Every regulated bank, building society, and investment firm produces an Internal Capital Adequacy Assessment Process document once a year. Every board signs it. Almost none of them would describe it as one of the most consequential governance acts they perform — and that gap between how the ICAAP is treated and what it actually represents is where board exposure concentrates.
The ICAAP is the mechanism through which a firm demonstrates it understands its own risks well enough to hold adequate capital against them — not the regulatory minimum, but a figure the firm has arrived at through its own genuine assessment. The PRA does not set that number. The board does, by approving the document that calculates it. That single fact is worth sitting with: the ICAAP is not a compliance submission the board rubber-stamps. It is the board's own statement of how much risk the firm is carrying and how much capital it believes is needed to withstand it.
Why most boards approve rather than own
The ICAAP process is technically demanding. It involves stress testing methodology, risk-weighted asset calculations, scenario design, and — since the introduction of Basel 3.1 — the output floor's interaction with a firm's specific business model. Few boards have the specialist technical depth to independently verify these calculations, and that is entirely reasonable. No board is expected to recalculate risk-weighted assets by hand.
The problem is not technical depth. It is that the gap between "we do not have the technical expertise to build this model" and "we have genuinely challenged whether this model's conclusions are sound" is where most boards quietly slide from ownership into approval. The document arrives already largely complete. The board's engagement becomes a review of a finished narrative rather than a genuine interrogation of the assumptions underneath it.
Signing the ICAAP is one of the most significant governance acts a board performs. The question is whether the signature reflects genuine understanding — or trust in a document the board did not have the means to independently test.
What genuine ownership actually requires
The board can articulate the firm's key capital risks unprompted
A useful, low-cost test: in a board meeting with no ICAAP paper in front of them, could each director name the firm's two or three most material capital risks and explain, in their own words, why they matter? A board that can only recite what the last paper said has not yet internalised the risk picture. A board that can explain it independently has.
Stress scenarios are challenged, not merely reviewed
The scenarios used in stress testing are judgement calls — decisions about what a plausible severe event looks like for this specific firm. A board that asks why a particular scenario was chosen, whether a more severe one should have been considered, and what the model would show under a scenario the risk function did not select, is exercising genuine oversight. A board that accepts the scenarios as presented is not.
The narrative reflects real deliberation, including dissent
The written ICAAP narrative is often treated as a technical document to be filed rather than a record of governance to be scrutinised. But the narrative is exactly where genuine board engagement should be visible — recorded questions, points of disagreement, requests for further analysis before sign-off. An ICAAP narrative that reads as a smooth, uncontested document is more often a sign of limited engagement than of a well-run process.
Internal model governance is a standing board matter, not a delegated technical exercise
For firms using internal models to calculate capital requirements, model governance — how the models are built, validated, and updated — has significant implications for the ICAAP's conclusions. Where model governance is delegated entirely to a technical committee with limited board visibility, the board's ICAAP sign-off rests on assumptions it has not itself examined.
Why Basel 3.1 raises the stakes
The introduction of the output floor — which limits how much benefit a firm can derive from internal models relative to the standardised approach — changes the capital calculus for model-heavy firms in ways that are not always intuitive. A board's prior understanding of the firm's capital efficiency may no longer hold under the new framework, and the ICAAP is precisely where that shift should be tested and understood at board level.
This is not a call for boards to become capital modelling experts. It is a call to recognise that Basel 3.1 has raised the bar for what "adequate board understanding" means — and that a board whose ICAAP engagement was already closer to approval than ownership will find that gap more exposed now than it was before.
The firms that handle supervisory scrutiny of their ICAAP well are, without exception, the ones where genuine board challenge is visible in the record — not just claimed in the covering letter.
Five questions worth asking before the next ICAAP sign-off
- Could every board member explain the firm's two or three most material capital risks without reading from a paper?
- Were the stress scenarios challenged, or simply reviewed and accepted?
- Does the ICAAP narrative show evidence of genuine deliberation — questions asked, points revised — or does it read as a finished document presented for approval?
- Has the board considered Basel 3.1's output floor implications for this firm's specific business model, not just the sector in general?
- Is internal model governance genuinely visible to the board, or delegated entirely to a technical committee?
The ICAAP will continue to be produced by the risk function, reviewed by technical committees, and presented to the board as a largely finished document. That is appropriate — boards are not meant to build capital models themselves. What distinguishes genuine ownership from approval is not technical capability. It is whether the board's engagement — its questions, its challenge, its record of deliberation — is substantive enough that, if scrutinised, it would demonstrate the board understood what it was signing.