Why Your ICAAP Is Failing the Board — And How Stress Testing Should Actually Drive Decisions

The ICAAP Has Become a Ritual. That Is the Problem.

Every year, hundreds of significant institutions across the EU produce detailed, technically sophisticated ICAAP documents. The work is extensive: granular market and credit risk models, reverse stress testing frameworks, scenario libraries calibrated to macro forecasts, capital consumption pathways under tail distributions. The output is impressive—often 100+ pages of methodology, results, and governance narratives.

And almost none of them change a lending decision, a portfolio allocation, or a capital buffer target.

The regulatory compliance is impeccable. The mathematical rigor is genuine. The governance sign-offs are in place. But the conclusions lie inert on a server, reviewed annually by the Risk function and the Board, then shelved until the next submission deadline arrives.

This is not a technical problem. It is a decision architecture problem. When a bank's ICAAP is designed as a regulatory submission rather than a management tool, the business lines that create and drive risk are excluded from the exercise. The capital assumptions embedded in the stress test are treated as regulatory outputs, not as live inputs to business strategy. And when the Risk Committee hears that "capital is adequate under all scenarios," no one asks the question that matters: What would we do differently if we believed the severe scenario had a 10% probability of materializing tomorrow?

The answer, often, is: nothing.

The Compliance Trap: Why Stress Tests Stop at the Submission

The structural issue is this: ICAAPs are designed and signed off by risk teams. They are reviewed by supervisors within the SREP process. They sit in the regulatory submission stream. Business lines—the lending teams, the trading desk, the investment committee—rarely see them.

When stress test output is reported to the Risk Committee as a 200-page document with the headline that "capital ratios remain above the bank's risk appetite thresholds under all scenarios," the committee has no incentive to dig deeper. The compliance burden is satisfied. The institution is safe. The exercise is done.

But compliance and adequacy are not the same as usefulness. A stress test that confirms what everyone already believed is not a stress test—it is a validation exercise. It generates confidence rather than insight.

The problem deepens when you examine the scenarios. Most banks recycle scenario assumptions from the prior year, sometimes with minor adjustments for the current macro environment. The ECB's geopolitical scenario in the 2026 ICAAP exercises is designed to stress banks, not to validate their current views. Yet when a bank's internal reverse stress testing reveals that the institution becomes unviable under assumptions that have a plausible 5-8% probability, that insight is usually compartmentalized within the Risk function. It does not flow to the CFO's capital planning model, it does not inform the business strategy, and it certainly does not lead to a constraint on lending growth or RWA targets.

Why? Because the ICAAP framework has been built as a top-down exercise: supervisors define the framework, the CRO operationalizes it, and the business receives outputs. There is no feedback loop. There is no decision authority tied to the results. The ICAAP exists in regulatory time, not business time.

The Three Questions a Useful ICAAP Must Answer

The most fundamental challenge in transforming an ICAAP from compliance to decision-making is this: which questions are you trying to answer?

A Board-useful ICAAP must be designed to answer three core questions, and if the Board cannot articulate clear answers to all three after reviewing the ICAAP, the exercise has failed—regardless of its regulatory compliance status.

1. Under what scenario does this institution become unviable, and how plausible is that scenario today?

This is the reverse stress test question. Not "what is our loss under scenario X" but "what would have to happen for us to fail?" A true reverse stress test forces a bank to identify concentration risks, model dependencies, and business model vulnerabilities that traditional scenario analysis papers over. For example: if CET1 falls below 8.5% because deposit funding dries up in a liquidity stress, what was the trigger? How correlated is your deposit base to the trigger event? How quickly can you shrink assets to restore capital? These are not comfortable questions, but they are the ones that matter.

The ECB's 2026 reverse geopolitical stress test is explicitly designed to force this kind of honesty. The scenario is calibrated to produce 300 basis points of CET1 depletion for a mid-sized bank with typical exposures. If your model shows only 150 basis points of depletion under that scenario, the ECB's implicit question is: what are you missing?

2. What decisions would management make differently if they believed the severe scenario had a 10% probability of materializing?

This question exposes whether the ICAAP has any real behavioral consequence. If the answer is "we would do nothing differently," then the ICAAP is not functioning as a management tool. It is a regulatory artifact. A genuine stress test output should trigger management action: a decision to reduce exposure in a particular asset class, to tighten underwriting standards, to hold higher capital buffers, to divest a business line. If the Board reads a reverse stress test that identifies a plausible path to capital depletion under a geopolitical shock, and the institution's response is "we will monitor this," the test has failed.

