Banks have to convince SAMA that their ICAAP process is comprehensive, rigorous and includes capital commensurate with their risk profile as well as strategic and operational planning. The banks must compose and assemble the specific ICAAP process and methodology based on the objective and requirements imposed by SAMA and on the specific strategic and operational plans set by their Board of Directors. Consequently, banks must have a clear understanding on SAMA's expectations in terms of the definitions, concepts and benchmarks in order for an effective assessment and follow-up by it. An important and obvious example is the manner in which both the risks and the capital are defined.

SAMA is responsible for establishing the frequency and nature of the review, while the Banks are to establish their actual implementation processes and methodology as per SAMA's guidelines.

Thus, while the two processes involved are closely integrated through the Supervisory Review Process, at the same time there is an express division of responsibilities. SAMA's role has the final word in this process as it makes its risk assessment of the banks and, where reason exists, imposes additional requirements on the banks or requires enhanced risk management systems, additional stress testing, etc.

One of the alternative courses of action available to SAMA is to establish a higher capital requirement than that calculated by the bank itself. The level of capital needed is based on the calculation of the capital requirement with respect to credit, market and operational risks based on the explicitly established calculation rules which are laid down within the scope of Pillar 1. However, a supplement could be required as additional capital which, in light of other types of risks (Pillar 2), which may arise within the scope of the internal capital adequacy assessment process. Consequently, this is not the only tool (to set a higher capital requirement) and it will not necessarily be the first choice, in that capital should not be a substitute for adequate risk management. On the other hand, a demand for more capital may be justified even for those banks with high, but well-managed risk exposures.

Interest rate risk in the banking book:

The measurement process should include all material interest rate positions of the bank and consider all relevant repricing and maturity data. Such information will generally include current balance and contractual rate of interest associated with the instruments and portfolios, principal payments, interest reset dates, maturities, the rate index used for repricing, and contractual interest rate ceilings or floors for adjustable-rate items. The system should also have well-documented assumptions and techniques.

Regardless of the type and level of complexity of the measurement system used, bank management should ensure the adequacy and completeness of the system. Because the quality and reliability of the measurement system is largely dependent on the quality of the data and various assumptions used in the model, management should give particular attention to these items.

(Refer to Paragraph 739-740 of International Convergence of Capital Measurement and Capital Standards – June 2006)

Liquidity risk: Liquidity is crucial to the ongoing viability of any banking organization. Banks’ capital positions can have an effect on their ability to obtain liquidity, especially in a crisis. Each bank must have adequate systems for measuring, monitoring and controlling liquidity risk. Banks should evaluate the adequacy of capital given their own liquidity profile and the liquidity of the markets in which they operate.

(Refer to Paragraph 741 of International Convergence of Capital Measurement and Capital Standards – June 2006)

^* Other risks not specifically covered here are described in component 2 of the Document under item #4.3.

It is important that an internal capital adequacy assessment process, as an activity, remains the responsibility of senior management and the Board.

In this regard, the board of directors and senior management must be clearly involved in its development, the process itself, and its integration into the ongoing operations and planning. The Board should ensure that the ICAAP is embedded in the bank's business and organizational processes. The Board's responsibility in the ICAAP process must be documented and clarified throughout the organisation.

The requirement regarding documentation is very significant. This is because in order to be able to evaluate the process it must be verifiable and it is possible for both the banks and SAMA to do a follow-up. Further, the manner in which the process is conducted as well as the decisions to which it leads to must be set forth in business plans, the board's rules of procedure, the minutes, as well as in various strategy and policy documents.

The ICAAP should form an integral part of the management process and of a decision-making culture, and it should be reviewed regularly by a bank's board or the board's executive committee. SAMA requires that this must take place at least once a year. Additionally, the internal capital adequacy assessment process must be reviewed and a document submitted when significant changes have taken place, whether in relation to the bank's own decisions or external changes. The fist formal ICAAP should be for the year 31.12.2008 and should be submitted to SAMA by 31 January 2009.

Also, in this regard, for a bank which operates in a number of financial sectors and perhaps also in various national markets, it may require a review of the ICAAP more frequently than once a year. SAMA will inform these Banks where a submission other than the annual submission is required. Consequently, for banks that operate within a single and simpler market segments, and where no dramatic changes take place in the market structure, a yearly review may represent an acceptable frequency.

The ICAAP should be risk based, comprehensive, forward-looking and take into consideration a bank's strategic plans and external changes. Further, it should also be based on an adequate measurement and assessment processes.

The basis of the internal capital adequacy assessment process lies in the measurement of a bank's minimum capital requirements which is the product of the calculated assessment of credit risks, market risks and operational risks which take place within the scope of Pillar 1 and all relevant Pillar 2 risks. Additional capital may also be required as a result of stress testing results, additional infrastructure expenditures and human resource, i.e. hiring of senior level executives. The internal capital adequacy assessment process challenges banks that they must take a broader approach and perspective of assessing other risks. Also, included are circumstances which affect the bank's total risk profile and which the management must analyze and form conclusions on their effects on the total capital requirements.

In this respect materiality is an aspect, i.e. large risk exposure - large risk management requirement - large capital requirement, and vice versa. However, it is important to understand that all banks - large as well as small, complex and non-complex - must comply with SAMA requirements.

Assessments of risks may be made both by using very sophisticated methods, models and also using perhaps simpler measures, and methods. What is appropriate and relevant is determined by the banks operations in question. In case of a large bank, it might be natural to use extensive stress tests which provide quantitative measurements of the impact due to a specified disruption. Generally, larger banks have external analyses with respect to economic and business cycles and financial market trends, including the use of economic capital models and measurements. This type of approach can constitute an important element of the internal capital adequacy assessment process. However, it is limited by the fact that generally it only deals with risks that are quantifiable.

It follows, therefore, it is not necessary for a bank with less complex operations to employ complicated model involving advanced analysis leading to economic capital requirements. However, for a small bank, the most important issue is to assess the effect of, for example, loosing its three largest customers, or an economic sector where the bank has considerable exposure having major problems, as well as consequence of the closure of a large customer.

Should a Bank utilize models relevant and appropriate disclosure of the model such as its generic name, application or use within the risk management process, validation results, internal logic, should be provided.

The ICAAP should produce a reasonable outcome vis-à-vis capital requirements. The process involves weighing together the importance of the risks which a bank encounters, the extent to which it exposes itself to these risks, and how it organizes itself and works in order to address them. This "bottom line" can crystallize into a minimum amount of capital after discussion with SAMA, as well as additional control systems necessary to cover the risks the bank is exposed to.

While capital requirements constitute a minimum requirement, banks in their interest operate above this minimum level as a consequence of their strategic objectives. The reason for this includes higher rating and thereby lower funding costs. It also provides a freedom of action in connection with corporate acquisitions, as well as in the event of losses which may arise due to a rapid and serious downturn in the economy. Consequently, banks, as well as SAMA, expect that bank capital stays above the minimum level.

Generally, if a bank's internal capital adequacy assessment process result in an assessed level of required capital which is the same, or below, the minimum as determined under the Pillar 1, this is an indication that the internal capital adequacy assessment process has not functioned in a satisfactory manner.