A saying goes like this - ‘Nutrition is not just about eating, it’s about learning to live’. Internal Capital Adequacy & Assessment Process (ICAAP) is a document which helps Bank to assess the capital position (‘Nutrition’) of the Bank vis-a-vis risk on boarded while augmenting business and suggest remedial measures to stay afloat not only in normal course of business but also in testing times.

In the aftermath of global financial Crises 2008, Basel committee on banking Supervision came out with BASEL III guidelines to make the Banking institutions more resilient in times of stress.

BASEL III stands on three pillars:

1. Minimum Capital Requirement
2. Supervisory Review & Evaluation Process (SREP)
3. Market Discipline

ICAAP is an important component of SREP.

ICAAP is a document that gives clarity to the regulator on the amount of Capital held towards various risks Bank is exposed to. It also gives confidence to the Regulator that bank will sustain any unforeseen events.

Before taking a deep dive into ICAAP, we have to understand the concepts of Regulatory Capital & Economic Capital.

Let us understand the process by way of one example.

Every human being needs basic food for the daily activity he is supposed to do. But for doing extra activity, for developing immunity & surviving during pandemic, person needs proteins, vitamins and other nutrition. Therefore, for the overall growth, person requires complete food.

Taking inference from the above example, Regulatory capital is like the basic food Banks need to run the day to day business and absorb losses from banking business so as to protect depositors fund and keep the Bank solvent. It is the bare minimum Capital Banks must keep as per the regulatory prescription. Whereas Economic Capital is like the ‘Complete Food’ for the survival of the Bank. Economic capital not only about regulatory prescribed risk capital, but also capture actual capital required proportionate to the entire gamut of risks as per the Bank’s risk profile. So apart from Credit, Market & Operational Risk, Economical Capital also consider Credit Concentration Risk, Liquidity Risk, Strategic Risk Reputation Risk, Model Risk, etc.

ICAAP of the Bank is an effort to bridge the gap between regulatory and economic capital through a comprehensive assessment of all the material risks perceived by the Bank, and planning the capital as a cushion against all these risks.

The diversified business activities pursued by the Bank are aimed at enhancing risk return profile while extending its reach to wide-spectrum of stakeholders. ICAAP documents do encompass all the group entities spread across jurisdictions.

Guiding Principles of ICCAP: 

Proportionality: Bank’s ICAAP should be commensurate with its size, complexity, & types of Risks on-boarded. RBI proposes three approaches for ICAAP i.e. Simple, Moderately Complex & Complex. Simple approach covers those banks, which are following a very basic risk management practices. Moderately Complex banks having comprehensive risk profile and uses stress testing & scenario analysis to project capital. The Complex Approach is the most sophisticated Approach involving use of Models for Capital planning & Business forecasts, which will be integrated into Bank‘s day-to-day management and operations

Forward Looking: Bank’s ICAAP shall factor not only the existing risks faced but also the potential risks and future business strategies. 

On-going Process & Evolving Nature: Capital adequacy assessment shall be an on-going and dynamic process to identify any incremental risk and proactively implement control measures and/or allocate appropriate capital. Bank shall periodically appraise its top management the efficacy of the current capital position to meet the current and future business requirements.

The process of ICAAP starts with defining the business strategy & fixing business targets. Banks formulates business strategy keeping in mind Vision statement & focus area of the Bank, duly taking into consideration the macroeconomic and banking sector outlook and the Bank’s own perception, available capital, and after due deliberations among concerned business verticals & top management. Then comes the Risk Appetite Statement which defines the Risk boundaries within which the Bank shall operate safely. Bank’s risk appetite statement, is expected to set out both a clear and unambiguous view on the intended actions with regard to its risks in line with its business strategy. In particular, the statement is expected to include motivations for taking on or avoiding certain types of risks.

ICAAP must cover all material risks faced by the Bank beyond Pillar I risks i.e. Credit Risk, Market Risk & Operational Risk, which includes but not limited to Reputation risk, Strategic risk, Group risk, ESG Risk (Environmental Social & Governance), & other Pillar II Risks.

Banks are expected to maintain a robust, up-to-date capital plan that is compatible with its strategies, risk appetite and capital resources. Bank is also expected to take into account the impact of upcoming changes in legal, regulatory, and accounting frameworks and make an informed and reasoned decision on how to address them in the Capital Planning. The capital plan is expected to comprise of baseline and adverse scenarios and to cover a forward-looking horizon of three to five years.

Stress testing alerts bank management to adverse unexpected outcomes related to a variety of risks and provides an indication of how much capital might be needed to absorb losses should large shocks occur. 

