ICARA Consultant or In-House Hire? Who Should Run Your ICARA

The ICARA Process in Brief

The Investment Firms Prudential Regime (IFPR) began on 1 January 2022 and introduced the internal capital adequacy and risk assessment, or ICARA, process for MIFIDPRU investment firms. The rules sit in chapter 7 of the MIFIDPRU sourcebook in the FCA Handbook. In outline, a firm must:

• run an ICARA process that identifies and monitors the potential material harms its business could cause, to clients, to markets and to the firm itself, and that is proportionate to the nature, scale and complexity of the business;
• assess its business model and carry out capital and liquidity planning, including stress testing;
• estimate the own funds it needs, and decide whether it must hold more than its own funds requirement to comply with the overall financial adequacy rule;
• hold the higher of the own funds needed to keep operating through the economic cycle and the own funds needed for an orderly wind-down, which becomes its own funds threshold requirement;
• do the same for liquid assets, arriving at a liquid assets threshold requirement;
• maintain recovery planning and wind-down planning; and
• notify the FCA immediately if own funds fall, or are likely to fall, below its early warning indicator, threshold requirement or wind-down trigger.

Under MIFIDPRU 7.8, the firm must review the adequacy of its ICARA process at least once every 12 months, and again after any material change to its business or operating model. Each review is documented in the ICARA document, which the governing body must review and approve, including the key assumptions behind it. The firm submits the MIF007 ICARA assessment questionnaire on a date it has notified to the FCA, and a revised date can’t leave MIF007 unsubmitted for more than 12 months. After a review triggered by a material change, MIF007 is due within 20 business days of the governing body approving the ICARA document. Records of the ICARA document and its approval must be kept for at least three years.

The FCA’s map of ICARA rules and guidance is a useful checklist, and our ICARA and IFPR guide for investment firm boards covers the process in more depth.

Who Owns the ICARA?

The governing body owns it. The rules make the board responsible for reviewing and approving the ICARA document and its key assumptions, and the FCA expects the ICARA to be part of how the firm is actually run, not a document produced once a year for the regulator.

Below board level, the people involved depend on the firm’s size and its SM&CR tier:

• Core SM&CR firms: most MIFIDPRU investment firms fall here. There is no separate SMF2 or SMF4 in the Core tier, so the finance director is typically approved as an SMF3 Executive Director and usually leads the ICARA, with the chief executive (SMF1) accountable for the business as a whole.
• Enhanced SM&CR firms: the chief finance function (SMF2) and, where the firm has one, the chief risk function (SMF4) are separate Senior Manager roles, and ownership of the ICARA usually sits with one or both. See our pages on SMF2 recruitment and SMF4 recruitment.
• Committees: SNI firms are outside the MIFIDPRU committee rules. Non-SNI firms must have risk, remuneration and nomination committees under MIFIDPRU 7.3 unless they qualify for the exclusion in MIFIDPRU 7.1.4R, broadly where on- and off-balance sheet assets average £100 million or less over four years, or £300 million or less with limited trading book and derivatives exposures. Where a risk committee exists, it will normally review the ICARA before it goes to the board. Many firms also use an audit committee, though MIFIDPRU does not require one.

Whoever drafts the ICARA, the question the FCA will ask is whether the board understood it, challenged it and used it. Its IFPR implementation observations found that some boards and committees did not give sufficient challenge and oversight, and that wind-down assessments were often weaker than going-concern assessments, with unrealistic assumptions and poorly justified estimates.

The Four Options

Firms tend to choose between four models. None is right for everyone.

External consultant

A good consultant brings a tested framework and an outside view of what the FCA expects. The weakness is ownership. If the consultant arrives once a year, interviews management and writes the document, the ICARA becomes a compliance exercise rather than a management tool. The FCA’s outsourcing rules are clear that a firm remains responsible for functions it outsources, and the governing body is the one approving the assumptions. Our guide to what you can and can’t outsource applies here too.

In-house hire

An in-house head of risk, risk manager or senior finance lead makes the ICARA part of the monthly rhythm: monitoring early warning indicators, refreshing liquidity forecasts, reporting harms to the risk committee and updating the wind-down plan when the business changes. It is the strongest model, but a significant fixed cost, and many candidates know either capital or risk well, but not both.

Fractional or interim specialist

A fractional risk or finance specialist can run the ICARA process for a few days a month, attend the risk committee and keep the triggers monitored, without the cost of a full-time hire. An interim is often the right answer after critical FCA feedback, when the ICARA needs rebuilding quickly, or when the person who owned it has left. See fractional and interim SMF cover and our honest view of when interim and fractional appointments work and when they don’t.

