SAMA'S Guideline Document on the Internal Capital Adequacy Assessment Plan (ICAAP)

Documentation and Corporate Governance in the ICAAP Process The requirement regarding documentation is very significant. This is because in order to be able to evaluate the process it must be verifiable and it is possible for both the banks and SAMA to do a follow-up. Further, the manner in which the process is conducted as well as the decisions to which it leads to must be set forth in business plans, the board's rules of procedure, the minutes, as well as in various strategy and policy documents. 5.4 Frequency of ICAAP Review The ICAAP should form an integral part of the management process and of a decision-making culture, and it should be reviewed regularly by a bank's board or the board's executive committee. SAMA requires that this must take place at least once a year. Additionally, the internal capital adequacy assessment process must be reviewed and a document submitted when significant changes have taken place, whether in relation to the bank's own decisions or external changes. The fist formal ICAAP should be for the year 31.12.2008 and should be submitted to SAMA by 31 January 2009. Also, in this regard, for a bank which operates in a number of financial sectors and perhaps also in various national markets, it may require a review of the ICAAP more frequently than once a year. SAMA will inform these Banks where a submission other than the annual submission is required. Consequently, for banks that operate within a single and simpler market segments, and where no dramatic changes take place in the market structure, a yearly review may represent an acceptable frequency. 5.5 Risk Based and Comprehensive The ICAAP should be risk based, comprehensive, forward-looking and take into consideration a bank's strategic plans and external changes. Further, it should also be based on an adequate measurement and assessment processes. The basis of the internal capital adequacy assessment process lies in the measurement of a bank's minimum capital requirements which is the product of the calculated assessment of credit risks, market risks and operational risks which take place within the scope of Pillar 1 and all relevant Pillar 2 risks. Additional capital may also be required as a result of stress testing results, additional infrastructure expenditures and human resource, i.e. hiring of senior level executives. The internal capital adequacy assessment process challenges banks that they must take a broader approach and perspective of assessing other risks. Also, included are circumstances which affect the bank's total risk profile and which the management must analyze and form conclusions on their effects on the total capital requirements. In this respect materiality is an aspect, i.e. large risk exposure - large risk management requirement - large capital requirement, and vice versa. However, it is important to understand that all banks - large as well as small, complex and non-complex - must comply with SAMA requirements.