Skip to content

FRM Exam Part II · Capital Planning at Large Bank Holding Companies: Supervisory Expectations and Range of Current Practice

Risk Identification and Internal Controls in Capital Planning

Updated 11 October 2026 · Fact-checked

Capital planning at a large bank holding company starts with identifying every material risk, then wrapping the process in governance: board and senior management oversight, written policies and procedures, independent validation and internal audit. These controls make sure capital targets reflect real risks and that the plan can be trusted and challenged.

Understand Risk Identification and Internal Controls in Capital Planning

A capital plan sets out how much capital a bank holding company needs, now and under stress, and how it will use that capital (dividends, buybacks, growth). Supervisors expect the plan to rest on a sound process, not just a number.

The first step is risk identification. The bank must find the risks that could hurt its capital. These include credit, market, operational, liquidity, interest rate and concentration risks, plus risks that are hard to model, such as strategic, reputational and model risk. A good process is firm-wide, repeated often, and looks at both on-balance-sheet and off-balance-sheet exposures. Weaker banks list only the risks they already model.

The second step is governance. The board of directors approves the capital plan and the capital policy, and it must understand the key assumptions, scenarios and limitations. Senior management designs and runs the process, reports clearly to the board and challenges results. Board minutes and reports should show real discussion, not just approval.

The third step is internal controls. These include written policies and procedures, defined roles, data and reporting controls, independent model validation, and internal audit review. The first line owns the process, risk and validation functions give independent challenge, and audit tests the whole framework. Material gaps, such as weak data or unvalidated models, should be disclosed and compensated for with conservatism.

The link to the exam: questions describe a bank's practice and ask whether it meets supervisory expectations, which risk was missed, or who is responsible for what.

How to solve Risk Identification and Internal Controls in Capital Planning questions

Use this method for any scenario question on risk identification, governance or controls in capital planning.

  1. 1Read the stem and decide which element is tested: risk identification, board oversight, senior management, policies, validation or audit.
  2. 2List the risks the bank has covered and note which material risks are missing or not captured in the stress scenarios.
  3. 3Identify who is acting in the scenario (board, management, risk function, internal audit) and check the action matches that role.
  4. 4Check for independence: the party reviewing a model or process should not be the one that built or owns it.
  5. 5Check for documentation: policies, assumptions, limitations and approvals should be written and reviewed.
  6. 6Look for weaknesses such as unvalidated models, poor data, or undocumented overrides, and ask how they should be compensated for.
  7. 7Eliminate options that overstate the role (for example, the board building the models) or understate it (a rubber-stamp approval).
  8. 8Pick the answer that is firm-wide, independent, documented and conservative where uncertainty remains.

Quickest way: Role-and-gap check

When to use it: Use when time is short and the options describe who does what in the capital planning process.

  1. Board: approves and challenges. Does not build models.
  2. Senior management: designs, runs and reports. Owns the process.
  3. Independent validation and audit: challenge and test. Must be independent.
  4. Scan the options for a role in the wrong place or a missing independent review.
  5. Choose the option that is firm-wide, documented and independent.

Common mistakes in Risk Identification and Internal Controls in Capital Planning

  • Saying risk identification covers only risks the bank already models.

    Students link capital planning only to quantified risks like credit and market.

    Fix: Remember that material risks include hard-to-quantify ones such as strategic, reputational and model risk. They need qualitative assessment or a conservative buffer.

  • Assigning model building to the board.

    Students read 'board oversight' as hands-on involvement.

    Fix: The board approves, questions and understands assumptions and limitations. Management and staff build and run the process.

  • Treating board approval as a formality.

    Approval looks like the end of the process.

    Fix: Supervisors expect evidence of real challenge and discussion, with enough information provided to the board to judge the plan.

  • Accepting validation done by the model developer.

    Students focus on whether validation happened, not who did it.

    Fix: Validation and audit must be independent of model development and use. Look for the independence clue in the stem.

  • Ignoring known weaknesses instead of compensating for them.

    Students assume a weak model or data set means the plan is invalid.

    Fix: Expectation is that weaknesses are identified, documented and offset by conservative adjustments or overlays, with remediation planned.

  • Looking at the process once a year.

    Capital plans are submitted annually, so students assume reviews are annual.

    Fix: Risk identification and monitoring should be ongoing, with the plan updated when conditions or the risk profile change materially.

Worked examples

Example 1

A large bank holding company's capital plan stresses credit and market risk only. Its risk team has noted growing exposure to a few large counterparties and reliance on a vendor model. Which is the best assessment?

Show the solution
  1. The tested element is risk identification.
  2. Counterparty concentration is a material risk and the vendor model creates model risk.
  3. Neither is reflected in the stress scenarios, so the identification process is incomplete.
  4. The fix is to include concentration and model risk in the assessment, either by modelling them or by adding a conservative buffer.

Answer: The risk identification is deficient. The bank should capture concentration and model risk in its scenarios or buffers and document how they are treated.

Example 2

The team that built a bank's loss-forecasting model also performs its annual validation. The board approves the capital plan after a short presentation with no discussion of model limitations. Identify the weaknesses.

Show the solution
  1. Check independence: the developers validate their own model, so there is no independent challenge.
  2. Check board oversight: approval with no discussion of limitations suggests the board is not given or does not use enough information to challenge.
  3. Check the fix: assign validation to an independent function, have internal audit test the process, and give the board reports on assumptions, limitations and results.

Answer: There are two weaknesses: lack of independent validation and weak board challenge. The bank should separate validation from development and give the board full information on limitations so it can challenge the plan.

Exam tips

  • Match each action to the right role: board approves and challenges, management runs, independent functions validate and audit.
  • Watch for independence clues. A developer reviewing their own model is almost always the flaw.
  • Questions often ask which risk was missed. Look for concentration, liquidity, operational or model risk absent from the scenarios.
  • The best answer usually combines firm-wide coverage, documentation and conservative treatment of known gaps.
  • Avoid options with absolutes like 'only' or 'never' unless the rule is truly strict.

Practice questions from Capital Planning at Large Bank Holding Companies: Supervisory Expectations and Range of Current Practice

Risk Identification and Internal Controls in Capital Planning in other exams

The same ground in other exams, if you are preparing for more than one or want another angle on it.

Risk Identification and Internal Controls in Capital Planning: frequently asked questions

What does the board do in capital planning?

The board approves the capital plan and policy, and challenges the assumptions and scenarios. It should receive enough information to understand results and limitations. It does not build the models.

Which risks should a bank identify for capital planning?

All material risks, including credit, market, operational, liquidity and interest rate risk. Also concentration, strategic, reputational and model risk, even when they are hard to quantify. Identification should be firm-wide and repeated as the risk profile changes.

Why must model validation be independent?

An independent reviewer can challenge assumptions without a stake in the result. Reviews by the builders tend to miss flaws. Internal audit then tests that the whole framework works as described.

What should a bank do when its data or models are weak?

It should document the weakness, assess its effect and offset it with conservative adjustments. It should also set a plan to fix the issue. Ignoring it or hiding it is the worst outcome.