During an engagement with a mid-sized commercial bank in Kenya, we asked the risk and finance teams to walk us through their ICAAP submission to the regulator. Their response was full of vague statements “We use expert judgment to set capital buffers,” “We consider all risks,” and “Our board reviews the report annually.” Not one of them could show me a documented link between the bank’s strategy, its key risks, and the capital allocated.
That’s when we knew: this was not an ICAAP but it was a regulatory appeasement document. And that’s dangerous.
If you treat ICAAP as a compliance box to tick, your bank is exposed. But if you use it as a strategic management tool, you gain competitive advantage. Here’s how to do it right, step by step.
Step 1: Ground ICAAP in your strategy
ICAAP must begin with your bank’s strategic objectives. Are you pursuing aggressive growth in SME lending? Expanding cross-border operations? Digitizing your product portfolio? Each of these choices drives different risk exposures. That’s why the ICAAP must be built after a clear strategy articulation.
In one assignment for a pan-African bank, we started by mapping each of their five-year strategic goals. Then we linked each goal to the top risk themes credit concentration, operational fragility, tech disruption, etc. From there, capital planning was no longer theoretical. It became purposeful.
Step 2: Define your risk universe, comprehensively
Don’t limit ICAAP to Pillar 1 risks (credit, market, operational). A robust ICAAP covers Pillar 2 risks like liquidity under stress, strategic missteps, reputation damage, cyber threats, and even ESG risk. Build a Risk Universe Matrix that clearly identifies each risk type, its relevance, owner, and measurement approach.
Pro tip: hold workshops across departments to ensure risks are not just imagined from head office. Branch-level realities often expose gaps that head office templates ignore.
Step 3: Develop a clear Risk Appetite Framework (RAF)
Most banks have something they call a risk appetite statement. But real RAFs are quantified, linked to business goals, and updated frequently. Define both hard limits (e.g. NPL ratio < 6%) and soft limits (e.g. customer complaints not exceeding 5% per month).
Boards must approve the RAF, and EXCO must operationalize it through business unit dashboards. If your branch managers don’t know your risk appetite, your ICAAP is cosmetic.
Step 4: Conduct robust capital adequacy stress testing
Stress testing is the engine of ICAAP. Run scenario-based tests (e.g. “What if NPLs rise by 30% over 12 months?”) and sensitivity tests (e.g. “What if FX volatility increases 20%?”). Always cover at least three plausible but severe stress events.
Use historical data and forward-looking intelligence. Tie the outcomes to specific capital actions: increase buffer, de-risk portfolio, raise contingency funding.
Step 5: Design your capital planning and allocation model
Capital must be allocated based on actual risk not just RWA percentages. Align economic capital to risk-adjusted performance metrics. Document your capital buffer rationale: business cycle, external environment, strategic investments, and regulatory expectations.
At a financial institution we supported in South Africa, once we clarified the capital allocation model, the board could confidently decide between expanding the mortgage book or investing in digital lending. That’s real governance.
Step 6: Align governance, Board, EXCO, and Risk Committees
Boards must not just receive ICAAP reports - they must interrogate them. EXCO should review ICAAP quarterly, not annually. Assign clear ownership: CRO for risk aggregation, CFO for capital projections, and CEO for strategic alignment.
Document every discussion in minutes. The regulator watches not just what you write - but what you do.
Compliance is minimum. ICAAP is a strategy weapon.
The best banks use ICAAP as a strategic steering tool, not a compliance nuisance. It’s a mirror to test your ambition against your resilience. When done well, it builds investor confidence, reduces surprises, and makes Board decisions sharper.
Don’t outsource thinking. Own your ICAAP. As a senior leader, ask your next Board Risk Committee to answer:
“What strategic risks are we underestimating, and how is our capital protecting us?”
If no one can answer confidently, your ICAAP isn’t working. Need help turning your ICAAP into a strategic weapon? You know where to find me.
Mr Strategy
