4.1 Stress testing programme

Institutions should have in place a stress testing programme that should cover at least the following:

• a) the types of stress testing and their main objectives and applications;
• b) the frequency of the different stress testing exercises;
• c) the internal governance arrangements including well-defined, transparent and consistent lines of responsibility and procedures;
• d) in the case of a group, the scope of the entities included and the coverage (e.g. risk types and portfolios) of the stress tests;
• e) the relevant data infrastructure;
• f) the methodological details, including models used and possible links between liquidity stress tests and solvency stress tests, namely the magnitude of such dynamic interactions and the capture of feedback effects;
• g) the range of assumptions, including business and managerial, and remedial actions envisaged for each stress test.

Parent institutions in a Member State and EU parent institutions should also develop a group stress testing programme to be approved and monitored by the management body and implemented by their senior management in the context of their centralised risk management policy. A group stress testing programme should include and address, to the extent appropriate, all institutions subject to prudential consolidation.

The institutions within the scope of prudential consolidation should, when establishing their individual stress testing programmes, take into account the relevant group stress testing programme.

Institutions should also include reverse stress testing and reverse stress testing scenarios in their stress testing programmes.

Institutions should ensure that their stress testing programmes are workable and feasible and that they inform decision-making at all appropriate management levels about all existing and potential material risks.

Institutions should regularly assess their stress testing programmes to determine their effectiveness and robustness, and should update them as appropriate. The assessment should be made on at least an annual basis and on the basis of both a quantitative and a qualitative analysis, and should fully reflect the changing external and internal conditions. Institutions should ensure that the frequency of assessments takes into account the frequency of the corresponding stress test applications.

Institutions should ensure that their quantitative analysis in accordance with the previous paragraph includes sound quantitative tests as backtesting tools to validate the assumptions, parameters and results of stress testing models (e.g. credit risk models, market risk models, pre-provision net revenue models). Institutions should ensure that their qualitative analysis in accordance with the previous paragraph is based on expert judgements or benchmarking assessments.

When assessing the stress testing programme, the institution shall consider at least the following:

• a) the effectiveness of the programme in meeting its intended purposes;
• b) the need for improvements;
• c) the identified risk factors, definitions and reasoning for relevant scenarios, model assumptions and the sensitivity of results to these assumptions, as well as the role of expert judgement to ensure that it is accompanied by sound analysis;
• d) the model performance, including its performance on out-of-sample data, i.e. on data that was not used for model development;
• e) how to incorporate possible solvency-liquidity adverse loops;
• f) the adequacy of possible interlinkages between solvency stress tests and liquidity stress tests;
• g) feedback received from competent authorities in the context of their supervisory or other stress tests;
• h) the adequacy of the data infrastructure (systems implementation and data quality);
• i) the proper level of involvement of senior management and the management body;
• j) all assumptions including business and/or managerial assumptions, and management actions envisaged, based on the purpose, type and result of the stress testing, including an assessment of the feasibility of management actions in stress situations and a changing business environment; and
• k) the adequacy of the relevant documentation.

The institution’s stress testing programme should be appropriately documented for all types of stress tests carried out at the single risk type and/or portfolio level, as well as the firm-wide level. Documentation should cover at least:

• a) the stress testing approach;
• b) the possible interlinkages between solvency stress tests and liquidity stress tests, namely a mapping between the deterioration on capital position (solvency) and ability to issue commercial paper and bonds (liquidity), macro-driven probabilities of default shifts (solvency) and the implied rating migration of banks unencumbered assets and the effect on collateral deposited at the relevant central bank (liquidity), the increase in expected non-performing loans (solvency) and the reduction in expected inflows from loan repayments or from non-financial corporation bonds (liquidity), or a possible liquidity gap (liquidity) and asset fire sales (solvency), and an increase in funding costs (liquidity) and P&L effects (solvency);
• c) the roles and responsibilities as determined in the internal policy, specifying the roles for the second and third lines of defence, and processes for at least the performance of the stress testing programme;
• d) a description of the entire process of designing, approving, performing, monitoring the performance and periodically assessing the stress testing programme and its outcomes;
• e) a description of the processes for evaluating stress test outcomes, including details of areas that require manual or human judgemental in some parts, and also of the process for using the results for informing management actions and the strategy of the institution; and
• f) a description and inventory of the relevant IT applications used for stress testing (and where a central inventory exists, reference can be made to it).

The stress testing programme should be challenged across the organisation, for instance by the risk committee and internal auditors. Business units not responsible for the design and application of the programme and/or non-involved external experts should play a key role in the assessment of this process, taking into account the relevant expertise for specific subjects.

Institutions should ensure, both for the initial design and for the assessment of the stress testing programme, that an effective dialogue has taken place with the involvement of experts from all business areas of the institution and that the programme and its updates have been properly reviewed by the senior management⁴ and management body of the institution, who are also responsible for monitoring its execution and oversight.

⁴ See also Title II, section 1, of the EBA Guidelines on Internal Governance.