The stress tests would reveal undetected areas of potential risk exposure and linkages between different categories of risks. In adverse circumstances, there may be substantial correlation of various risks, especially credit and market risks. Stress testing can range from relatively simple alterations in assumptions about one or more financial, structural or economic variables to the use of highly sophisticated models. The output of such portfolio-wide stress tests should be reviewed by the Board and suitable changes may be made in prudential risk limits for achieving Bank’s strategic objectives. A pictorial representation of entire process of stress testing is given below:

Use of ICAAP in Banks:

ICAAP must be an integral part of the bank’s processes and must be embedded within the organization. Senior management and the Board of Directors must be supportive and fully engaged in the process of preparation & implementation of ICAAP. 

Risk Appetite is the amount of risk that a bank is willing to take in pursuit of strategic objectives. Banks may on-board many risks while pursuing its business strategies. A risk-appetite statement is the formal way of expressing these risks. Developing the risk-appetite statement is a cornerstone of the bank’s approach to risk and business strategy as a whole.

Risk Appetite & Risk Capacity are often used interchangeably. However, Risk capacity acts as an outer boundary within which risk appetite may fluctuate.

Since in context of banking, breach of regulatory minimum may act as an outer boundary, Risk Capacity may be defined as per regulatory specified minimum requirements. 

Risk Appetite is defined as the maximum risk an organization is willing to take to achieve its business objectives.

For layman’s understanding, let’s take one example. On the strength of strong physique, Mr. X can work out for 4 hours in a stretch. However, after three hours, he starts to exhaust. In this example 4 hours is the risk capacity of Mr. X. Workout in a stretch beyond this may be fatal for him. But 3 hours is his risk appetite. He may face minor health issues beyond this point.

Risk appetite may be fixed, taking into account projected business and stress conditions which the Bank may undergo. Certain aspects of risk appetite may not be explicitly quantifiable such as operational risk, conduct risk, reputation risk, information technology related risks etc. The appetite for these may be defined based on parameterization of various qualitative and quantitative indicators.

Linking Risk Appetite to Business Strategy:

While a risk appetite statement defines the aggregate level of risk, management must be able to track levels of exposure against the risk appetite statement and risk tolerances. Linking risk appetite and strategy clarifies the level of risk associated with a strategy.

While defining risk appetite & managing risk taking, banks shall focus on maximizing return and achieving P&L target. This process starts with defining corporate goals. Banks must fix hurdle rate for the return they expect from different verticals in line with corporate goals. Risk appetite shall be fixed taking into considerations risk associated with business while striving for corporate goals and capital available. Then Risk appetite should boil down to risk tolerance limits for the operating units. These limits to be tested periodically against the boundaries as defined by risk appetite.

As per Basel III regulatory requirements, Banks shall maintain sufficient capital above the minimum required level desired by regulator to adequately hedge material risk arising from Credit Risk, Market Risk and Operational Risk under Pillar I. In addition to the three Pillar I risks, Banks shall measure (quantitatively or qualitatively) and monitor its other material risks as part of ICAAP. Because ICAAP is defined under Pillar II of BASEL III guidelines. Hence these risks are called Pillar II Risks.

BASEL framework describes three areas not addressed in the minimum capital calculation that should be specifically considered under the Pillar II:

• Risks that are not fully captured under the Pillar I, such as credit concentration risk.
• Risks that are not considered under the Pillar I, such as liquid risk, interest rate risk in banking book, etc.
• Factors external to the bank, such as economic conditions.

There is no single approach to identify the Pillar II risks. It is varying from Bank to Bank depending upon the risk profile of the Bank, which includes management practices followed, risk mitigations in place, nature of activities undertaken, business strategy & presence in different geographies.

Some of the examples of Pillar II risks include but not limited to:

1. Liquidity Risk
2. Interest Rate Risk in Banking Book
3. Reputational Risk
4. Strategic Risk
5. Cyber Risk
6. Credit Concentration Risk
7. Group Risk
8. Step-in Risk

A robust ICAAP is the foundation of sound risk management programme. 

ICAAP is an opportunity for banks to improve the risk management culture and Practices within the organization. Banks shall not consider ICAAP merely a regulatory compliance, but look through the lenses of larger perspective for all the stakeholders including lenders, shareholders, customers etc, since it ensures that the bank possesses sufficient internal capital for meeting various risks or in other words ensure the solvency and hence continuous survival of the bank. 

(Disclaimer: All the data and images used in the article are sourced from publicly available information on internet)

Swapna Sarit Patra is working as a Senior Manager in Integrated Risk Management Department, Risk Management Wing, Canara Bank. He joined bank as Probationary Officer in 2013 and has experience in both Branch Banking & Risk Management. His Qualification Includes M.Tech (E&TC), B.Tech (E&TC.), JAIIB & CAIIB. He can be reached at swapnasaritpatra@canarabank.com