ICAAP and ILAAP Reports: Key Insights and Recommendations

BY MR. J. Y. MAMMAN PROJECT MANAGER, BASEL II/III IMPLEMENTATION, CBN AT THE SEPTEMBER, 2017 QUARTERLY GENERAL MEETING OF THE CHIEF AUDIT EXECUTIVES OF BANKS IN NIGERIA

Objective Introduction Documenting the ICAAP and ILAAP The Supervisory Review and Evaluation Process Recommendation Conclusion

To use the opportunity provided by the Quarterly Meeting of Audit Executives of Banks in Nigeria to: Discuss the minimum expectations of Regulators regarding the content of ICAAP report. To discuss issues in Liquidity Risk Management using ILAAP

The Basel II Capital Accord is structured on three mutually reinforcing pillars. Pillar 1 sets out the mechanism for calculating the minimum regulatory capital Pillar 2 provides the regulatory authorities with tools to assess the completeness and adequacy of each bank s capital vis- -vis the risks that it faces Pillar 3 details the obligations of banks to disclose information on risks and capital adequacy to all stakeholders.

processes for assessing and maintaining on an on- going basis adequate capital to support all the material risks that a bank is exposed to ICAAP processes for assessing the liquidity and funding risks and ensuring that liabilities are met in both normal and stressed scenarios over a period of time ILAAP

The ICAAP and ILAAP are key management inputs used by regulators for SREP. Our experience in carrying out the SREP shows that there is considerable improvement in the quality and use of the ICAAP report by banks. Our presentation of the paper on Documenting the ICAAP and ILAAP Reports opportunity for us to share with you our minimum expectations regarding the contents of ICAAP and ILAAP as complimentary supervisory tools to ensure safety and stability of banks. Documenting the ICAAP and ILAAP Reports provides an

ICAAP SPECIFIC INFORMATION At a minimum, the ICAAP report shall be organized into the areas specified in Annex B of the Guidance Note. ICAAP SPECIFIC INFORMATION The report should provide more specific details on the following issues: Governance of ICAAP and Data Quality Business Model and Strategy Risk Identification and Materiality Assessment Risk Appetite Framework Quantification of Pillar 2 Capital Stress Testing Framework Capital Planning and Management Process Role of ICAAP in Decision Making Internal Audit Review of ICAAP

Governance and Data Quality The ownership of ICAAP banks. The Board and senior management are responsible for putting in place an appropriate ICAAP commensurate with the bank s risk profile, business plan and analysis of bank s current and future capital needs. Governance and Data Quality ownership of ICAAP lies with the Board of Directors of The ICAAP must form and decision-making process The Board should approve a ICAAP . Information on the data quality completeness, accuracy, consistency, timeliness, validity and traceability of data should be included in the report. ICAAP must form an integral p an integral part of the management approve all the key elements of the data quality framework that ensures

Business Model and Strategy Banks are expected to document their strategies and processes for assessing and maintaining on an on going basis the amount, type and distribution of internal capital that is adequate to cover the risks they are exposed to. Risk Identification and Materiality Assessment The report should show that the banks periodically and identify those considered to be material or not material. Business Model and Strategy Risk Identification and Materiality Assessment periodically assess the risks they are exposed to material or not material.

Risk Appetite Framework The report of the Risk Appetite Framework should show the relationship between the risks and is integrated into business planning, capital allocation, performance management and Board reporting processes. The bank s risk appetite metrics should be quantitative, specific and measurable ensure effective management of the bank s risk profile. Quantification of Pillar 2 Capital The design of the ICAAP should be comprehensive and provide for identification, measurement and reporting of all the material risks faced by the bank. Risk Appetite Framework risks undertaken undertaken and the chosen the chosen strategy strategy. It should also reflect how it quantitative, specific and measurable for key risks to Quantification of Pillar 2 Capital

Stress The ICAAP report should incorporate rigorous, forward-looking stress testing that identifies possible events or changes in market conditions that could adversely impact the institutions It should also consider future capital resources and capital requirements under adverse Banks should justify the basis of its assumptions appropriateness of the severity level. Stress Testing Framework Testing Framework could adversely impact the institutions future capital resources and capital scenarios. justify the basis of its assumptions and the requirements under adverse scenarios. Capital Bank s are expected to document their capital plans with their The internal capital should be of good quality. The report should include capital planning for at least three- years and use of stress test in projecting for the future capital needs. Capital Planning and Management Process Planning and Management Process document their capital plans and relate it capital needs. and relate it with their capital needs.

