ICAAP practitioner’s guide
How to write an ICAAP the PRA takes seriously: structure, stress testing, capital planning and board challenge, from people who write them.
By Mark Dougherty, CPA (CAN)01 · Risk Advisory · Advice and consulting
Prudential risk advisory and consulting
Risk Advisory is RiskTAE’s advisory and consulting practice for prudential risk, capital and liquidity in regulated financial firms: the ICAAP and ILAAP for banks, the ICARA for investment firms, the ORSA for insurers, and the recovery, resolution and wind-down plans that sit behind them.
As advisers, senior practitioners give CROs, CFOs and boards independent challenge and a second opinion. As consultants, the same people write ICAAPs and ILAAPs, build risk frameworks and move capital calculations onto the PRA’s Basel 3.1 rules.
You get work that holds up to board challenge and supervisory review, and a team of your own that can run it next year.
Two offers
What is the difference between risk advisory and risk consulting?
Advice
Advice is judgement. You keep the pen, and we give you an independent, senior view: a second opinion on the ICAAP before the board signs it, challenge on your risk appetite, preparation before a meeting with the PRA, or a steady hand through a skilled person review.
Consulting
Consulting is delivery. We hold the pen: we write the ICAAP and ILAAP, build the framework, run the Basel 3.1 recalculation and the stress tests, then hand everything over with documented assumptions so your team can run it next year.
Many clients use both, often in sequence: advice to scope the problem, consulting to fix it, then advice again as an independent check before submission.
Which assessment
Which assessment does your firm need?
It depends on who regulates you and what you do. Banks and building societies run an ICAAP and an ILAAP for the PRA, MIFIDPRU investment firms run an ICARA for the FCA, and insurers run an ORSA, with recovery, solvent exit and wind-down plans beside them.
| Assessment | Who needs it | Rules | How often | Our page |
|---|---|---|---|---|
| ICAAP | Banks, building societies and PRA-designated investment firms | PRA ICAA Part; SS31/15, or SS4/25 for SDDTs (frequency expectations since 20 January 2026, in full from 1 January 2027) | Annually; every two years for SDDTs other than new and growing banks | ICAAP |
| ILAAP | Banks and building societies | PRA ILAA Part; SS24/15 | Annually for most firms; at least every two years for SDDTs other than new and growing banks | ILAAP |
| ICARA | MIFIDPRU investment firms | FCA MIFIDPRU 7 | At least every 12 months and after a material change (MIFIDPRU 7.8.2R) | ICARA |
| ORSA | PRA-regulated insurers and reinsurers | PRA Conditions Governing Business Part, chapter 3 | Regularly, and without delay after a significant change (rule 3.10) | ORSA |
| Recovery plan | Banks and building societies | PRA Recovery Plans Part; SS9/17 | At least annually; every two years for SDDTs | Recovery planning |
| Solvent exit analysis | Non-systemic banks and building societies since 1 October 2025; most PRA-regulated insurers since 30 June 2026 | Recovery Plans Part, chapter 7, and SS2/24; PS20/24 and SS11/24 | After a material change and at least every three years | Wind-down and solvent exit |
| Wind-down plan | FCA solo-regulated firms, including investment, payment and e-money firms | FCA Wind-down Planning Guide; MIFIDPRU 7.5.7R for investment firms | Kept under review by a named person; within the ICARA cycle for investment firms | Wind-down and solvent exit |
The full comparison, with the rule source, how often each is refreshed and who approves it, is in which prudential assessment does your firm need?
Sources: PRA Rulebook, ICAA, ILAA, Recovery Plans and Conditions Governing Business Parts; PRA SS31/15, SS24/15, SS9/17, SS2/24 and SS11/24; FCA Handbook, MIFIDPRU 7 and WDPG. Each is cited in full on the linked page.
Services
What do you deliver?
We write, review and rebuild capital and liquidity assessments, recovery and wind-down plans and the frameworks behind them, for banks and building societies, investment firms and insurers.
For banks and building societies
01
ICAAP
A first ICAAP, an annual refresh or an independent review before the board signs, with the capital model handed to your team.
02
ILAAP
Liquidity risk appetite, the LCR and NSFR, liquidity stress testing and the contingency funding plan, written so the board can see how each number was reached.
03
Basel 3.1
Risk-weighted assets recalculated on the PRA’s final rules, run beside today’s, and carried through to the capital plan and the ICAAP.
04
SDDT regime
Whether to opt in to the strong and simple regime, tested against the nine criteria and a capital comparison with Basel 3.1.
05
Operational risk capital
The move to the Basel 3.1 standardised approach: the Business Indicator on your own figures, the scenarios and the Pillar 2A assessment.
06
Step-in risk
The policy, the register of in-scope entities and the SI returns that go to the PRA with the ICAAP.
07
Recovery planning
Recovery plans with credible indicators and options, resolution packs, and a fire drill the board has rehearsed.
