tool. Its principles cover governance, objectives, methodology, resources, implementation and documentation.

ICAAP training should cover:

• Sensitivity testing
• Scenario testing
• Historical scenarios
• Hypothetical scenarios
• Institution-specific scenarios
• System-wide scenarios
• Reverse stress testing
• Multi-year projections
• Risk interactions
• Second-round effects

Possible stress variables include:

• GDP contraction
• Unemployment
• Interest-rate shocks
• Property-price decline
• Exchange-rate movement
• Credit spread widening
• Default-rate increases
• Rating migration
• Deposit outflow
• Margin compression
• Operational losses
• Cyber incidents

A scenario should be:

• Severe
• Plausible
• Relevant
• Internally consistent
• Quantifiable
• Linked to vulnerabilities

A scenario is not meaningful merely because its macroeconomic assumptions look severe.

It must transmit through the institution’s actual exposures.

10. Scenario Translation

The institution must translate a scenario into financial and risk outcomes.

This may involve:

• Macroeconomic models
• Credit-risk satellite models
• PD stress
• LGD stress
• EAD stress
• Stage migration
• IFRS 9 provisions
• Market revaluation
• Net interest income
• Fee-income changes
• Operating-cost changes
• Risk-weighted assets
• Operational losses
• Tax effects
• Capital ratios

Training should trace the complete chain:

Macroeconomic shock → risk-driver change → financial impact → capital impact → management response

A vague scenario narrative without a defensible transmission mechanism does not produce a strong ICAAP.

ECB guidance expects institutions to explain how macroeconomic scenarios translate into financial and risk metrics, including income, provisions, risk weights and risk materialisation.

11. Reverse Stress Testing

Normal stress testing asks:

What happens if a particular scenario occurs?

Reverse stress testing asks:

What scenario would make the institution’s business model or capital position unviable?

Possible failure points include:

• Breach of capital requirements
• Breach of risk appetite
• Loss of market confidence
• Inability to raise funding
• Recovery-plan activation
• Unsustainable business model

Reverse stress testing helps identify hidden vulnerabilities and combinations of risks that may not appear in ordinary scenarios.

It should not be designed to produce an impossibly remote scenario.

The objective is to identify severe but relevant circumstances that could threaten viability.

12. Credit-Risk Capital Assessment

Credit risk is often the largest risk for a lending institution.

An ICAAP credit-risk module may include:

• Default risk
• Migration risk
• Concentration risk
• Counterparty risk
• Residual risk
• Collateral risk
• Country risk
• Securitisation risk
• Off-balance-sheet exposure
• IFRS 9 interaction
• Stress losses
• RWA inflation

Institutions should assess whether Pillar 1 capital adequately captures their credit-risk profile.

Potential limitations may arise from:

• High sector concentration
• Large single-name exposure
• Weak collateral
• Rapid portfolio growth
• Thin default data
• Risk-weight floors
• Unrated borrowers
• Vulnerable geographies
• Correlated exposures

13. Concentration Risk

Concentration risk is a common Pillar 2 risk.

Possible forms include:

• Single-name concentration
• Group concentration
• Sector concentration
• Geographic concentration
• Product concentration
• Collateral concentration
• Funding concentration
• Counterparty concentration

Training may cover measures such as:

• Herfindahl–Hirschman Index
• Top-exposure ratios
• Granularity adjustments
• Scenario analysis
• Name-level stress testing
• Sector stress testing
• Correlation analysis

A concentration model should not be treated as a black box.

Participants must understand what the measure captures, which assumptions drive the result and whether capital or exposure reduction is the correct response.

14. Market-Risk Capital Assessment

Market-risk ICAAP analysis may include:

• Interest-rate risk
• Equity risk
• Foreign-exchange risk
• Commodity risk
• Credit spread risk
• Basis risk
• Volatility risk
• Concentration
• Illiquidity
• Valuation uncertainty

Possible methodologies include:

• Value at Risk
• Expected Shortfall
• Stress loss
• Sensitivity analysis
• Scenario analysis
• Add-on methods

The institution should examine risks that are not fully captured by regulatory calculations, including valuation and concentration weaknesses.

