ICAAP and ILAAP: Turning Regulatory Exercises into Management Tools

What the processes are for

Minimum capital requirements are calculated using standardised or approved internal approaches that necessarily simplify. They do not capture concentration risk in full, they treat interest-rate risk in the banking book outside the main calculation, and they say little about business-model risk, strategic risk or reputational risk. ICAAP is the institution's own answer to what capital is required once those gaps are considered.

ILAAP plays the same role for liquidity. The liquidity coverage ratio and net stable funding ratio are standardised, comparable and deliberately blunt. They do not reflect an institution's specific depositor concentration, intraday requirements, collateral encumbrance profile or the behaviour of its particular funding providers under stress. ILAAP is where those specifics are assessed.

Core components

ICAAP

• Risk identification: a structured inventory of material risks with a documented materiality assessment, revisited annually.
• Quantification: internal capital estimates for each material risk, using methods proportionate to the risk and the institution.
• Aggregation: combination of risk-type capital with an explicit and justified diversification assumption.
• Capital planning: multi-year projection of resources and requirements under baseline and adverse conditions.
• Stress testing: severe but plausible scenarios linked to the institution's specific vulnerabilities.
• Management actions: credible, quantified and pre-considered responses, distinguishing what is within management control from what is not.

ILAAP

• Funding strategy and the concentration profile of funding sources by counterparty, tenor, currency and channel.
• Survival horizon analysis under idiosyncratic, market-wide and combined stress.
• Collateral management, encumbrance and the realistic monetisation capacity of the liquid asset buffer.
• Intraday liquidity requirements, which are frequently the least analysed component.
• The contingency funding plan, with triggers that give management usable lead time rather than confirming a crisis already under way.

Making them management tools

The difference between a compliance document and a management process is mostly about sequencing and ownership. If the capital assessment runs in parallel with the business plan and its results can change the plan, it is a management process. If it validates a plan already approved, it is documentation.

1. Run the scenario analysis before the plan is finalised, so capital and liquidity constraints shape targets rather than being reconciled to them afterwards.
2. Give each material risk an accountable owner who presents the quantification and defends the assumptions, rather than centralising authorship in the risk function.
3. Express the output as a small number of decisions: how much growth is affordable, which portfolios consume disproportionate capital, whether the buffer is correctly sized and composed.
4. Use the same scenarios across capital, liquidity, earnings and recovery planning so the narratives are consistent and the interactions are visible.
5. Track the previous year's stress results against subsequent experience and record what the comparison implies about scenario severity.

Board engagement and recovery planning

Supervisory frameworks place responsibility for these assessments with the management body. That responsibility is meaningful only if the board receives material it can interrogate: a limited set of scenarios with clear narratives, the specific vulnerabilities they test, the resulting capital and liquidity trajectory, and the management actions assumed.

Recovery planning connects to both. Recovery indicators should be calibrated against the same stress scenarios, so that a trajectory identified in ICAAP or ILAAP maps to a defined escalation point. Where recovery triggers are set at levels only breached after the assessments show capacity is already exhausted, the plan provides no lead time.