3. Where is the boundary between capital we hold for regulatory compliance and capital we hold because we genuinely believe the risk warrants it?

This is the most politically difficult question in banking, but it is where the real decision-making lives. A bank's combined Pillar 1 and Pillar 2 framework is designed by regulators. But the ICAAP output—the internal capital adequacy assessment—should inform the institution's own view of how much capital it needs. If management believes that the risks identified in the ICAAP require 11% CET1 to be held with genuine confidence, but the regulatory minimum (Pillar 1 + Pillar 2R + buffer requirements) is 9.5%, the board needs to consciously choose whether the additional 150 basis points is justified by the bank's own risk appetite.

Most boards cannot answer these questions. Not because the board members lack sophistication, but because the ICAAP has been structured to prevent them from needing to.

Reverse Stress Testing Is the Most Honest Exercise in Risk Management

Reverse stress testing represents a fundamental inversion of how most banks approach capital adequacy. Instead of asking "what is our capital depletion under scenario X?", you ask "what would have to go wrong for us to fail?" This distinction is not semantic; it forces a different kind of rigor.

In traditional scenario analysis, a bank specifies a scenario (e.g., a 4% decline in GDP, a 500bp widening in credit spreads, a 20% depreciation in currency X). Then, it runs that scenario through its risk models and observes the impact on capital. The output is typically a point estimate: "under this scenario, CET1 falls to 9.8%." The bank then assesses whether 9.8% is acceptable.

This approach has a fatal flaw: it assumes that the scenarios specified are the ones that matter. But the scenarios that actually threaten a bank are often combinations of factors that the risk team did not pre-specify, or dynamics that the models do not fully capture. A reverse stress test changes the question: what market moves, credit events, or behavioral changes would be required to move CET1 to 8.0%? Then, the bank assesses the plausibility and likelihood of those combinations.

The ECB's 2026 reverse geopolitical stress test is a case study in this approach. Rather than specifying a single geopolitical scenario, the ECB is asking banks to work backwards from a capital depletion target (approximately 300bps of CET1) and to identify which risk drivers would plausibly produce that outcome. For a bank with significant emerging market exposures, this might mean a currency depreciation + sovereign spread widening + corporate default clustering. For a bank with commodity risk, it might mean energy price collapse + equity volatility spike. The key insight is that different banks have different reverse stress tests, because they have different risk concentrations.

This moves the exercise from regulatory compliance to risk management. A bank that understands its own reverse stress test has clarity on which concentrations are dangerous and which are manageable. That clarity is actionable. It can inform business strategy, capital allocation, and risk appetite.

Connecting Stress Testing to the ALCO and the Board

The integration of stress testing into actual management decision-making requires a specific plumbing: stress test outputs must feed directly into the bank's most critical governance forums.

The most important connection is to the Risk Appetite Framework (RAF). In most banks, the RAF exists as a parallel structure to the ICAAP: risk metrics, thresholds, and escalation triggers are set, and they are monitored through the year. But the connection between the ICAAP and the RAF is loose. The ICAAP produces a set of capital estimates under scenarios; the RAF sets tolerance levels for annual losses, unexpected defaults, market moves, and liquidity stress. Ideally, these should be directly linked.

Here is how it works: The ICAAP's reverse stress test identifies the combination of market and credit events that would move CET1 to the bank's minimum target (e.g., 8.5%). That combination becomes a RAF constraint. ALCO monitors this constraint daily or weekly. If the bank's current exposures move closer to the boundary identified in the reverse stress test, the ALCO escalates the issue and may require action. This is not a theoretical exercise; it is a live operational link between stress testing and decision-making.

A second critical integration point is capital planning triggers. The ICAAP should directly inform when the bank's business plan requires capital raise or when growth must be constrained. For example: if the ICAAP shows that a 2% decline in GDP would drive CET1 to 9.1%, and the bank's risk appetite minimum is 9.5%, then the bank should build into its three-year financial plan a mechanism to reduce leverage or raise equity if that economic scenario materializes. This is not hypothetical risk management; it is strategic planning grounded in stress test output.

A concrete example: Using the ICAAP's capital distributions under stress scenarios, the CFO and CRO jointly set the Pillar 2 Guidance (P2G) target that the bank will hold above its regulatory Pillar 2 Requirement. The ECB does not set the P2G; the bank does, in dialogue with supervisors. But the bank's internal reasoning should be transparent: "Our ICAAP shows that under the ECB's geopolitical scenario, CET1 depletes by 280bps. To maintain our risk appetite even in a severe scenario, we will hold P2G of 150bps." This connects the ICAAP directly to capital buffer decisions.