15. Interest-Rate Risk in the Banking Book

IRRBB is a major Pillar 2 risk.

Training may include:

• Repricing risk
• Yield-curve risk
• Basis risk
• Option risk
• Net Interest Income
• Economic Value of Equity
• Non-maturity deposits
• Loan prepayments
• Deposit betas
• Behavioural maturity
• Stress scenarios

IRRBB should be linked to:

• ALM
• Pricing
• Hedging
• Deposit strategy
• Balance-sheet planning
• Capital adequacy

Peaks2Tails’ existing banking-risk material connects ICAAP with IRRBB, liquidity, stress testing, balance-sheet structure, Excel and Python modelling.

16. Operational-Risk Capital Assessment

Operational risk may arise from:

• Process failure
• Human error
• Fraud
• Technology failure
• Cyber incidents
• Legal events
• Third-party failure
• Business disruption
• Model implementation errors

ICAAP operational-risk assessment may use:

• Historical loss data
• Scenarios
• Risk and control self-assessments
• Key risk indicators
• Audit findings
• External-loss data
• Expert judgement

Low historical loss does not prove low risk.

The absence of past cyber losses, for example, does not demonstrate that a severe future incident is immaterial.

17. Business and Strategic Risk

Business risk can arise from:

• Declining margins
• Competitive pressure
• Customer loss
• Technology disruption
• Cost inflation
• Failed expansion
• Product obsolescence
• Regulatory change
• Revenue concentration

Strategic-risk assessment may include:

• Business-plan stress
• Break-even analysis
• Earnings-at-risk
• Cost-income stress
• Scenario analysis
• Capital impact

Capital cannot repair a fundamentally unsustainable strategy indefinitely.

ICAAP should therefore consider business-model viability, not only short-term loss absorption.

18. Model Risk

Model risk arises when decisions rely on incorrect, unstable or misused models.

ICAAP training may examine:

• Model inventory
• Materiality
• Validation findings
• Data limitations
• Implementation errors
• Parameter uncertainty
• Model overlays
• Machine-learning governance
• Model concentration
• Unvalidated models

Model risk may be addressed through:

• Additional controls
• Model redevelopment
• Conservative adjustments
• Usage restrictions
• Limits
• Capital add-ons

The correct response depends on the nature and severity of the weakness.

19. Risk Quantification

Risk quantification methodologies may include:

• Regulatory capital add-ons
• Economic-capital models
• Stress-loss approaches
• Scenario-based assessment
• Scorecards
• Expert judgement
• Proxy methodologies
• Benchmarking
• Qualitative assessments

Not every material risk can be quantified precisely.

False precision is not a sign of sophistication.

Where quantitative evidence is weak, the institution should disclose:

• Data limitations
• Assumptions
• Uncertainty
• Conservative adjustments
• Validation findings
• Alternative mitigants

20. Economic Capital

Economic capital estimates the capital required to absorb unexpected losses at a selected confidence level and time horizon.

Training may cover:

• Loss distributions
• Expected loss
• Unexpected loss
• Confidence level
• Holding period
• Tail risk
• Correlation
• Diversification
• Capital allocation
• Return on risk-adjusted capital

A basic economic-capital framework may estimate capital separately for:

• Credit risk
• Market risk
• Operational risk
• IRRBB
• Business risk

It may then aggregate results using assumptions regarding dependency.

Economic capital is useful only when its assumptions are understood and its output influences decisions.

21. Risk Aggregation and Diversification

Adding standalone risk capital produces a conservative total but may ignore diversification.

Applying diversification without strong evidence may understate capital needs.

Training should examine:

• Simple summation
• Correlation matrices
• Variance-covariance aggregation
• Copulas
• Scenario aggregation
• Dependency under stress
• Concentration
• Tail dependence

Correlations often increase during periods of stress.

A diversification benefit calibrated during stable conditions may disappear when it is most needed.

Any benefit should therefore be:

• Evidence based
• Conservative
• Transparent
• Validated
• Stress tested

22. Capital Buffers

Internal capital buffers may protect against:

• Forecast uncertainty
• Model risk
• Stress losses
• Strategic growth
• Distribution plans
• Regulatory changes
• Rating objectives
• Market expectations
• Capital-raising delays

A buffer should not be an unexplained percentage added at the end of the calculation.

