“The challenge of ICAAP” by Francisco Roque A. Lumbres (August 2, 2010)
SUITS THE C-SUITE By Francisco Roque A. Lumbres
Business World (08/02/2010)
On January 15 last year, the Bangko Sentral ng Pilipinas (BSP) issued Circular 639, requiring all universal banks and commercial banks to undertake an Internal Capital Adequacy Assessment Process (ICAAP).
This now requires banks to develop and implement internal systems and procedures to ensure adequate capital in the long term, taking into consideration all material risks.
The ICAAP must be completed and submitted to the BSP by January 31 next year.
Before submission, however, the ICAAP must be approved by the bank’s Board, reviewed on a regular basis, and updated when there are changes in the bank’s risk profile.
Basel II and ICAAP
The ICAAP is a component of Basel II. Basel II, which was implemented in the country in 2007, is based on three pillars:
• Pillar 1 covers minimum capital requirements for credit, market and operational risks;
• Pillar 2 covers the supervisory review process and consists of ICAAP and the Supervisory Review and Evaluation Process;
• Pillar 3 covers market discipline and includes disclosure requirements and reporting.
ICAAP requires banks to implement their own process for assessing their capital adequacy in relation to their risk profiles and a strategy for maintaining their capital levels.
Pillar 2 also requires supervisory authorities like the BSP to review banks’ strategies, risk policies, processes and procedures and then determine whether their capital is adequate.
Although ICAAP is aligned with the regulatory capital requirements under Pillar 1, its scope and coverage is beyond the credit, market and operational risks under Pillar 1.
It also includes liquidity, reputational, strategic, and concentration risks.
The key guiding principles of ICAAP are as follows:
• comprehensive assessment of all material risks — Banks must assess all their material risks. They must be able to identify, quantify and report all significant risks from a business perspective to secure capital adequacy. This risk assessment process should be documented properly.
• principle of proportionality — The guiding principle is that the more significant a risk is based on a bank’s assessment, the better the bank’s risk measurement and management procedures should be.
• Board and senior management responsibility — The overall responsibility for the ICAAP rests with the bank’s Board and senior management. They must ensure that an ICAAP is in place and reviewed regularly.
• forward-looking perspective — The ICAAP should not be limited to existing risks but it must also consider potential risks arising from future business strategies.
• embedded in the business — The ICAAP should become an integral part of risk management and decision-making process.
• internal controls and independent review — Banks should establish a process of internal controls, audit and review, making the ICAAP subject to independent internal or external review.
• ongoing process — The ICAAP is not a one-time requirement, but rather a dynamic and continuous exercise that should form an integral part of the bank’s risk management process.
In implementing ICAAP, banks need to address four critical elements.
Here are some questions to consider when implementing ICAAP:
• assessment and mitigation techniques — There is no cookie-cutter approach in complying with the ICAAP. Banks need to consider their own unique set of risks. Is the bank able to identify and measure the risks it is exposed to now and in the future, as it moves forward in executing its strategy toward attaining its business goals? Given the risks it is exposed to, does it apply the appropriate mitigation techniques that may help lower capital requirements?
• board and senior management involvement — Many banks are now on their second dialogue with the BSP. Senior executives may expect a more rigorous discussion on ICAAP and its governance with the BSP. Board members and senior executives may be probed on their understanding of their bank’s risks, risk strategy, plans to secure sufficient capital, and embedding ICAAP in the business. Delegating ICAAP to risk, finance or corporate planning functions with little Board and senior management involvement is clearly not the way to go. The absence of board discussions in the minutes of meetings may suggest rubber-stamping of ICAAP documents submitted to the BSP.
Moreover, the internal audit (IA) function needs to be actively involved. The BSP expects IA to take part in the ICAAP process and submissions.
• stress testing in capital planning — Does the bank have the appropriate techniques used in the conduct of stress testing when it plans its capital adequacy? Are the bank’s stress tests “stressed” enough? The BSP will look at scenarios that are forward-looking and not just historical ones. They also expect stress tests based on scenarios that are “severe enough and yet plausible.” The BSP will be interested in how the bank plans to manage its business and capital to survive stress or crisis situations while meeting the minimum capital requirement.
• securing capital adequacy — Is the bank able to link its risks to capital adequacy? What are the ranges of capital identified, and how much capital should the bank hold? ICAAP is not just about how much capital the bank should have now, but should consider forward-looking aspects taking into account the potential risks and changes in business strategies.
Getting the most out of ICAAP
Pure regulatory compliance should not be the prime motivator for adopting a sound ICAAP. Rather, the ICAAP should be rooted in the best interest of all stakeholders.
The business of banking has increasingly become complex and it calls for an effective risk management system in order for banks to possess adequate capital in the long term.
The ICAAP journey provides a significant opportunity for banks to ensure capital adequacy via redesigning its risk strategy and appetite; improve existing risk management system and process; strengthen integration of risk and capital management; and embed the process in the business for better corporate governance and decision making.
ICAAP is an important process within all banks. Implemented properly, a sound ICAAP will help banks manage their business better through volatile economic cycles.
(As of publication, Francisco Roque A. Lumbres, CFA, PRM is a Partner of SGV & Co.)
This article was originally published in the BusinessWorld newspaper. It is for general information only and is not a substitute for professional advice where the facts and circumstances warrant. The views and opinion expressed above are those of the author and do not necessarily represent the views of SGV & Co.