How to Structure an ICAAP Board Challenge Session That Withstands PRA Scrutiny

The PRA reads ICAAP board minutes forensically. Supervisors are looking for evidence that directors understood the capital numbers, tested management's assumptions, and reached a defensible view on adequacy. What they must not find is a session so choreographed it looks rubber-stamped, or so freewheeling that individual directors end up personally owning technical judgements they were never equipped to make. The structure of the challenge session is what threads that needle.

Key Executive Takeaways

• The PRA wants to see substantive challenge on stress scenarios, Pillar 2 methodology, and management buffer, evidenced in minutes that name the challenger and record the response.
• Individual accountability risk crystallises when a director's name is attached to a specific technical conclusion they cannot defend under supervisory questioning; the fix is collective board sign-off on capital adequacy, with individual challenges recorded as questions rather than determinations.
• Pre-reads, a documented challenge log, and a clear split between CFO-owned numbers and board-owned judgement are the three artefacts that separate a credible session from a vulnerable one.

Start with the pre-read discipline

The challenge session begins two weeks before the meeting. Directors need the full ICAAP document, a board-level summary of no more than twelve pages, and a separate challenge pack: last year's PRA feedback, the internal audit view, and the CRO's independent assessment of where management may be optimistic. Without the challenge pack, non-executives are challenging in a vacuum, and the minutes will show it.

What most boards get wrong: they send the ICAAP as a fait accompli. The pre-read should explicitly flag the three or four judgement calls management made, the alternatives considered, and why the chosen path was preferred. This is what gives NEDs something concrete to push on.

Sequence the agenda around judgement, not numbers

The session should not open with the capital ratio. Open with the scenario narrative: what could plausibly go wrong, and does the board believe the severity is calibrated correctly. Then move to Pillar 2A methodology, then management buffer, then the ratio. This sequence forces the board to challenge the inputs before endorsing the output. Supervisors notice when the flow runs the other way.

Allocate at least ninety minutes. Anything shorter reads, in the minutes, as insufficient.

Structure the challenge record to protect individuals

This is where accountability risk is managed. The minute-taker should record challenges in a consistent format: the director asked X, management responded Y, the board was satisfied or requested further work. The individual director is on record as having asked a probing question. The board collectively is on record as having reached a conclusion.

What goes wrong: minutes that read "Director A concluded the operational risk capital was adequate." That single sentence hands the PRA a named individual to question when things move. The correct formulation is "Director A challenged the operational risk methodology; management provided the following justification; the board concluded the approach was reasonable."

Maintain a separate challenge log as an appendix. This becomes the primary artefact you hand supervisors when they ask how the board tested the numbers.

Keep the CFO owning the numbers, the board owning the judgement

The ICAAP document is management's. The board is not certifying arithmetic; it is forming a view on whether the capital position is adequate given the risk profile and strategy. Make this split explicit in the chair's opening remarks and in the resolution. The resolution should approve the ICAAP as the basis for the firm's capital adequacy assessment, not attest to the accuracy of every calculation. This distinction matters when supervisors probe individual understanding of Pillar 2 model mechanics.

What good looks like

A credible session produces: minutes running to eight to twelve pages, a challenge log with fifteen to twenty five recorded challenges, evidence that at least two scenarios were reshaped by board input, and a resolution that ties capital adequacy to the risk appetite statement. If your last ICAAP minutes were three pages and recorded unanimous approval with no substantive discussion, you have a problem the PRA will find.

Next step

Before your next ICAAP cycle, ask the company secretary to pull the last two years of ICAAP minutes and score them against the structure above. If the challenge log does not exist, or if individual directors are named as reaching technical conclusions, redesign the session template now, not after the supervisor asks.

Frequently Asked Questions

Should the CRO or CFO lead the session?

The CFO presents the ICAAP; the CRO presents the independent challenge. Both should be in the room throughout. The chair runs the session. If the CFO both presents and defends without an independent voice, the challenge record looks thin.

How do we handle a director who does not understand the Pillar 2 methodology?

That director should ask clarifying questions on the record and rely on the collective board resolution. Do not push them to sign off on technical detail. The PRA expects directors to understand the risks and the judgements, not to replicate the modelling.

Can we hold the challenge session over two meetings?

Yes, and for larger firms this is often better. Run a scenario and methodology session six weeks before final approval, then a capital adequacy conclusion session. This produces a stronger evidential trail than a single meeting.

What if the PRA has already flagged concerns with last year's ICAAP?

Address those concerns explicitly on the agenda, with a paper showing what changed and why. Silence on prior feedback is the fastest way to escalate supervisory attention.