Its rationale should be linked to identifiable uncertainty or strategic objectives.

23. Management Actions

Stress-testing results often assume management actions.

Possible actions include:

• Reducing dividends
• Raising capital
• Reducing lending
• Selling assets
• Hedging exposures
• Repricing products
• Cutting costs
• Reducing risk-weighted assets
• Changing funding strategy
• Restricting new business

Every assumed action should be tested for:

• Feasibility
• Timing
• Governance
• Market capacity
• Legal restrictions
• Operational readiness
• Customer impact
• Reputational impact
• Interaction with other actions

Assuming that the institution can raise capital instantly during a systemic crisis is not credible.

Gross stressed results should normally be visible before management actions are applied.

24. Link Between ICAAP and Recovery Planning

ICAAP and recovery planning serve different purposes but should be connected.

ICAAP focuses on maintaining adequate capital under normal and stressed conditions.

Recovery planning addresses actions available when the institution experiences severe financial deterioration.

The frameworks should align on:

• Capital indicators
• Early-warning thresholds
• Recovery triggers
• Stress scenarios
• Management actions
• Governance
• Escalation
• Communication

ECB’s 2025 clarification describes ICAAP, risk appetite and recovery planning as parts of a connected capital-management continuum.

25. Data, Technology and Management Information

ICAAP depends on reliable data from multiple systems.

Relevant data may include:

• Capital instruments
• Accounting balances
• Risk-weighted assets
• Credit exposures
• Ratings
• Defaults
• Collateral
• Market positions
• Operational losses
• Interest-rate gaps
• Business forecasts
• Macroeconomic variables

Training for data and technology teams should cover:

• Data lineage
• Source-system mapping
• Reconciliation
• Data ownership
• Transformation logic
• Version control
• Manual adjustments
• Access controls
• Audit trails
• Reporting frequency

A sophisticated model built on unreconciled data produces unreliable capital estimates.

26. Independent Review and Validation

ICAAP should be subject to independent challenge.

Review may cover:

• Scope
• Risk inventory
• Materiality
• Data
• Methodology
• Assumptions
• Stress scenarios
• Capital resources
• Aggregation
• Diversification
• Management actions
• Governance
• Documentation
• Use test

RBI’s published guidance states that ICAAP review should evaluate process integrity, proportionality, concentration-risk identification, data completeness, scenario validity and stress-testing adequacy.

Independent review may be performed by:

• Model-validation teams
• Risk assurance
• Internal audit
• External specialists

The reviewer must be sufficiently independent from the team that designed the process.

27. ICAAP Documentation

ICAAP documentation should be understandable to technical teams, senior management, the board and supervisors.

A typical ICAAP document may contain:

1. Executive summary
2. Governance framework
3. Business model and strategy
4. Risk appetite
5. Risk inventory
6. Materiality assessment
7. Capital resources
8. Risk quantification
9. Stress testing
10. Capital planning
11. Aggregation and diversification
12. Management actions
13. Validation and assurance
14. Key limitations
15. Capital adequacy conclusion

RBI’s illustrative ICAAP outline includes current and projected financial positions, capital adequacy, sensitivities, future scenarios, aggregation, testing and evidence of ICAAP use within the bank.

The document should explain the process honestly.

It should not hide weaknesses behind technical language.

Practical Exercises for ICAAP Training

A high-quality ICAAP workshop should include applied exercises.

Exercise 1: Build a Risk Inventory

Participants analyse a fictional bank and identify:

• Material risks
• Emerging risks
• Pillar 1 coverage
• Pillar 2 gaps
• Risk owners
• Potential mitigants

Exercise 2: Conduct a Materiality Assessment

Participants assess risks based on:

• Exposure
• Potential loss
• Earnings impact
• Capital impact
• Control weakness
• Stress vulnerability

They document why each risk is:

• Material
• Non-material
• Quantified
• Qualitatively managed

Exercise 3: Develop a Capital Plan

Participants forecast:

• Profit
• Dividends
• Regulatory capital
• Risk-weighted assets
• Capital ratios
• Business growth
• Capital issuance

They then test alternative business assumptions.

