At many GCC banks, the IFRS 9 ECL team, the ICAAP team, and the stress testing team operate largely independently. Different reporting lines. Sometimes different vendors for tooling. Different methodology papers. Different governance committees. Three exercises, three sets of artefacts, often three slightly different views of the same portfolio.

This is the default arrangement at most institutions, and there is a real cost to it. IFRS 9, ICAAP, and stress testing are not three frameworks that happen to share inputs. They are three applications of a common analytical framework, each tuned for a different audience, time horizon, and parameter calibration. The bank that recognises this and engineers connection between them builds a coherent risk capability. The bank that treats them as fully separate builds three coherent risk capabilities that don’t quite agree with each other.

This piece is about why the three are connected — and what banks lose when they aren’t engineered that way.

The three frameworks, briefly

IFRS 9 is an accounting standard. It tells the bank how much loan-loss provision to recognise on the balance sheet today. The answer is the Expected Credit Loss — a probability-weighted view of losses over either the next twelve months (Stage 1) or the lifetime of the exposure (Stages 2 and 3). The output flows through the P&L into retained earnings and from there into Common Equity Tier 1 capital.

ICAAP is a regulatory framework. It tells the bank how much capital it should hold given its risk profile, beyond the minimum Pillar I numbers. The answer requires the bank to identify and quantify all material risks (Pillar II), project capital adequacy over a multi-year horizon, and articulate why the planned capital position is sufficient under both expected and stressed conditions.

Stress testing is a methodology. It tells the bank what happens to its financial position under adverse scenarios — credit downturn, liquidity crunch, market dislocation, operational shock. The answer feeds into ICAAP, into recovery planning, into Board risk appetite, and into supervisory dialogue.

Three different things. Three different audiences (auditors for IFRS 9, regulators for ICAAP, internal risk management and the Board for stress testing). Three different time horizons (point-in-time provision for IFRS 9, three-to-five-year capital plan for ICAAP, scenario-driven projections for stress testing).

So why argue they are connected?

Why they are structurally connected

Because the underlying analytical inputs are the same.

Each of the three exercises needs a credible answer to the same set of questions. What is the probability of default for each portfolio segment? What is the expected loss given default? What is the exposure at default at any future point? How do these parameters move under different macroeconomic conditions? How does the capital position evolve as the loan book ages, defaults, and rebuilds?

These are the same questions. IFRS 9 calls them PD, LGD, EAD, and SICR triggers. ICAAP calls them risk-weighted asset projections, expected loss assumptions, and capital glide-paths. Stress testing calls them scenario-conditional credit loss paths, capital impact, and management actions.

The structure is the same. The calibration differs in deliberate ways: point-in-time PDs for IFRS 9, often through-the-cycle PDs for ICAAP Pillar I capital, scenario-conditional PDs for stress testing. These are different mathematical objects derived from a common framework — not three independent constructions.

When the three exercises are run with no engineered connection — when the IFRS 9 team calibrates its PD models, the ICAAP team uses different ones for capital projection, and the stress test team builds yet others for scenario analysis — the bank ends up running essentially the same exercise three times and reaching three different answers. Auditors see the IFRS 9 number. Regulators see the ICAAP number. The Board sees the stress test number. The numbers often don’t reconcile cleanly, and reconciling them after the fact takes real effort.

This is where the structural problem becomes a practical one.

What banks lose without engineered connection

Three things, in order of severity.

First, the bank loses methodological coherence. The IFRS 9 model says provisions rise 25% in a downturn. The stress test, run by a different team with different calibration, says provisions rise 60%. Which is correct? In practice, neither is “wrong” individually — the difference reflects different macro assumptions, different segmentation, different through-the-cycle versus point-in-time treatment. But the auditor and the regulator both notice, both ask, and the bank should be able to explain the difference cleanly. When the three exercises are fully independent, the explanation often takes a working group to assemble.

Second, the bank loses governance traceability. When a Board committee asks why provisions are projected to rise next year, the answer should be a clean line: “because the macro overlay assumes GDP growth of 1.8%, which moves PDs in the corporate book by X basis points, which propagates through the ECL engine to Y million dirhams of additional provision.” That clean line requires shared scenario assumptions and a documented chain of cause and effect across the three exercises. When IFRS 9 and ICAAP and stress testing each have their own assumption sets, the line is rebuilt manually each time the question is asked.

