Risk Advisory · ICAAP
RiskTAE’s ICAAP consultants write the Internal Capital Adequacy Assessment Process for UK banks, building societies and lenders, or review and challenge the firm’s own draft. Practitioners who have run risk and capital functions do the work, and at the end the document and the capital model pass to your team.
Your board approves an ICAAP it can defend in front of the PRA, and your own people can refresh it next year.
By Mark Dougherty, CPA (CAN)Updated
Definition
An ICAAP (Internal Capital Adequacy Assessment Process) is a firm’s own assessment of the amount, type and distribution of capital it needs to cover the risks it faces now and could face over its business plan, including under stress. In the UK the PRA requires one under the Internal Capital Adequacy Assessment Part of its Rulebook and uses it, alongside its own methodologies, to set the firm’s Pillar 2 capital. SS31/15 expects yours to be documented and updated annually, and says that a firm that merely replicates the PRA’s own methodologies is not carrying out its own assessment.
Our guide what is an ICAAP covers the basics, and our white paper How to write an ICAAP: a practitioner’s guide with structure and board checklist goes further into stress testing, capital planning and board challenge.
Sources: PRA SS31/15 The ICAAP and the SREP, paras 2.1 to 2.3, updated 14 July 2026; PRA Rulebook, Internal Capital Adequacy Assessment Part.
How the ICAAP cycle runs
From risk identification to the PRA’s capital requirement
The ICAAP cycle as SS31/15 describes it, with the two-year cycle for most SDDTs.
Sources: PRA SS31/15, updated 14 July 2026, paras 2.1 to 2.3, 3.8, 3.9 and 5.2 to 5.4; PRA Rulebook, Internal Capital Adequacy Assessment Part, rules 13.1 and 15.2; PRA PS4/26, 20 January 2026.
Supervision
The ICAAP is the firm’s input to the Supervisory Review and Evaluation Process (SREP). The PRA uses it to judge whether every material risk has been identified and whether the capital held covers them. SS31/15 splits the question in two: Pillar 2A for risks Pillar 1 does not fully capture, and Pillar 2B for risks over a forward-looking planning horizon. Two numbers come out:
The PRA also judges the people: how involved the management body was, and whether management can discuss and defend all aspects of the ICAAP. It can ask for the design and results of the reverse stress test. If your Pillar 2A figure is below what the PRA’s methodology produces, put the reasoning in the document, because the supervisor will make that comparison.
Sources: PRA SS31/15, paras 5.2 to 5.4, 5.7, 5.10, 5.12, 5.20 and 5.23.
Contents
The Rulebook requires a written record of the major sources of risk, how the firm will deal with them, and the stress tests with their assumptions and results. The right-hand column is what we find in drafts we review.
| Part | What the PRA expects | Where drafts fall short |
|---|---|---|
| Pillar 1 risks | Own funds requirements for credit, market and operational risk under the Rulebook: the base for every ratio in the capital plan. | Risk-weighted assets lifted from the last return, so the plan starts from a different balance sheet from the one it projects. |
| Pillar 2A risks | The firm’s own view of risks Pillar 1 misses or understates. SS31/15 covers credit, interest rate risk in the banking book, market, group, operational and pension obligation risk, and foreign currency lending. | The PRA’s methodology presented as the firm’s own, and risks called immaterial with no analysis behind the call. |
| Stress testing and capital planning | Stress tests at least annually. Capital resources and requirements projected over three to five years, before and after the realistic management actions the firm could, and would, take. | A stress narrative quoting different numbers from the capital plan tables, and management actions that would not work in the stress described. |
| Reverse stress testing | The business plan tested to failure: the point at which the market loses confidence, which can come well before capital runs out. Design and results approved at least annually by senior management or the governing body (every two years for an SDDT). | Scenarios that stop only when capital reaches zero, with no link to the recovery plan. |
| Governance and sign-off | The ICAAP is the management body’s responsibility, approved by it and used in decisions. | A board that sees the document once, at the approval meeting. |
| The capital model | Appropriately conservative. The PRA may examine its structure, parameterisation and governance, and whether the firm has the skills to run it. | A spreadsheet only its author can operate. |
Sources: PRA Rulebook, Internal Capital Adequacy Assessment Part, rules 13.1, 15.2 and 15.4; PRA SS31/15, paras 1.3, 2.2, 2.6, 3.8, 3.9, 3.25 and 4.3.
