5.6 Risk management framework

Competent authorities should assess whether the investment firm has established an appropriate risk management framework and risk management processes. Competent authorities should review at least:

• a. the risk strategy, risk appetite and risk management framework;
• b. the ICARAP framework;
• c. sensitivity to cyclical economic fluctuations.

5.6.1 Risk management framework, risk appetite and strategy

When assessing the risk management framework, competent authorities should consider the extent to which it is embedded in, and how it influences, the overall strategy of the investment firm. Competent authorities should, in particular, assess if there are appropriate and consistent links between the business strategy, the risk strategy, risk appetite and risk management framework, and the capital and liquidity management frameworks.

When reviewing the risk strategy, risk appetite and risk management framework of an investment firm, competent authorities should assess at least whether:

• a. investment firms have a holistic investment firm-wide risk management framework extending across all the organisation, recognising fully the economic substance of all its risk exposures including the risks the investment firm poses to itself, its customers and markets and liquidity risk in particular those which can have a material impact on or deplete the level of own funds available;
• b. the risk management framework encompasses all relevant risks with appropriate consideration of both financial and non-financial risks;
• c. the investment firm when identifying and measuring or assessing risks, not only uses quantitative assessment methodologies (including stress testing), but also qualitative risk assessment tools (including expert judgement and critical analysis);
• d. there is effective risk reporting involving sound internal consideration and communication of risk strategy and relevant risk data, both horizontally across the investment firms and up and down the management chain;
• e. the investment firm’s risk management framework includes policies, procedures, risk limits and risk controls ensuring adequate, timely and continuous identification, measurement or assessment, monitoring, management, mitigation and reporting of the risks at the business line, at the investment firm level and, where relevant, at consolidated level;
• f. the risk strategy and risk appetite translate all material risks into specific risk limits;
• g. the risk strategy and appetite appropriately consider the risk appetite and financial resources of the investment firm and take into account supervisory own funds and liquidity requirements and other supervisory measures and requirements;
• h. the investment firm has established processes for the approval of decisions on which the compliance function or, where relevant, the risk management function, have expressed a negative view.

5.6.2 Framework for Internal capital adequacy assessment process and internal risk-assessment process (ICARAP)

Competent authorities should assess whether investment firms, which are not small and non-interconnected investment firms according to Article 12 of Regulation (EU) 2019/2033 or for which competent authorities exercised the discretion envisaged in the second subparagraph of Article 24(2) of Directive (EU) 2019/2034, at individual level, or investment firms groups, at consolidated level, have sound, effective and comprehensive arrangements, strategies and processes in place to assess and maintain on an ongoing basis the amounts, types and distribution of internal capital and liquid assets that they consider adequate to cover the nature and level of risks which they may pose to others and to which the investment firms themselves are or may be exposed to. Such arrangements, strategies and processes should be part of an internal capital adequacy and internal-risk assessment process that may be further split into an internal capital adequacy assessment process (ICAAP) and an internal liquidity adequacy assessment process (ILAAP).

In the case of investment firms which meet the conditions for qualifying as small and non-interconnected investment firms set out in Article 12(1) of Regulation (EU) 2019/2033 being requested by their competent authorities to apply the requirements according to Article 24(2) of Directive (EU) 2019/2034, the competent authorities should perform the assessment as deemed appropriate.

These assessments should contribute to the determination of additional own funds requirement and the assessment of capital adequacy as outlined in Title 7 as well as to the evaluation of liquidity adequacy as outlined in Title 9.

Soundness of the ICARAP

When assessing the soundness of the ICARAP, competent authorities should assess, where relevant distinguishing between the ICAAP and the ILAAP, whether:

• a. the arrangements, strategies and processes constituting the ICARAP are appropriate and proportionate to the nature, size and complexity of the investment firm’s activities;
• b. the arrangements, strategies and processes constituting the ICARAP are regularly reviewed by the investment firm;
• c. methodologies and assumptions applied by investment firms are appropriate and grounded in solid empirical input data;
• d. whether the confidence level is consistent with the risk appetite;
• e. whether the definition and composition of available internal capital or liquidity resources considered by the investment firm for the ICARAP is consistent with the risks measured by the investment firm and are eligible for the calculation of own funds and liquidity buffers.

