ICAAP Maturity · Risk Governance (COBAC ICAAP Instruction)
Your ICAAP framework measured requirement by requirement, translated into a costed action plan.
10 themes, a 5-level scale. And the action that moves each level to the next.
The framework’s 10 themes, already written from L1 to L5. One company, one business unit, or 300 at once.
ICAAP Maturity · Risk Governance (COBAC ICAAP Instruction)
10 themes, 5-level scale.
Nordhavn Industries
53 / 100
They measure their maturity with Datamensio
An example
This could be your situation.
Take one company as an example: three sites, three spreadsheets, no shared answer.
Nobody can consolidate.
Nordhavn Industries, 2,400 people in Hamburg, Lyon and Porto. A client asks where the group stands. Each site answers in its own spreadsheet, with its own scales.
Three weeks, a single base.
One COBAC Instruction on the internal capital adequacy assessment process (ICAAP), CEMAC prudential framework assessment launched across all three sites at once, from the managers’ interview notes. The framework was already written, its 10 themes and levels L1 to L5 too.
Two costs avoided before being committed.
A score of 53 out of 100, with the gap concentrated on three themes. The AI companion spotted that two actions duplicated those of another audit. The committee report took one sentence to request.
What it saved them
- 3sites measured on the same base, instead of three questionnaires to reconcile
- 2duplicate actions caught before the spend
- 1committee report, with no manual rework
These figures are an example. They could be yours.
The standard imposes processes. Datamensio says where you stand.
01
The framework is already written
Themes, questions and levels L1 to L5, all written. You do not start from an empty spreadsheet.
02
The score lands the same day
Online, by self-assessment link or in interview. Theme by theme, comparable over time.
03
The gap becomes a costed plan
Every step up carries its action. The AI prioritises on expected effect, not on the order of the standard.
04
Progress can be demonstrated
Campaign after campaign, against your target and against your own past. That is what your board asks for.
The maturity scale
One level, the next, and the action that links the two.
This mechanism (a level, a higher level, and the action linking them) is what turns an observation into a trajectory.
Are stress test results used in management decisions?
- N1
No stress test is conducted on the capital need, or the work is limited to an isolated, undocumented sensitivity analysis.
- N2
Scenarios are run once a year to feed the ICAAP report. Results do not lead to any tracked decision.
- N3
Results are presented to the risk committee, which identifies possible corrective actions. The link with the capital plan is established.
- N4
Scenarios are calibrated on the institution’s own vulnerabilities, trigger thresholds are defined and decisions taken are tracked through to execution.
- N5
Tests, including reverse stress tests, are integrated into the budget cycle and the recovery plan. Assumptions are reviewed after every significant event, with a documented history of revisions.
Action to move from L2 to L3
Put the presentation of stress test results on the agenda of the quarterly risk committee, with a proposed corrective action, an owner and a deadline recorded in the minutes for each adverse scenario.
« With Datamensio, we meet our objectives far more efficiently. The ERDF inspection services and our supervising ministry particularly appreciated an approach that gives them reliable data. »
Director, CCI 94CCI Île-de-France
« We believe this is the most suitable solution to scale our transformation project and measure impact according to our needs. »
Maja SucekChief Operating Officer, Interreg Danube
Rarely on its own
Frameworks combine. Put several together to cover your business, or have the AI write yours.
Take your first measurementon ICAAP.
What this framework covers
ICAAP, the internal capital adequacy assessment process, forms Pillar 2 of the prudential framework applied by the COBAC to CEMAC credit institutions. It requires the institution to identify all its risks, including those not covered by the Pillar 1 minimum requirements (banking book interest rate risk, concentration risk, reputational risk, strategic risk), to quantify the internal capital needed to cover them, to test this assessment through stress testing, and to document it all in a report submitted to the governing body and then to the supervisor.
In practice, the difficulty is not producing the document but embedding it. ICAAP only has value if it genuinely feeds into decisions. Does the internal capital calculation influence credit pricing and dividend distribution policy, or does it remain an annual exercise run alongside the budget? Is risk appetite translated into operational limits monitored by the business lines, or set out as general principles? Do stress test scenarios reflect the institution’s own vulnerabilities (sector concentration, dependence on public deposits, sovereign exposure) or replicate a generic model?