Third, and most expensively, the bank loses optionality on management actions. A connected framework lets the bank ask: if we tightened underwriting in segment X, what does that do to ECL today, to capital adequacy in three years, and to stress-test resilience? Three teams using disconnected models cannot answer this question quickly. A connected framework can answer in a working session.

This last point is the real cost. Most banks can absorb some methodological inconsistency and some governance friction. Speed of capital impact analysis under supervisory or strategic pressure is harder to recover when the underlying framework is fragmented.

What “engineered connection” looks like in practice

It does not mean merging the three teams into one. The accounting, regulatory, and risk-management functions have different skills and different reporting lines for good reasons. Connection is structural, not organisational.

What it does mean is this. The bank operates a coherent set of credit risk parameters — a shared PD framework with deliberate point-in-time and through-the-cycle versions, a shared LGD framework, a shared EAD framework — calibrated together and used consistently across all three exercises. Where the three exercises need different calibrations (PIT for IFRS 9, TTC for ICAAP, conditional for stress), the relationship between the calibrations is documented, not accidental.

The macroeconomic overlay is a single methodology with documented scenarios. The same scenarios that drive the IFRS 9 macro adjustment also drive the stress test paths and feed into the ICAAP capital projection. Differences between the three exercises become differences of application, not of underlying scenario design.

The IFRS 9 team takes the parameter framework and produces today’s provision. The stress testing team takes the same parameter framework and runs scenarios through it to produce scenario-conditional loss paths. The ICAAP team takes both outputs and integrates them into a capital adequacy projection. Each exercise has its own deliverable. None has its own model framework.

When this works, three things become easier to demonstrate. Capital projections in ICAAP can be reconciled to ECL movements in IFRS 9 reporting. Stress test losses can be reconciled to lifetime ECL under appropriately weighted adverse scenarios. Board-level discussions of provisions, capital, and resilience use the same vocabulary and the same scenario set.

Auditors stop asking why the IFRS 9 model and the stress test give different answers — because the difference is now documented up-front, not reconstructed after the fact. Regulators stop asking why ICAAP capital projections diverge from accounting expectations. The Board stops needing three separate briefings on the same underlying portfolio dynamics.

Where banks usually start

For most GCC banks, the path to engineered connection is not a green-field redesign. The three exercises already exist, with three sets of historical artefacts and three working teams. The realistic starting point is incremental alignment, not rebuild.

The first place to look is the credit risk parameters themselves. Are PDs calibrated within a coherent framework that recognises PIT and TTC variants of the same underlying model, or does each exercise calibrate from scratch? Are LGDs derived from a shared empirical analysis with deliberate adjustments per use case, or from independent analyses? Are macroeconomic scenarios shared across exercises, or developed independently?

In our experience working with GCC banks, the answer often falls toward the independent end of the spectrum: each exercise has been built by its own team, against its own dataset, on its own assumptions. The bank does not have one coherent framework — it has three, and the differences between them are largely accidental rather than deliberate.

This is rarely a flaw of any one team. It tends to be a consequence of the way these exercises evolved at most banks: IFRS 9 came first under accounting pressure, ICAAP arrived next under regulatory pressure, stress testing matured most recently under supervisory pressure. Each was implemented to satisfy a specific deadline with a specific output. Coherence across the three was rarely a design objective.

It can become one. Not in a single quarter, not without effort. But the path from three disconnected exercises to one connected framework — shared parameters first, shared scenarios next, shared governance last — is straightforward when treated deliberately.

The bottom line

A bank that runs IFRS 9, ICAAP, and stress testing as fully separate exercises is paying multiple times for what should be a shared analytical capability — and getting an inconsistent capability in return. A bank that engineers connection between them gets methodological coherence, governance traceability, and the ability to do real-time impact analysis when it matters.

The framework matters. The labels do not.

Riskweise builds IFRS 9, ICAAP, and stress testing frameworks for GCC banks, NBFCs, fintechs and insurers — calibrated to CBUAE, SAMA, CBB, QCB, CBK and CBO supervisory expectations, delivered as fully-editable Excel artefacts that the client owns end-to-end. To talk about how the three connect at your institution, email contact@riskweise.com.