8. ICAAP and ILAAP conclusions and quality assurance

Competent authorities should ensure that they receive from institutions conclusions of the internal capital and liquidity adequacy assessments and their impact on the risk and overall management of an institution, including:

• a. summary of main conclusions on ICAAP and ILAAP in order to form a concise view on the current capital and liquidity position of the institution, its capacity to cover the risks to which it is or might be exposed, and any measures planned by it to ensure that capital and liquidity remain at, or are restored to, adequate levels in the near future;
• b. material changes (made or planned) to the risk management framework based on ICAAP or ILAAP results;
• c. material changes (made or planned) to business models, strategies or risk appetite frameworks based on ICAAP or ILAAP results, including management actions (e.g. changes of risk positions);
• d. material changes (made or planned) to the ICAAP and ILAAP frameworks, including improvements to be introduced following the observation of internal validations, internal audit reports and the outcomes of the dialogue with the competent authorities.

Competent authorities should ensure that the information specified in the previous paragraph should have approval from the pertinent body within the governance framework responsible for ICAAP and ILAAP and should be accompanied by a specific timeline associated with the planned changes.

Competent authorities should also receive from institutions adequate explanation of how institutions ensure that the ICAAP and ILAAP frameworks and models used provide reliable results (e.g. validation concepts, validation reports) and a description of both the internal validation approach (process, frequency) and the validation content, where available. In particular, competent authorities should receive from institutions all available results of the internal validations/reviews of ICAAP and ILAAP methodologies and calculation outcomes performed by the independent validation function.

Competent authorities should also receive from institutions their internal audit reports covering ICAAP and ILAAP.