When this plumbing is in place, the ICAAP becomes a living document. The CFO consults it when pricing an acquisition or planning a capital raise. The ALCO references it when debating business growth. The board reviews it not as a compliance submission, but as a quarterly reality check on whether the institution's risk profile has drifted outside its own appetite.

What a Board-Ready Stress Testing Programme Looks Like

So what does excellence look like? The following verdict grid contrasts a stress testing programme that is genuinely useful to the board versus one that is compliance-focused:

The difference is not in technical sophistication. A "bad" programme can have excellent models and rigorous scenario calibration. The difference is whether the exercise produces consequences.

The ECB's View: SREP Penalises Passive ICAAPs

The ECB's approach to ICAAP assessment under the SREP process has become increasingly granular and unforgiving. The message is clear: a formulaic ICAAP—one that demonstrates technical compliance without genuine internal use—will attract supervisor scrutiny and potentially a capital add-on.

The ECB's SREP guidance on "Governance and Organization" (Pillar 2) explicitly emphasizes internal use as a criterion for assessing the quality of the ICAAP. The regulator is asking: Is this institution's ICAAP actually used to inform management decisions? Or is it merely a compliance artifact?

Banks that score poorly on this dimension—where the Risk Committee reviews the ICAAP but the Investment Committee does not, where stress test outputs do not inform capital planning, where the reverse stress test is not mapped to actual portfolio concentrations—increasingly face a supervisor recommendation to either improve the framework or accept a higher Pillar 2 Requirement.

This is not accidental. The ECB's increasing focus on management quality is a response to the observation that many institutions can demonstrate mathematical rigor in their models while being dangerously passive in their actual capital management. A bank can run a sophisticated Monte Carlo simulation of its loan portfolio under 10,000 economic paths, arrive at a capital estimate of 10.2%, and then allocate capital as if that number has no practical meaning. The ECB's supervisory approach—particularly under the SSM (Single Supervisory Mechanism)—is designed to catch exactly this disconnect.

The message to boards and risk committees is direct: the ICAAP is now a supervisory window into management quality. If your ICAAP is passive, your Pillar 2R will be higher. If your ICAAP is active and driving decisions, you have a case for a lower Pillar 2R or a more stable regulatory capital framework.

The Path Forward: From Ritual to Reality

Transforming an ICAAP from compliance to decision-making requires three parallel changes:

First: Reframe ownership. The ICAAP must migrate from being a Risk function document to being a CFO-CFO-CRO document. This means the ICAAP is presented to the Board Investment Committee and the Board Risk Committee jointly, not sequentially. It means the business cases for capital raises and major acquisitions are explicitly stress-tested against the ICAAP scenarios.

Second: Create feedback loops. The ICAAP should inform quarterly RAF reviews, capital planning cycles, and ALCO decisions. If the ICAAP is an annual exercise that produces outputs that are never consulted again, it has failed structurally. Build in quarterly or semi-annual re-baselines that check whether the macro scenarios remain plausible or whether the bank's risk profile has shifted materially.

Third: Make scenarios visceral. Avoid generic, textbook scenarios. Instead, calibrate scenarios to the bank's own risk drivers. For a bank with significant real estate exposure, the scenario should stress real estate fundamentals directly. For a bank with significant emerging market funding dependence, the scenario should stress external funding costs and capital flight. When scenarios are grounded in the bank's actual business model, the board finds them credible, and stress test outputs gain real behavioral weight.

Conclusion

The ICAAP is nominally a regulatory instrument. It is required by the ECB, assessed during the SREP, and used to set the Pillar 2 Requirement. But the best-run banks have learned to use the ICAAP as a strategic tool. They understand that if stress testing is done well, it reveals the concentrations and fragilities that actually limit their business. And they organize themselves—in terms of governance, capital allocation, and business strategy—around those truths.

At Ezelman, we have seen first-hand how stress testing and ICAAP frameworks can be transformed from regulatory paperwork into genuine management tools. We have redesigned these frameworks at institutions that were attracting supervisor scrutiny precisely because their ICAAP was passive. We have integrated stress test outputs into capital planning, RAF thresholds, and business strategy reviews. And we have seen how, when done correctly, the ICAAP stops being a burden and becomes a source of competitive advantage: banks that truly understand their own fragility can make smarter bets about which risks to take and which to avoid.

If your board is struggling with an ICAAP that complies on paper but fails to drive decisions, you are not alone. And you do not have to accept that state. Contact us.