Exercise 4: Build an Adverse Scenario

Participants define:

• Macroeconomic variables
• Institution-specific shocks
• Transmission mechanisms
• Credit losses
• Market losses
• Income effects
• Operational losses
• RWA impact

Exercise 5: Translate Stress into Capital Ratios

Participants calculate:

• Pre-provision income
• Credit impairment
• Tax effects
• Capital depletion
• RWA inflation
• CET1 ratio
• Total capital ratio
• Management buffer

Exercise 6: Test Management Actions

Participants assess whether proposed actions are:

• Credible
• Timely
• Independent
• Operationally feasible
• Consistent with the scenario

Exercise 7: Quantify Concentration Risk

Participants calculate:

• Top-name concentration
• Sector concentration
• HHI
• Concentration stress loss
• Additional capital requirement

Exercise 8: Assess IRRBB

Participants estimate:

• Repricing gaps
• NII sensitivity
• EVE sensitivity
• Behavioural assumptions
• Capital impact

Exercise 9: Review an ICAAP Submission

Participants identify:

• Missing risks
• Unsupported assumptions
• Double counting
• Weak management actions
• Inconsistent forecasts
• Poor governance
• Documentation gaps

Exercise 10: Prepare a Capital Adequacy Statement

Participants produce a concise management-level conclusion covering:

• Current capital position
• Forecast adequacy
• Stress resilience
• Material risks
• Key assumptions
• Management actions
• Limitations

Excel-Based ICAAP Training

Excel can support:

• Capital-ratio forecasting
• RWA projections
• Stress testing
• Concentration analysis
• NII sensitivity
• EVE analysis
• Scenario comparison
• Capital dashboards
• Management-action testing

Excel is particularly useful for explaining calculation logic transparently.

However, spreadsheets must be controlled through:

• Formula review
• Version control
• Input validation
• Change logs
• Access restrictions
• Reconciliation
• Independent checking

Python-Based ICAAP Training

Python can support:

• Large-scale data preparation
• Automated stress testing
• Scenario simulation
• Portfolio analysis
• Economic-capital models
• Monte Carlo simulation
• Concentration analysis
• Capital forecasting
• Management reporting

Useful libraries may include:

• Pandas
• NumPy
• SciPy
• Statsmodels
• Scikit-learn
• Matplotlib

Python should improve reproducibility and scale. It should not conceal methodology from management or validators.

Who Should Attend ICAAP Training?

ICAAP training may be relevant for:

• Enterprise-risk teams
• Capital-management teams
• Regulatory-risk teams
• Credit-risk professionals
• Market-risk professionals
• Operational-risk teams
• Treasury and ALM teams
• Finance and planning teams
• Stress-testing teams
• Model developers
• Model validators
• Internal auditors
• Compliance officers
• Data and technology teams
• Senior management
• Board and risk-committee members

ICAAP Training for Different Functions

Risk Teams

Focus areas:

• Risk inventory
• Materiality
• Risk quantification
• Stress testing
• Risk aggregation
• Capital assessment

Finance Teams

Focus areas:

• Capital resources
• Profit forecasting
• Balance-sheet planning
• RWA projections
• Dividends
• Capital issuance
• Reconciliation

Treasury and ALM Teams

Focus areas:

• IRRBB
• Funding strategy
• Balance-sheet structure
• Interest-rate scenarios
• Capital and liquidity interaction

Internal Audit

Focus areas:

• Governance
• Process integrity
• Data controls
• Methodology review
• Use test
• Independent assurance

Data and Technology Teams

Focus areas:

• Data lineage
• System architecture
• Scenario engines
• Controls
• Reconciliation
• Audit trails

Senior Management and Board

Focus areas:

• Capital adequacy conclusion
• Risk appetite
• Stress vulnerabilities
• Management actions
• Strategic decisions
• Governance responsibility

ICAAP Training Delivery Formats

Physical Corporate Workshop

Suitable for:

• Cross-functional teams
• Case studies
• Board sessions
• Implementation workshops
• Detailed numerical exercises

Live Virtual ICAAP Training

Suitable for:

• Distributed teams
• Instructor-led calculations
• Interactive discussions
• Excel and Python demonstrations
• Question-and-answer sessions

Self-Paced ICAAP Course

Suitable for:

• Foundation learning
• Employee induction
• Refresher training
• Large participant groups

Self-paced training should include assessments. Watching videos alone does not demonstrate competence.