The regional context raises the bar further. The COBAC’s progressive transposition of Basel II and III standards has strengthened the links between ICAAP, the internal control framework, governance and the prudential supervision process. One confusion often recurs: ICAAP is neither the prudential report nor the solvency ratio calculation. The ratio measures regulatory compliance at a given date. ICAAP is an ongoing, forward looking process, one that may conclude the institution needs more capital than the regulatory minimum.
The maturity assessment answers a different question from that of a documentary review. A review asks: is the requirement met, yes or no. The assessment asks: what level of control has each component of the framework reached, and what specific action moves it to the next level. This is what makes it possible to steer an upgrade programme across several financial years, and to compare subsidiaries of a banking group operating in several countries of the zone.
Within Datamensio, the framework is ready to use. You can also adapt it to your institution: the AI adjusts themes, questions and levels to your size and profile, or builds a bespoke version from your own risk policies and your latest ICAAP report.
Reference standard: COBAC Instruction on the internal capital adequacy assessment process (ICAAP), CEMAC prudential framework
The themes assessed
Governance of the ICAAP process
Role of the governing body and the executive body, existence and operation of the risk committee, formal approval of the report, independence of the risk management function.
Risk appetite and tolerance
Formalisation of the risk appetite statement, breakdown into limits by risk type and business line, alert mechanism for breaches, annual review by the board.
Risk identification and mapping
Exhaustive identification of material risks, materiality criteria, treatment of Pillar 2 risks (banking book interest rate, concentration, strategic, reputational), update frequency.
Internal capital quantification
Methods used per risk type, assumptions and justification, aggregation and treatment of diversification, consistency with the regulatory capital calculation.
Stress testing
Choice and severity of scenarios, consideration of the institution’s own vulnerabilities, reverse stress tests, translation of results into management actions.
Capital planning
Multi year projection of capital needs and resources, alignment with the budget and strategic plan, capital recovery plan, distribution policy.
Data quality and information systems
Traceability of data feeding the process, aggregation of exposures, consistency checks, reliance on manual processing.
Documentation and reporting to the supervisor
Structure and completeness of the ICAAP report, audit trail of calculations, version retention, compliance with COBAC submission deadlines.
Independent review and internal control
Scope and frequency of the internal audit review, model validation, follow up on recommendations, alignment with the permanent control framework.
Use in day to day management
Influence of internal capital on pricing, capital allocation, lending decisions and strategic trade offs, ownership by the business lines.
A short version of the framework is available for the online self-assessment.
Frequently asked questions
Does the assessment amount to COBAC approval of the ICAAP framework?
No. The COBAC runs its own prudential supervision process and remains solely responsible for assessing your framework. The assessment measures the maturity of each component and prepares the exchange with the supervisor by documenting gaps and the actions under way.
What is the difference between this assessment and a prudential compliance review?
A review checks whether a requirement is met and concludes with a binary finding. The assessment places your practices on a progressive scale and points to the trajectory for improvement. The two complement each other: the assessment prepares the review, the review validates.
How long does the assessment take?
The short version takes 20 to 30 minutes to complete for a risk manager. The full version, in collaborative mode, generally takes one to two weeks, most of the time being spent gathering input from finance, internal control and IT.
Can the framework be adapted to our institution?
Yes. You can edit the questions and levels, add your own themes or start from a blank template. The AI can also build a bespoke version from your risk policies and your latest ICAAP report. You keep full control of the framework.
Can several subsidiaries of a regional group be compared?
Yes. The same framework is rolled out to each business unit, scores are compared by theme, and a cross cutting roadmap consolidates the assessments. The AI groups recurring gaps together to avoid tackling the same issue ten times over.
Is quantitative expertise required to answer?
The questions concern the organisation of the process, its governance and its use, not model mechanics. Some questions call for input from a modeller or from management control: collaborative mode lets you assign them to the right person.
How does this assessment relate to internal control and COBAC governance?
COBAC regulations on governance and internal control provide part of the foundation ICAAP relies on. Findings overlap, and the cross cutting roadmap allows these frameworks to be cross referenced without duplicating actions.
Where is the data hosted?
In France, with OVH, backed up with Scaleway. No transfer outside the European Union. The AI models used can be selected, including from European providers.