Effectiveness of the ICARAP

When assessing the effectiveness of the ICARAP, competent authorities should assess, where relevant distinguishing between the ICAAP and ILAAP, whether:

• a. the investment firm considers the ICARAP and its results in the decision-making and management processes at all levels in the investment firm;
• b. the investment firm uses the ICARAP and its results in its risk, capital and liquidity management;
• c. the investment firm has policies, procedures and tools to facilitate:
• i. clear identification of the functions and/or relevant committees responsible for the different elements of the ICARAP;
• ii. capital and liquidity planning: the calculation of capital and liquidity resources on a forward-looking basis in connection with the overall strategy or significant transactions;
• iii. the allocation and monitoring of capital and liquidity resources among business lines and risk types, notably by defining risk limits for business lines, entities or individual risks that are consistent with the objective of ensuring the overall adequacy of the investment firm’s internal capital and liquidity resources;
• iv. the regular and prompt reporting of capital and liquidity adequacy to senior management and to the management body;
• v. senior management or management body awareness and actions where business strategy and/or significant individual transactions may be inconsistent with the ICAAP and available internal capital or with the ILAAP and available internal liquidity resources;
• d. whether the management body demonstrates appropriate commitment to and knowledge of the ICARAP and its outcomes; and
• e. the ICARAP is forward-looking in nature by assessing the consistency of internal capital and liquidity assets with strategic plans. Comprehensiveness of the ICARAP

Competent authorities should assess the appropriateness of the ICARAP’s coverage of the investment firm’s business model, business lines, activities and legal entities. On the basis of this assessment, competent authorities should assess the appropriateness of the ICARAP’s identification and assessment of risks to which the investment firm is or may be exposed or pose to others, and the ICARAP’s compliance with legal requirements. In particular, they should assess:

• a. whether the ICARAP is implemented homogenously and proportionately for all the relevant investment firm’s business lines, activities and legal entities with respect to risk identification and assessment;
• b. where any entity has different internal governance arrangements or processes from the other entities of the group, whether these deviations are justified. The adoption of advanced models by only part of the group may be justified by a lack of sufficient data to estimate parameters for some business lines, activities, or legal entities, provided that these business lines, activities, or legal entities do not represent a source of risk concentration for the rest of the portfolio.

5.6.3 Investment firm’s assessment of cyclical economic fluctuations

Competent authorities should assess whether the investment firms perform a comprehensive assessment of the risks which are material to their business and operating model, to the composition of their portfolio or to their trading strategies. This should include an assessment of these risks in the context of cyclical economic fluctuations and of the impact such fluctuations may have on the investment firms’ ability to meet its own funds requirements, to fund its ongoing business operations or to orderly wind-down.

Competent authorities should assess whether investment firms performing activities referred to in point (3) or (6) of Section A of Annex I to Directive 2014/65/EU conduct more in-depth assessment using stress test(s) or sensitivity analysis, expecting them to reflect a scope and level of sophistication appropriate to the nature, scale, and complexity of the investment firms’ activities.

Competent authorities should review investment firms’ assessments of cyclical economic fluctuations, if relevant in the form of stress testing or sensitivity analyses, and their outcomes. Where, on the basis of such review, the investment firm’s assessments of the impacts of cyclical economic fluctuations are sufficiently reliable, the results of such review should inform the assessment of various SREP elements, in particular:

• a. the identification of possible deficiencies in overall governance arrangements or investment firm-wide controls identified during the review should be taken into account;
• b. the identification of relevant business vulnerabilities that should be taken into consideration when assessing investment firms’ business model viability and sustainability of their strategies in accordance with Title 4;
• c. the identification of possible vulnerabilities or weaknesses in risk management and controls on individual risk areas identified during the review should be taken into account by the competent authorities when assessing individual risks to capital as referred to in Title 6, or risks to liquidity as referred to in Title 8; and
• d. the potential determination of guidance on additional own funds (P2G), revised capital planning and other measures as set out in Titles 7 and 10.

For investment firms performing activities referred to in point (3) or (6) of Section A of Annex I to Directive 2014/65/EU, when assessing stress tests or sensitivity analyses, and their results, competent authorities should pay specific attention to the following:

• a. the appropriateness of the selection of the scenarios, which should be relevant to the investment firm’s business model or individual business lines or portfolios and the market in which it operates;
• b. the underlying assumptions, methodologies and risk drivers, including the scenario severity;
• c. the coverage of material risks and vulnerabilities identified, and their impact on the ability of the investment firms to generate profit and maintain adequate capital requirements; and
• d. the use of their results, before and after taking into account relevant management actions, in the investment firm’s risk and strategic management.

When assessing stress tests and sensitivity analyses and their results in the case of cross-border groups, competent authorities should consider the transferability of capital and liquidity between the legal entities or business units during stressed conditions, as well as the functioning of any established intra-group financial support arrangements, taking into account the funding difficulties that might be expected in stressed conditions.

If competent authorities identify deficiencies in the design of the assessment of cyclical economic fluctuations, or, where relevant, in the design of the scenarios or assumptions used by investment firms for stress testing or sensitivity analyses, they may require investment firms respectively to re-perform or re-run their analyses, or some specific parts using modified assumptions provided by the competent authorities, or specific prescribed scenarios.