Hybrid ICAAP Programme

A hybrid programme can combine:

• Recorded foundation modules
• Live workshops
• Assignments
• Case studies
• Assessments
• Mentoring
• Post-training support

How to Choose an ICAAP Training Provider

Organisations should evaluate providers using practical criteria.

Regulatory Understanding

The provider should distinguish among:

• Basel principles
• Local regulations
• Supervisory guidance
• Institution-specific policy
• Industry practice

Capital-Modelling Capability

The programme should include actual calculations rather than only regulatory summaries.

Cross-Functional Coverage

ICAAP connects:

• Risk
• Finance
• Treasury
• Strategy
• Data
• Technology
• Audit
• Governance

The provider should understand these connections.

Practical Exercises

The programme should include:

• Risk inventories
• Capital plans
• Stress scenarios
• Risk quantification
• Management actions
• ICAAP review

Customisation

The syllabus should reflect:

• Business model
• Products
• Jurisdiction
• Risk profile
• Existing ICAAP maturity
• Participant roles
• Supervisory findings

Trainer Experience

The trainer should be able to explain both modelling and management implications.

Post-Training Support

Follow-up assistance may be useful when participants begin applying the framework to internal data, models and reports.

ICAAP Training with Peaks2Tails

Peaks2Tails provides corporate training, mentoring and risk-modelling support across banking risk, credit risk, market risk, treasury risk, Basel, IFRS 9, ICAAP, ILAAP, IRRBB, Excel and Python. Its corporate-training material highlights customisable curricula, practical exercises, assessment and post-training guidance.

A customised ICAAP programme can be designed around:

• Pillar 2 fundamentals
• Risk inventory
• Materiality assessment
• Risk appetite
• Capital planning
• Credit-risk capital
• Market-risk capital
• Operational-risk capital
• Concentration risk
• IRRBB
• Economic capital
• Stress testing
• Reverse stress testing
• Management actions
• ICAAP governance
• Validation
• Documentation
• Excel implementation
• Python implementation

The final structure should be determined through a training-needs assessment rather than a fixed generic syllabus.

Frequently Asked Questions

What is ICAAP training?

ICAAP training teaches financial-institution employees how to identify material risks, assess internal capital needs, develop capital plans, conduct stress tests and govern the Internal Capital Adequacy Assessment Process.

What does ICAAP stand for?

ICAAP stands for Internal Capital Adequacy Assessment Process.

Is ICAAP part of Basel III?

ICAAP forms part of the Basel Pillar 2 supervisory framework. Its origins are associated with Basel II, but it remains an integral component of the consolidated Basel framework.

What is the difference between ICAAP and regulatory capital?

Regulatory capital is calculated under prescribed prudential rules. ICAAP assesses whether the institution has adequate capital for its complete risk profile, strategy and future vulnerabilities.

What is the difference between ICAAP and SREP?

ICAAP is conducted by the institution. SREP is the supervisor’s review and evaluation of the institution’s risks, governance, capital and related processes.

Does ICAAP include stress testing?

Yes. Forward-looking stress testing is a core ICAAP component.

What risks should ICAAP cover?

ICAAP should cover all material risks relevant to the institution, including risks not captured or not fully captured under Pillar 1.

Is ICAAP only for large banks?

The scope and complexity should be proportionate to the institution. Smaller institutions may use simpler methodologies, but simplicity does not remove the need for credible risk assessment.

Can ICAAP be completed using Excel?

Excel can support smaller or less complex calculations, scenario analysis and capital planning. Larger institutions may require controlled databases, dedicated systems and Python or other analytical platforms.

Is economic capital compulsory for ICAAP?

Requirements vary by jurisdiction and institution. Economic capital can be useful, but a complex model is not automatically required or appropriate for every bank.

