How to Prepare an ICAAP That Anticipates PRA Challenge

A strong ICAAP is not a document. It is evidence that the board and executive understand the risks the firm runs, have quantified them with intellectual honesty, and hold capital that genuinely reflects them. PRA challenge, and any resulting Pillar 2A uplift or PRA buffer, tends to follow weaknesses in that evidence rather than in the arithmetic. The firms that come through supervisory review well are those whose ICAAP reads as a product of genuine internal debate, not a compliance artefact.

Start With Risk Identification, Not Capital Numbers

Most weak ICAAPs begin with the Pillar 1 position and work outwards. Strong ones begin with a disciplined risk identification exercise that asks what could actually hurt this firm, given its business model, concentrations, and operating environment. This is where the SREP-facing credibility is won or lost.

For each material risk, the document should show: how it was identified, who challenged the assessment, what evidence supports materiality, and how it maps to capital. If a risk is dismissed as immaterial, say why with specifics. Supervisors notice when a risk register has been copied forward from last year with cosmetic updates.

Design Stress Scenarios the Board Would Actually Worry About

The reverse stress test and severe but plausible scenarios are where PRA reviewers probe hardest. Common failings: scenarios that are severe in headline but mild where it matters for your portfolio, narratives that do not translate into coherent P&L and capital paths, and a reverse stress test that stops at an abstract loss number without describing the chain of events.

Good practice: build scenarios around your actual concentrations and vulnerabilities. If you have a geographic tilt, a sector exposure, a funding dependency, or a single large counterparty, the scenario should bite there. Walk the scenario through origination, impairment, funding cost, operational response, and management actions. Be explicit about which management actions are realistic under stress and which are not.

Own the Pillar 2A Methodology

For each Pillar 2A risk category, the firm should set out its own methodology and quantification before referencing the PRA's methodologies. Where you depart from supervisory benchmarks, explain why with reference to your business model. Where you align, show that you have tested the result rather than defaulted to it.

Concentration risk, IRRBB, pension risk, and operational risk are the usual areas where add-ons arise. For each, ask: does the number we are holding reflect the risk a thoughtful outsider would see in our book?

Make Board Ownership Visible

A board-approved ICAAP that reads as if the board saw it once, at the end, invites challenge on governance as well as substance. The document should reference specific board and risk committee discussions, challenges raised, and how they changed the output. Minutes should corroborate this.

The CRO and CFO should be able to defend any number in the document without reading from it. If they cannot, the document is not ready.

Address the Previous SREP Head-On

If the last SREP produced specific feedback, findings, or an add-on, the new ICAAP must show what you have done about it. Burying the response, or claiming the issue has been resolved without evidence, is the single most reliable way to attract a repeat finding or an escalation.

What Good Looks Like

A PRA reviewer should finish the ICAAP able to summarise, in a paragraph, what this firm is, what could kill it, how much capital it holds against those risks, and why that amount is right. If any of those four are unclear, expect challenge. If all four are clear and well-evidenced, the dialogue tends to be about calibration rather than credibility.

Next Step

Before the next submission cycle, commission an internal pre-read by someone outside the ICAAP team, ideally with supervisory experience, and ask them to mark it against the four questions above. The gaps they find are the ones the PRA will find.

Frequently Asked Questions

How far ahead should ICAAP preparation start?

Six months is a reasonable minimum for a firm of any complexity. Risk identification and scenario design need time for genuine debate, and board engagement cannot be compressed into the final weeks without showing.

Should we benchmark our Pillar 2A against peers?

Yes, but as a sense-check, not a target. If your numbers diverge materially from comparable firms, you should understand why and be able to explain it. Converging on the peer average without a reason of your own invites the question of whether you have done the work.

How do we handle a risk we know is contentious with the PRA?

Address it directly. Set out your view, acknowledge the supervisory perspective, show the analysis behind your position, and describe what would change your mind. Supervisors respond better to reasoned disagreement than to silence or hedging.

What is the most common cause of a PRA buffer increase?

Stress testing that does not reflect the firm's actual vulnerabilities, combined with management actions that would not survive contact with the scenario. Both signal that the firm has not internalised the exercise.

Who should present the ICAAP in supervisory dialogue?

The CRO and CFO jointly, with the CEO able to speak to strategic choices and the Chair available on governance. A document presented only by the second line signals that the first line does not own it.