08
Risk appetite frameworks
Risk appetite statements, taxonomies and limits the board can use, with every calibration documented.
09
Skilled person reviews
A senior practitioner on your side before, during and after a section 166 review, and a remediation plan the regulator can close.
For investment firms
10
ICARA
The harms assessment, the stress tests, the wind-down plan and the own funds and liquid assets thresholds for MIFIDPRU investment firms.
11
Wind-down and solvent exit
Wind-down plans for investment, payment and e-money firms, and the solvent exit analysis the PRA requires of non-systemic banks, building societies and insurers.
For insurers
12
ORSA
The Own Risk and Solvency Assessment: the forward-looking solvency projection, the stress and scenario tests and the board’s challenge.
Engagements
How does an engagement run?
Every engagement starts with a 30-minute scoping call and a written proposal that sets out the scope, the timetable and the fee. Where one of our RisKIT models fits, we start from it rather than a blank spreadsheet, which puts a first set of numbers in front of management sooner.
We work inside your team rather than beside it, and we finish with a handover of the models and their documented assumptions to the people who will run them next year. Training for the board or the team can be added from Risk Education, and if the work shows a gap in the team, Risk Talent can fill it.
Experience
Where have our people done this work?
Across banking and financial services: retail and investment banking, capital markets, asset management, fintech, and general and life insurance, in the UK and in other financial centres.
The work covers the prudential and risk agenda end to end: capital and liquidity assessments, Basel 3.1 and the capital calculations behind it, credit, market and operational risk, non-financial risk, risk appetite and frameworks, recovery and wind-down planning, and independent reviews before a board signs or after a regulator asks.
The practice is led by Mark Dougherty, CPA (CAN), a Canadian Chartered Professional Accountant with more than 20 years in risk management who has served as an interim chief risk officer.
Regulatory deadline
What changes on 1 January 2027?
Basel 3.1 and the SDDT regime
Two sets of PRA rules take effect that day. Basel 3.1, published on 20 January 2026 in policy statement PS1/26, applies to PRA-authorised banks, building societies and PRA-designated investment firms, with the internal model approach for market risk following on 1 January 2028. The simplified capital regime for small domestic deposit takers, published the same day in PS4/26, applies to the firms that qualify and opt in.
A firm’s first ICAAP under the new rules needs recalculated risk-weighted assets well before the board is asked to approve it. If yours has not started, the scoping call is the place to begin.
Sources: Bank of England, PS1/26 Implementation of Basel 3.1: final rules, 20 January 2026; PRA PS4/26 The Strong and Simple Framework, 20 January 2026.
FAQ
Questions about Risk Advisory
Do you offer advice and consulting, or one of them?
Both. Some clients want an independent, senior view and keep the work in-house; others want us to do the work. The same senior people do both, and many engagements move from one to the other.
What is an ICAAP?
An ICAAP, or Internal Capital Adequacy Assessment Process, is a firm’s own assessment of the capital it needs for the risks it runs, now and under stress. The PRA reviews it as part of its supervisory review and uses it when setting the firm’s Pillar 2 capital requirements.
What is an ILAAP?
An ILAAP, or Internal Liquidity Adequacy Assessment Process, is the liquidity equivalent: the firm’s own assessment of the liquidity and funding it needs in normal conditions and under stress. The PRA uses it in its review of the firm’s liquidity position.
Can you review an ICAAP we have already written?
Yes. We review drafts against the PRA’s expectations and give the board a written view of the gaps before it approves the document.
Do you work outside the UK?
Yes. Alongside the PRA’s rules we work with the EU’s Capital Requirements Regulation, EU CRR III, and with national Basel implementations elsewhere, and our RisKIT models cover UK, EU, US and global Basel frameworks.
Insights
Further reading
Basel 3.1 readiness guide
A practitioner's guide to Basel 3.1 in the UK: what applies on 1 January 2027, what to have ready and what the PRA will look for. Free to read.
By Mark Dougherty, CPA (CAN)
ICAAP, ILAAP, ICARA, ORSA, recovery plan or wind-down plan: which does your firm need?
Which prudential assessment a firm needs depends on its regulator and its business. UK banks and building societies write an ICAAP, an ILAAP and a recovery plan, plus a solvent exit analysis if non-systemic; FCA investment firms run an ICARA; Solvency UK insurers write an ORSA; and the FCA expects payment and e-money firms to keep a wind-down plan.
By Mark Dougherty, CPA (CAN) · 7 min readNext step
Scope it in 30 minutes
Tell us the deadline and where the work is stuck. We will tell you what it would take to finish it, and whether you need advice, consulting or both.
Scope an advisory need
Tell us what needs doing and by when. A partner will come back to you. Treated in confidence.
Prefer email? advisory@risktae.com or +44 20 3996 9599. We use these details only to reply to you: privacy notice.