What is reverse stress testing?

Reverse stress testing identifies scenarios that could cause the institution to breach capital thresholds or become unviable.

Does ICAAP training guarantee regulatory compliance?

No. Training improves employee knowledge and implementation capability. Compliance depends on applicable regulations, systems, data, governance, methodologies, documentation and supervisory assessment.

Conclusion: ICAAP Must Operate as a Capital-Management System, Not an Annual Report

ICAAP fails when it becomes a document-production exercise.

The organisation gathers information from risk, finance and treasury, inserts the numbers into a template, obtains board approval and submits the document.

The process may technically be completed, but the institution has learned little about its actual resilience.

A credible ICAAP starts with a different objective.

It asks whether the bank understands the risks created by its current activities, future strategy and operating environment—and whether it has enough capital and management capacity to survive when those risks materialise.

That question cannot be answered through one capital ratio.

A bank may report a strong CET1 ratio while carrying:

• Severe sector concentration
• Aggressive loan growth
• Weak underwriting
• Large interest-rate exposure
• Unstable earnings
• Dependence on one funding source
• Unresolved operational weaknesses
• Unvalidated models
• Unrealistic business assumptions

ICAAP must bring these vulnerabilities together.

The process should begin with a risk inventory that reflects the institution as it actually operates.

A generic list copied from another bank is useless.

The institution must understand:

• Where it earns money
• Which customers it depends on
• Which products create tail risk
• Which assumptions support profitability
• Which systems and controls are fragile
• Which risks could grow under the business plan
• Which external events could threaten viability

The next challenge is materiality.

Institutions often quantify risks that are easy to model while ignoring risks that are difficult to measure.

This is backwards.

A risk does not become immaterial because historical data are unavailable.

Data limitations should lead to more careful judgement, conservative treatment and stronger controls—not automatic exclusion.

Risk quantification must also remain proportionate.

A smaller institution does not need a complex simulation for every risk. It does need a methodology that is understandable, evidence based and appropriate to its exposures.

A simple stress-loss approach can be stronger than an advanced model that nobody can explain or validate.

At the same time, simplicity must not become an excuse for arbitrary percentages.

Every capital estimate should have a clear basis:

• What risk is being measured?
• Which exposure is included?
• What loss concept is used?
• Which horizon applies?
• Which assumptions drive the result?
• How was the methodology validated?
• How sensitive is the result?

The institution must also distinguish between capital and risk management.

Capital absorbs losses after risk materialises.

It does not prevent the loss.

A bank with excessive concentration should not assume that a capital add-on permanently solves the problem. It may also need portfolio limits, revised underwriting, collateral requirements, pricing changes or exposure reduction.

An institution with weak cyber controls cannot treat additional capital as a substitute for system investment.

An institution with an unsustainable business model cannot solve the problem indefinitely by increasing capital.

ICAAP should force management to consider both capital and non-capital responses.

The forward-looking element is equally important.

Historical capital ratios describe where the bank has been.

ICAAP must assess where it is going.

That requires credible projections of:

• Earnings
• Balance-sheet growth
• Credit losses
• Risk-weighted assets
• Dividends
• Capital issuance
• Regulatory change
• Business expansion
• Strategic investment

The baseline forecast itself must be challenged.

A capital plan based on optimistic growth, stable margins and low credit losses will produce an artificially comfortable conclusion.

Stress testing then tests whether that conclusion survives adverse conditions.

But stress testing is useful only when scenarios are linked to real vulnerabilities.

Applying a standard GDP shock to every portfolio is not enough.

A mortgage-heavy bank should examine property prices, unemployment, prepayment behaviour and interest rates.

A corporate lender should examine sector defaults, rating migration, collateral deterioration and concentration.

A trading institution should examine market liquidity, spread widening, basis risk and counterparty stress.

A digital bank should examine deposit behaviour, cyber disruption, technology failure and confidence effects.

Scenarios must be institution specific.

They must also be internally consistent.

A scenario should not assume severe economic contraction while simultaneously preserving strong loan growth, stable margins, low defaults and immediate capital-market access.

The transmission mechanism must be visible.

