ICAAP expectations and audit requirements for ICAAP and BCAR

To: DTIs using the Basel Standardized Approach to Credit Risk

OSFI last wrote to all Standardized Deposit-Taking Institutions (DTIs) on March 25, 2022, communicating our expectations for the 2022 Internal Capital Adequacy Assessment Process (ICAAP) submission and internal audit of the ICAAP and Basel Capital Adequacy Reporting (BCAR).

The purpose of this communication is to outline OSFI’s expectations with respect to the next ICAAP submission as well as submission of internal audit report relating to ICAAP.

Internal Capital Adequacy Assessment Process expectations

The next submission to OSFI of each Standardized DTI’s (including category 3 DTIs using the Simplified Risk Based approach) ICAAP will be on or before March 31, 2024 for all institutions (December and October year ends). The submission should be based on their portfolio as at fiscal year-end 2023.

OSFI recognizes that the ICAAP is, first and foremost, an internal process and should not be considered a “regulatory” exercise. As such, in internal purpose, management may still choose to prepare their ICAAP as part of their annual planning process prior to the required submission date for OSFI.

The ICAAP package for OSFI submission can utilize the scope and format used by the institution, however, the contents of the submission should have a scope that includes the elements in the attached OSFI ICAAP template.

Please note that starting with the March 31, 2024 submission, in addition to submitting the ICAAP document to the Lead Supervisor, DTIs will need to submit an ICAAP data return through RRS. The return replaces the Key Metrics Table previously required as part of the ICAAP submission. OSFI expects to make available a copy of the ICAAP data return for public consultation during August to September of 2023.

Finally, as has been the case in previous ICAAP submission cycles, the specific risks and downturn severity for the minimum required single and multiple factor stress tests to be undertaken by each institution as part of its ICAAP will be communicated directly to each institution by September 30, 2023.

Internal audit review of Internal Capital Adequacy Assessment Process

By no later than May 31, 2024, OSFI expects each institution’s Internal Audit function to provide their OSFI Lead Supervisor with a copy of the audit report on the following:

Review of the 2023 ICAAP, including a view on each of the following elements:

• comprehensiveness and appropriateness of ICAAP in the context of the institution, its operating environment, the soundness of controls underpinning it and OSFI’s expectations of a rigorous ICAAP process,
• identification of all key risks,
• effectiveness of information systems that support the ICAAP,
• appropriateness of the measurement methodology employed to support the ICAAP assessment and the accuracy and completeness of data input,
• reasonableness of ICAAP output and assumptions used,
• reasonableness and appropriateness of stress testing and analysis of assumptions,
• integration of ICAAP results and risk management (e.g., limit setting and monitoring), and
• reasonableness of the capital plan and internal capital targets.

Should you have any questions or concerns, please contact your OSFI Lead Supervisor.

Yours sincerely,

Amar Munipalle
Executive Director Risk Advisory Hub, Supervision