2027 ICAAPs
Basel 3.1 and the Pillar 2A changes take effect
An ICAAP approved in 2027 must reflect rules that change on 1 January 2027 and two that changed in 2026. Draft on the new numbers from the start; converting later tends to leave the stress results and the capital plan out of step.
Sources: PRA PS1/26, 20 January 2026 (para 2.6; rule instrument Article 92); PS2/26, 20 January 2026; PS15/26, 28 May 2026; PS7/25; PS9/24, para 6.6; PS5/25, SS1/25 and Rulebook, Regulatory Reporting 24.5; PS4/26, 20 January 2026; ICAA Part rule 15.4.
Three ways we work
Take one, or combine them.
We hold the pen. We run risk identification with your risk owners, run the stress and reverse stress tests, draft the document and take it through committee to the board. Your team works alongside us, so next year’s refresh is theirs.
You keep the pen. We test the draft and model against the ICAA Part and SS31/15, or SS4/25 for an SDDT, and give the board a written gap report that ranks each gap by how likely the PRA is to raise it, with the fix.
Where the spreadsheet is the weak point, we start from a RisKIT ICAAP model: pre-built, open Excel, in Basel II/2.5/III and Basel 3.1 versions. We set it up and validate it on your data, then train the people who will run it.
Engagement
Every engagement starts with a 30-minute scoping call and a written proposal setting out scope, timetable and fee. We plan back from the board date so the board has time to challenge the draft before it is asked to approve it. We read your last SREP feedback first, because it shows what the supervisor wants fixed.
The stress work comes before the prose. One scenario set drives both the stress narrative and the capital plan, management actions included, so the numbers in the text match the model. In our experience, reverse stress testing is where boards are most often challenged, so we build scenarios that reach the point of lost market confidence and tie them to your recovery plan options.
The board receives:
Credentials
The work is led by Mark Dougherty, CPA (CAN), our technical lead, and done by senior practitioners who have held the roles: former CROs and heads of risk, former regulators and interim executives, with model and quant specialists.
Our people write and review ICAAPs for banks, building societies and PRA-designated investment firms: first ICAAPs for newly authorised firms, annual refreshes, rebuilds after a supervisory finding, and independent reviews before the board approves. The same practitioners write ILAAPs, ICARAs and ORSAs, and work across Risk Advisory.
FAQ
SS31/15 expects the ICAAP to be updated annually, and sooner if a change in the business means current resources may no longer be adequate. Since 20 January 2026, SDDTs other than new and growing banks update their ICAAP every two years under PS4/26.
Yes. We review the document and the model against the PRA’s rules and SS31/15, and give the board a written gap report before approval. It ranks each gap and says what evidence would close it.
We plan back from the board date. The stress testing comes before the prose, so the timetable depends most on how quickly the capital data is ready.
Each engagement is priced in a written proposal after a 30-minute scoping call, setting out scope, timetable and fee. Starting from a RisKIT ICAAP model rather than a blank spreadsheet puts the first numbers in front of management sooner.
Yes. Some firms and supervisors combine the capital and liquidity assessments in one document, usually called an ICLAAP. For a UK bank the requirements sit in two Parts of the PRA Rulebook, the ICAA Part and the ILAA Part, so whatever the document is called it has to meet both, and we write it to both.
Insights
From 1 January 2027 an ICAAP has to be written on a Basel 3.1 basis. The PRA set this out in PS15/26: ICAAPs signed off by boards in 2026 should include an impact assessment of Basel...
By Mark Dougherty, CPA (CAN) · 8 min readHow to write an ICAAP the PRA takes seriously: structure, stress testing, capital planning and board challenge, from people who write them.
By Mark Dougherty, CPA (CAN)
An ICAAP, or Internal Capital Adequacy Assessment Process, is a bank's own assessment of how much capital it needs, of what type and where, to cover its risks now and over its business plan, including under stress. The PRA requires one from every bank and building society and uses it in the SREP to set Pillar 2 capital.
By Mark Dougherty, CPA (CAN) · 6 min readNext step
Tell us your board date and where the draft stands. We will tell you what it would take to finish, and whether you need us to write it, review it or build the model.
Tell us what needs doing and by when. A partner will come back to you. Treated in confidence.
Prefer email? advisory@risktae.com or +44 20 3996 9599. We use these details only to reply to you: privacy notice.