Management should be able to trace:

1. The external shock
2. The affected portfolio
3. The change in risk drivers
4. The accounting impact
5. The RWA impact
6. The capital impact
7. The management response
8. The final capital position

Management actions require the same discipline.

Institutions frequently improve stressed capital ratios by assuming asset sales, dividend cancellation, capital issuance or rapid balance-sheet reduction.

Some actions may be credible.

Others may not be executable during the scenario in which they are needed.

The institution must ask:

• Has the action been used before?
• Who can approve it?
• How quickly can it be implemented?
• Will markets be available?
• Will customers or regulators accept it?
• Does it conflict with another action?
• Is the benefit already recognised elsewhere?
• What happens when every bank attempts the same action?

A credible ICAAP should show capital outcomes before and after management actions.

Otherwise, management may not understand the institution’s underlying vulnerability.

Governance is what turns these calculations into an effective process.

The board must not approve ICAAP blindly.

It should challenge:

• Material-risk conclusions
• Capital targets
• Stress severity
• Business assumptions
• Buffer calibration
• Management actions
• Key limitations

Senior management should understand how ICAAP affects strategy.

Risk teams should understand financial projections.

Finance teams should understand risk quantification.

Treasury should understand capital and liquidity interaction.

Technology teams should understand why particular data are required.

Internal audit should assess whether ICAAP is actually used rather than merely documented.

This integration is the real test.

An ICAAP process is credible when it changes decisions.

It may lead the institution to:

• Reduce sector exposure
• Increase a management buffer
• Change dividend plans
• Reprice risk
• Strengthen underwriting
• Raise capital earlier
• Improve hedging
• Slow balance-sheet growth
• Address a model weakness
• Revise its recovery options

When ICAAP never affects a decision, it is probably not functioning as intended.

Independent review is therefore essential.

Reviewers should not restrict themselves to checking whether the required headings appear in the document.

They should test:

• Whether the risk inventory is complete
• Whether data reconcile
• Whether models can be reproduced
• Whether assumptions are reasonable
• Whether diversification is justified
• Whether scenarios are severe enough
• Whether management actions are feasible
• Whether board challenge is evidenced
• Whether ICAAP outcomes are used

Weaknesses should be disclosed honestly.

A credible ICAAP does not pretend that every risk is measured perfectly.

It identifies uncertainty and explains how it is managed.

That is especially important as institutions face emerging risks involving climate change, cyber threats, artificial intelligence, geopolitical instability and rapidly changing interest-rate environments.

Historical data may not provide reliable answers for these risks.

Management judgement will remain necessary.

But judgement must be documented, challenged, approved and reviewed.

This is where effective ICAAP training creates value.

The objective is not to help employees memorise the definition of Pillar 2.

It is to help them understand the complete decision process:

• How risks are identified
• How materiality is determined
• How risks are quantified
• How capital is defined
• How forecasts are constructed
• How scenarios are designed
• How actions are evaluated
• How conclusions are governed
• How the results influence strategy

Participants should leave the programme able to challenge an ICAAP, not merely describe one.

A risk analyst should be able to identify a missing material risk.

A finance professional should be able to connect business forecasts with capital ratios.

A treasury professional should be able to explain how balance-sheet decisions affect capital and interest-rate exposure.

A modeller should be able to explain assumptions and limitations.

A validator should be able to reproduce and challenge calculations.

An internal auditor should be able to assess whether the process is controlled.

A board member should be able to understand whether the institution remains adequately capitalised under credible stress.

That is the difference between regulatory awareness and practical capability.

The ultimate purpose of ICAAP is not to prove that today’s capital is sufficient.

It is to identify the conditions under which tomorrow’s capital may become insufficient—and to ensure that management acts before that happens.

A strong ICAAP therefore protects more than a regulatory ratio.

It supports:

• Better risk decisions
• More credible capital planning
• Earlier management action
• Stronger supervisory dialogue
• More resilient strategy
• Greater institutional stability

For banks and financial institutions, ICAAP training should be treated as a strategic risk-management investment.

The institution’s capital position is too important to be understood by only a small regulatory-reporting team.

It must be understood by everyone whose decisions create, measure, manage or govern risk.