It is important that an internal capital adequacy assessment process, as an activity, remains the responsibility of senior management and the Board.

In this regard, the board of directors and senior management must be clearly involved in its development, the process itself, and its integration into the ongoing operations and planning. The Board should ensure that the ICAAP is embedded in the bank's business and organizational processes. The Board's responsibility in the ICAAP process must be documented and clarified throughout the organisation.

The requirement regarding documentation is very significant. This is because in order to be able to evaluate the process it must be verifiable and it is possible for both the banks and SAMA to do a follow-up. Further, the manner in which the process is conducted as well as the decisions to which it leads to must be set forth in business plans, the board's rules of procedure, the minutes, as well as in various strategy and policy documents.

The ICAAP should form an integral part of the management process and of a decision-making culture, and it should be reviewed regularly by a bank's board or the board's executive committee. SAMA requires that this must take place at least once a year. Additionally, the internal capital adequacy assessment process must be reviewed and a document submitted when significant changes have taken place, whether in relation to the bank's own decisions or external changes. The fist formal ICAAP should be for the year 31.12.2008 and should be submitted to SAMA by 31 January 2009.

Also, in this regard, for a bank which operates in a number of financial sectors and perhaps also in various national markets, it may require a review of the ICAAP more frequently than once a year. SAMA will inform these Banks where a submission other than the annual submission is required. Consequently, for banks that operate within a single and simpler market segments, and where no dramatic changes take place in the market structure, a yearly review may represent an acceptable frequency.

The ICAAP should be risk based, comprehensive, forward-looking and take into consideration a bank's strategic plans and external changes. Further, it should also be based on an adequate measurement and assessment processes.

The basis of the internal capital adequacy assessment process lies in the measurement of a bank's minimum capital requirements which is the product of the calculated assessment of credit risks, market risks and operational risks which take place within the scope of Pillar 1 and all relevant Pillar 2 risks. Additional capital may also be required as a result of stress testing results, additional infrastructure expenditures and human resource, i.e. hiring of senior level executives. The internal capital adequacy assessment process challenges banks that they must take a broader approach and perspective of assessing other risks. Also, included are circumstances which affect the bank's total risk profile and which the management must analyze and form conclusions on their effects on the total capital requirements.

In this respect materiality is an aspect, i.e. large risk exposure - large risk management requirement - large capital requirement, and vice versa. However, it is important to understand that all banks - large as well as small, complex and non-complex - must comply with SAMA requirements.

Assessments of risks may be made both by using very sophisticated methods, models and also using perhaps simpler measures, and methods. What is appropriate and relevant is determined by the banks operations in question. In case of a large bank, it might be natural to use extensive stress tests which provide quantitative measurements of the impact due to a specified disruption. Generally, larger banks have external analyses with respect to economic and business cycles and financial market trends, including the use of economic capital models and measurements. This type of approach can constitute an important element of the internal capital adequacy assessment process. However, it is limited by the fact that generally it only deals with risks that are quantifiable.

It follows, therefore, it is not necessary for a bank with less complex operations to employ complicated model involving advanced analysis leading to economic capital requirements. However, for a small bank, the most important issue is to assess the effect of, for example, loosing its three largest customers, or an economic sector where the bank has considerable exposure having major problems, as well as consequence of the closure of a large customer.

Should a Bank utilize models relevant and appropriate disclosure of the model such as its generic name, application or use within the risk management process, validation results, internal logic, should be provided.

The ICAAP should produce a reasonable outcome vis-à-vis capital requirements. The process involves weighing together the importance of the risks which a bank encounters, the extent to which it exposes itself to these risks, and how it organizes itself and works in order to address them. This "bottom line" can crystallize into a minimum amount of capital after discussion with SAMA, as well as additional control systems necessary to cover the risks the bank is exposed to.

While capital requirements constitute a minimum requirement, banks in their interest operate above this minimum level as a consequence of their strategic objectives. The reason for this includes higher rating and thereby lower funding costs. It also provides a freedom of action in connection with corporate acquisitions, as well as in the event of losses which may arise due to a rapid and serious downturn in the economy. Consequently, banks, as well as SAMA, expect that bank capital stays above the minimum level.

Generally, if a bank's internal capital adequacy assessment process result in an assessed level of required capital which is the same, or below, the minimum as determined under the Pillar 1, this is an indication that the internal capital adequacy assessment process has not functioned in a satisfactory manner.