IFPR ICARA: Assessment A in practice

But process maturity is not the same as quality. Assessment A, the assessment of harms arising from ongoing operations within the ICARA process, remains the area most likely to be generic, carried forward unchanged and unable to withstand scrutiny [2][3].

That matters, because Assessment A is not just one section of the ICARA. It is the fundamental component that drives the capital and liquidity requirements across the entire framework and ultimately underpins a firm’s compliance with the Overall Financial Adequacy Rule (OFAR) under IFPR [2].

What Assessment A is and what it is not

Under MIFIDPRU 7.4, firms are required to identify all material harms that could arise from their ongoing operations [4]. This is a core component of the ICARA process and goes beyond the K-factor framework that many firms initially anchor to.

K-factors provide a baseline, but they do not capture the full range of firm specific risks. Operational exposures linked to the business model, conduct risks, concentration risks and key person dependencies must all be identified and assessed, and these are not captured by the K-factors other minimum own funds requirements [2][4].

The output feeds directly into the own funds assessment under MIFIDPRU 7.6 and the ongoing operations liquidity assessment under MIFIDPRU 7.7 [2][4].

In practice, this means Assessment A should look and feel very different across firms. A repurposed risk register is not an ICARA Assessment A. If the analysis could be lifted and applied to another investment firm with minimal change, it is unlikely to meet FCA expectations.

Common pitfalls for firms applying IFPR ICARA

Across multiple ICARA cycles, the same weaknesses continue to emerge, even in firms that consider their frameworks are well established.

The first is the missing link between harms and financial resources. Identifying a harm is the starting point, not the outcome. The question that drives the numerical requirement is what the residual financial impact would be if controls fail, particularly under stress. Where a harm is assessed as material but results in no additional capital or liquidity requirement, that position needs to be clearly justified. Without it, the firm’s threshold requirements are not grounded in its risk profile [2][3][5].

The second is the liquidity assessment. Too often, this is treated as a high-level overlay rather than a firm specific analysis. In practice, liquidity under IFPR should reflect the actual mechanics of the business, including margin calls, client behaviour, timing of outflows and operational dependencies. A single annual number derived from generic stresses does not capture how liquidity risk evolves over time, and risks missing the intra year dynamics that MIFIDPRU is trying to surface [2][3][5].

The third, and often most telling, is a lack of integration. A material harm identified in Assessment A should be visible elsewhere in the ICARA, whether in stress testing, early warning indicators or wind down assumptions. Where those links cannot be clearly traced, the document may be complete, but it is not coherent [2][3][5].

Why Assessment A matters

The OFAR is clear that firms must hold sufficient financial resources at all times, not just at the point of drafting the ICARA [2][4].

A weak Assessment A undermines that position. If the firm cannot explain how its harms translate into capital and liquidity requirements, it cannot be confident those requirements are right. That creates either a prudential risk or an inefficient allocation of capital.

There is also a supervisory dimension. The FCA’s focus has increasingly shifted from whether firms have completed the ICARA process to whether the analysis stands up in practice. The ability to demonstrate a clear, logical chain from harms through to financial resources is often the point of challenge [2][3].

What good looks like

Done well, Assessment A moves beyond compliance. It becomes a structured way of understanding how the firm’s business model generates risk and how that risk translates into financial resilience.

Stronger ICARAs tend to have a few common features. Harms are clearly articulated and are strongly linked to the business model. Controls are assessed in a way that allows residual risk to be understood. Financial impacts are explicit and feed directly into capital and liquidity assumptions. And, critically, the outputs are used by senior management, rather than simply documented.

In these firms, Assessment A is not static. It evolves alongside the business and provides a basis for real decisions about risk appetite, growth and resource allocation [2][3][5].

What should firms do to prepare for their next ICARA cycle?

For firms preparing their next ICARA cycle, the key question is not whether the firm has produced its Assessment A, but whether it is doing its job.

Can the firm clearly explain how it has identified harms, how those harms translate into financial impact, and how that in turn drives capital and liquidity requirements?

If not, the answer is not more documentation. It is a more fundamental reassessment of how the ICARA process is being used in practice.

References

1. FCA, IFPR implementation observations: quantifying threshold requirements and managing financial resources, February 2023.
2. FCA, IFPR implementation observations: quantifying threshold requirements and managing financial resources – concluding report, November 2023.
3. FCA Handbook, MIFIDPRU 7 — Internal Capital Adequacy and Risk Assessment.
4. FCA, TR22/1: Observations on wind-down planning: liquidity, triggers & intragroup dependencies, April 2022.
5. Forvis Mazars, The IFPR — enhancing regulated firms' risk management practices.