Role Banks should demonstrate in the reports that the ICAAP process is fully embedded within the bank including the role of ICAAP in decision making. Role of ICAAP in Decision Making of ICAAP in Decision Making fully embedded within the bank Internal Audit Review of ICAAP ICAAP and its review process should be subject to periodic and independent review external parties to ensure its reasonableness and the accuracy of the data and stress scenarios used. Internal Audit Review of ICAAP periodic and independent review by internal and or The frequency of the internal audit review process as well as the methodologies adopted and review by external parties should also be documented. documented.

The CBN has not issued guidelines for ILAAP to banks in Nigeria. Your interest however, shows that you are passionate about ensuring that your respective institutions put measures in place to properly address their liquidity and funding risks. As you put measures in place to prepare ILAAP and or manage liquidity risks for your banks, remember that you are to be guided by the sound principles of liquidity risk management and are to comply with the minimum liquidity ratio prescribed by the CBN from time to time and also ensure the effectiveness of your Liquidity Contingency Funding plans.

Generally, ILAAP as with ICAAP, is an internal document and remains a bank s responsibility to design and implement it in a proportionate manner. It should however, contain information at a minimum on the following: Governance Use of ILAAP Liquidity Contingency Plan Risk Identification and Measurement Liquidity Buffers and Source of Funding ILAAP Assumptions and Risk Quantification methodologies Regular Stress Testing Internal Review and Validation It may hopefully be expected that banks should at least once in a year be required to provide a clear statement on the adequacy or otherwise of their liquidity condition.

The assessment of ICAAP and ILAAP are important in the Supervisory Review and Evaluation Process (SREP) which is the Second Pillar of Basel II Accords. It ensures that banks have adequate capital and liquidity to support all the material risks in their businesses and that they use better risk management techniques to monitor and manage these risks. With ILAAP, the SREP was widened to include liquidity adequacy assessment.

Pillar 2 process is underpinned by the following four (4) principles: 1. Banks should have a process for assessing their overall capital adequacy relation to their risk profile and a strategy for maintaining their capital level. process for assessing their overall capital adequacy in Supervisors should review and evaluate banks internal capital adequacy assessments and strategies, as well as their ability to ensure compliance regulatory capital ratios. Supervisors should take appropriate supervisory action review and evaluate banks internal capital adequacy take appropriate supervisory action if they are not satisfied with the results of this process. 2. ensure compliance with Supervisors should expect banks to operate above the minimum regulatory capital and should be able to require banks to hold capital in excess of this minimum. expect banks to operate above the minimum regulatory 3. Supervisors should seek to intervene at an early stage from falling below the minimum levels required to support the risk profile of a bank or (b) to require rapid remedial action if capital is not maintained or restored. seek to intervene at an early stage (a) to prevent capital 4. Banks liquidity management practices should be guided by the principles for sound liquidity risk management .

As internal audit executives, you will and or may be required to provide quality assurance and or independent review of the ICAAP and ILAAP with respect to risk management functions, etc. this will include providing: A concise and explicit statement and liquidity which at a minimum will provide an ; a) Explicit definition of internal capital definition and its adequacy now and in the future b) Show the relevant outcomes of internal capital assessment for the foreseeable future c) State the liquidity and funding position of the bank that is consistent with the risk appetite and its strategy, It should also include comments o organization, risk appetite, adequacy, integrity, approval and maintenance of any risk models, etc. Assessment of the effectiveness reporting functions interact to produce timely, reliable, and relevant reports for all the stakeholders. risk management, capital and liquidity capital and liquidity, regulatory and reporting regulatory and reporting concise and explicit statement on the quality and adequacy of capital comments on the risk management processes- effectiveness of the processes by which the risk and

The ICAAP (and ILAAP?) reports should be detailed document(s amount of analysis; written in a clear and concise manner. Appropriate cross-referencing to internal policies and frameworks and attachment of relevant schedules to aid the understanding of the analysts. At a minimum, for now, the ICAAP report shall be organized into the areas specified in Annex B of the Guidance Note. detailed document(s), covering considerable clear and concise manner. aid the understanding of the analysts.

The recent financial crisis has reinforced the importance of further reforms in the Basel standards, which led to the introduction of the liquidity standards to strengthen capital and liquidity regulations to promote more resilient banks. Many banks despite adequate capital resources still experienced difficulties because they did not manage their liquidity in a sound and prudent manner. The ICAAP and ILAAP are used by supervisors as tools for sound risk management practices that will ensure that banks have sufficient internal capital and liquidity buffers at all times to cover the risks that they take. The introduction of the ILAAP to complement the ICAAP, if properly implemented will certainly improve the resilience of our banks in Nigeria. It is on this note, that we want to use this medium to thank the Association of Chief Audit Executives of Banks in Nigeria who are critical stakeholders for this initiative. We long forward to more future collaboration on similar activities for the mutual benefit of the entire financial system.