Hybrid

For most small and mid-sized investment firms, the hybrid model works best. An in-house owner, often the finance director or a finance manager with risk experience, runs the process and monitoring, while an external specialist provides the methodology, stress-testing support and independent challenge before board approval. The key is to write down who does what, so that neither side assumes the other is watching the triggers.

What the FCA Expects, Whichever Model You Choose

• The governing body reviews and approves the ICARA document and its key assumptions, and can explain them.
• The ICARA reflects the firm’s actual business model, harms and risk appetite, not a generic template.
• Harms assessment, stress testing, risk appetite and triggers are linked and consistent with each other.
• The wind-down plan is realistic, with justified costs and timelines and consideration of group dependencies.
• Early warning indicators and thresholds are monitored between annual reviews, and the FCA is notified when required.
• The ICARA is reviewed at least annually and after any material change, and MIF007 is submitted on time.

If you use a consultant, the test is whether your own people could explain and defend the ICARA in a meeting with the FCA without the consultant in the room.

Signs You Need Someone In-House

• Growth: new products, new client types or rising assets under management mean harms and capital needs change faster than an annual review can track.
• Non-SNI status: moving out of the SNI category brings K-factor requirements, more governance and, above the MIFIDPRU 7.1.4R thresholds, risk, remuneration and nomination committees.
• FCA feedback: criticism of the ICARA, a request for additional own funds or liquid assets, or a supervisory review that questions governance.
• Complex wind-down: client money and assets, group service dependencies, multiple jurisdictions or long-dated contracts make orderly wind-down hard to model.
• Group ICARA: where a group ICARA is used, the FCA has found that many did not properly assess the risks of each individual firm.

What to Look for in the Person Who Runs Your ICARA

Whether you hire a head of risk, a risk manager or a finance lead, look for:

• direct, hands-on experience of MIFIDPRU own funds, K-factors and liquid assets requirements, not only general risk management;
• experience of writing or materially rebuilding an ICARA, ideally at a firm of similar size and model;
• credible stress testing and reverse stress testing, built from the firm’s own data;
• practical wind-down planning, including costs, timelines and dependencies on group or third-party services;
• the ability to explain capital and liquidity to a board in plain terms, and to take challenge from NEDs; and
• enough seniority to push back when the business plan and the capital position don’t match.

For investment firms, the right background often sits between finance and risk. See our pages on SMF recruitment for investment managers and financial controllers for FCA-regulated firms.

Interview questions

• Walk me through how you set the own funds threshold requirement at your last firm. What drove the number?
• How did you identify material harms, and how did they link to your risk appetite and early warning indicators?
• What were the key assumptions in your wind-down plan, and how did you test them?
• What would you report to the board each month, and what would make you escalate between reviews?
• Describe a time the board or the FCA challenged your ICARA. What changed?
• Which parts of the ICARA would you keep in-house, and which would you use outside support for?

Strong candidates answer with specifics: figures, triggers and decisions they influenced. Be wary of anyone who can describe the rules but not a single judgement call they made. Our wider guide to interviewing SMF candidates covers how to test for this.

What It Costs

Costs vary widely, so we won’t quote generic figures. An external ICARA review is usually priced as a project; an in-house hire is a salary plus overheads; and day rates for interim and fractional risk and finance specialists vary widely with seniority, MIFIDPRU experience and the scope of the work. Our SMF and compliance salary guide gives current ranges for permanent roles. The fairer comparison is not the cost of a consultant against a salary, but the cost of the option against what it delivers: a weak ICARA can lead to the FCA requiring additional own funds or liquid assets, which ties up capital for much longer than any fee.

The Bottom Line

An ICARA is the firm’s own assessment, approved by its own board. Consultants are valuable for methodology and challenge, but the firm needs someone inside the business who understands the numbers and watches the triggers all year. For a small SNI firm that may be the finance director with external support. For a growing or non-SNI firm, it usually means a dedicated in-house or fractional specialist.

Frequently Asked Questions

Can we outsource our ICARA to a consultant?

You can use a consultant to help design and draft it, but the firm remains responsible and the governing body must review and approve the ICARA document and its key assumptions.

How often must the ICARA be reviewed?

At least once every 12 months, and after any material change to the firm’s business or operating model.

What is MIF007?

The ICARA assessment questionnaire. Firms submit it on a date notified to the FCA, at least every 12 months, and within 20 business days of board approval after a review triggered by a material change.

Which Senior Manager is responsible for the ICARA?

The governing body owns it. At a Core firm the finance director, usually an SMF3, typically leads it. At an Enhanced firm, the SMF2 and, where there is one, the SMF4 are usually involved.