How to Structure an ICAAP Narrative That Pre-empts PRA Capital Add-on Challenge

The PRA does not read your ICAAP looking to agree with you. It reads it looking for the gap between your risk profile and your capital number, and for the sentences you hoped it would skim. A well-structured narrative closes those gaps before the supervisor opens them. A poorly structured one invites a Pillar 2A uplift or a PRA buffer scalar that could have been avoided.

Start with the supervisor's question, not yours

The PRA reviewer is answering one question: is this firm holding enough capital for the risks it actually runs, under plausible stress, with credible management response. Your Executive Summary should answer that question in under three pages. State the Pillar 1 number, the Pillar 2A methodology output by risk category, the stressed capital need, the buffer conclusion, and the residual uncertainties you have chosen not to capitalise and why. If the reader has to hunt for any of these, you have already lost ground.

Most firms bury the answer behind fifty pages of business description. Cut it. The business model belongs in an annex unless a specific feature drives a specific risk.

Anchor the risk taxonomy to the Board's own words

Supervisors compare the ICAAP against Board minutes, the risk appetite statement, and the CRO's recent papers. Divergence between these documents is treated as a control weakness. Before drafting, reconcile the ICAAP risk taxonomy line by line with the risk appetite statement and the latest Board risk report. Where the ICAAP introduces a risk the Board has not discussed, add a footnote showing when it was tabled. Where the Board has flagged a concern absent from the ICAAP, address it head-on.

Quantify Pillar 2A with method, not defensiveness

For each material risk, structure the section identically: definition, exposure metric, methodology, key assumptions, sensitivity, capital outcome, and known limitations. The PRA's own methodology statements are the reference point for credit concentration, operational risk, IRRBB, and pension risk. Deviation is allowed; unexplained deviation is not. If your operational risk scenario analysis produces a lower number than a loss-distribution approach would, show both and explain the choice. Reviewers accept judgement. They do not accept selection bias.

Price your own weaknesses

The biggest self-inflicted wound in ICAAPs is the unacknowledged issue. If model validation has flagged a limitation, if data quality is weak in a portfolio, if a new product has thin loss history, name it and add a management overlay. A firm that adds fifteen basis points itself for a known data gap almost never receives a larger scalar for the same gap. A firm that stays silent almost always does.

Make stress testing decision-useful

The scenario narrative should read like a Board paper, not a modelling exercise. Tie each scenario to a specific vulnerability in the business model. Show the capital trajectory quarter by quarter, not just the trough. Then, for management actions, specify: the action, the trigger metric, the approval body, the execution timeline, and the capital impact net of tax and second-order effects. "Reduce lending" is not a management action. "Pause new originations in unsecured personal loans above 60 months tenor, triggered at CET1 of X percent, approved by ExCo within 10 business days, releasing Y of RWA over two quarters" is.

Close the loop to the buffer

The PRA buffer conclusion should follow mechanically from the stress results and the quality of management actions. State the buffer, state the stress drawdown net of credible actions, and show the arithmetic. If you are proposing a buffer below what a naive read of the stress would suggest, justify it with the specificity of your actions, not with adjectives.

What to do next

Before the next submission, run a red-team read of the current draft with one instruction: mark every paragraph where a supervisor could reasonably ask a follow-up question. If more than a handful survive, the document is not ready.

Frequently Asked Questions

How long should the ICAAP be?

Long enough to evidence the analysis, short enough that the argument is visible. For a mid-sized bank, the main document should sit between 120 and 180 pages, with methodology and data in annexes. Length above that usually signals a document written to reassure the author rather than the reader.

Should we pre-empt the SREP by proposing our own Pillar 2A number?

Yes, and with conviction. A firm that presents a defended number, with method and sensitivities, sets the anchor for the dialogue. A firm that presents a range invites the top of the range.

How do we handle risks the PRA has flagged thematically but which we do not consider material?

Address them in a dedicated section, show the analysis that led to the immateriality conclusion, and quantify the sensitivity. Silence on a thematic priority is read as either negligence or evasion.

What is the most common reason firms receive an add-on they did not expect?

A mismatch between the risk profile described qualitatively in the document and the quantification. Reviewers notice when the narrative flags growth, complexity, or concentration and the capital number does not move accordingly.

How early should the Board see the draft?

The Board should shape the risk appetite and scenario choices before drafting begins, review a substantive draft at least six weeks before submission, and approve the final version with time to reflect changes. Late Board involvement produces documents that read as management papers with a Board signature, and supervisors can tell.