Is there enough “I” in your ICAAP and ILAAP?

Supervisory expectations of the ICAAP and ILAAP continue to evolve. The latest guidance papers from the European Central Bank (ECB) and the European Banking Authority (EBA) on them seek to enhance their thoroughness and explore how “internal” the processes are – that is, ensuring that they are fully embedded within a bank’s operations and business decision-making, and integrated with the supervisory and risk management framework, and “strategic steering”. Banks are being challenged to move beyond a pure compliance mindset and invest resources to enhance how strategy and risk are jointly managed within the business.

Deloitte’s third Banking Union Supervisory Survey examines the current approach of 52 banks from 15 Eurozone countries supervised by the ECB’s Single Supervisory Mechanism (SSM), and in particular explores whether Boards and senior management teams are sufficiently focused on the demand from supervisors, and the benefit to their businesses, of better integration and embedding of the ICAAP and ILAAP.

In this paper, we consider why, given the potential benefits, SSM supervised banks have not yet made the required investment to better integrate and embed the ICAAP and ILAAP, and what could be done to catalyse change. We identify a number of enablers to achieve alignment between the objectives of the bank and its supervisors. These include risk data and IT infrastructure, risk-adjusted performance measurement, alignment of management incentives, and governance. We further examine the management of non-financial risk (NFR) as a case study, an area where supervisors are developing their expectations.

Key observations from the 2018 Deloitte Banking Union Supervisory Survey

• Almost all survey respondents said that the Board used the ICAAP and ILAAP to challenge and assess capital and liquidity adequacy.
• Respondents reported a strong link between the outputs of the ICAAP/ILAAP and the review and calibration of the risk appetite statement (RAS). However, feedback loops between the RAS and the ICAAP/ILAAP in the event of a breach of the RAS were not as strong.
• The majority of respondents initially reported that the outputs of the ICAAP/ILAAP were a critical input into the business decision-making process, but some then found it difficult to provide specific examples of the link between business decision-making processes and the ICAAP and ILAAP.
• Integrating NFR into ICAAP remains a challenge, with many respondents still working to develop models to quantify NFR or using existing quantitative and qualitative methodologies to account for NFR.
• Only about half of the respondents agreed that supervisory expectations are transparent and support/correspond to their internal view on ICAAP and ILAAP design and governance.