Ten areas where a stress-testing framework is tested — by the board, by internal audit and by a supervisor — what a sound answer looks like in each, and the symptom that gives a weak one away.
In short
- A stress-testing framework is rarely found to be wrong in one decisive way. It degrades area by area, as scenarios are carried forward unchanged, severity drifts toward whatever passes, and results arrive later each year.
- A weak framework gives itself away by symptoms rather than by documentation, which is usually adequate even where the framework is not.
- Use and integration is the area a reviewer weights most heavily, because it distinguishes a programme from a report, and it is the one that cannot be repaired in the weeks before an examination.
- What separates a framework that holds from one that does not is whether severity was chosen by someone accountable, whether the scenarios describe risks this institution recognises, whether anyone with standing was able to say no, and whether the results reached a decision in time to change it.
On this page
A stress-testing framework is rarely found to be wrong in one decisive way. It degrades area by area, as scenarios are carried forward unchanged because rewriting them is expensive, as severity drifts toward whatever passes, as management actions accumulate optimism nobody has re-checked, and as results arrive later each year until they no longer reach a decision in time to change it.
The ten areas below are where a programme is most consistently tested — by the board, by internal audit and by a supervisor. Each is stated as what a sound framework can show, followed by the symptom that gives a weak one away.
Scenario origin and ownership#
A sound framework can show where each scenario came from, which concentrations of this balance sheet it was built to disturb, and who inside the institution proposed and defended it.
The symptom of a weak answer is a scenario set whose descriptions could belong to any bank in any market, or one carried forward across several cycles with only the base year updated — usually because rewriting the narrative would require the transmission mechanism to be stated, and nobody currently owns it.
Severity and its governance#
A sound framework can name the forum that chose the severity of each scenario, produce the minutes of that decision, and explain the basis — what the institution intends to remain viable through, without extraordinary support.
The symptom of a weak answer is severity that arrives with the parameters rather than before them, or results that land just above the regulatory minimum year after year, which is the statistical signature of calibration to the answer rather than to the appetite.
Narrative coherence#
A sound framework can produce, for each scenario, a written narrative whose variable paths follow from the story and whose combinations are economically possible.
The symptom of a weak answer is a scenario in which the currency collapses without inflation, employment holds through a deep recession, property prices fall with household defaults unchanged, or no authority responds at all across several years of crisis.
These are visible without a model and are usually the first thing a reviewer checks, because they establish whether the narrative was written before the numbers or after them.
Coverage#
A sound framework can show which risk types each scenario reaches — credit, market, interest rate in the banking book, liquidity and funding, operational, concentration — and can justify any that are excluded.
The symptom of a weak answer is a programme that is a credit-loss exercise with a liquidity appendix, or one in which operational and conduct events appear only as a fixed add-on with no scenario logic behind it.
The liquidity leg deserves its own scrutiny: it runs on a different clock, turns on behavioural assumptions no accounting standard governs, and is the road along which institutions actually fail fastest.
Reverse stress testing#
A sound framework can produce a definition of failure that goes beyond breaching a minimum, a documented search for the scenarios that would reach it, and evidence that the findings were reported and acted on.
The symptom of a weak answer is a reverse stress test performed once, concluding that failure would require conditions so extreme as to be unimaginable, and never revisited — which is what happens when the failure point is set out of reach so that the conclusion is comfortable.
Balance-sheet projection and management actions#
A sound framework can show a projection consistent with the narrative — volumes, margins and mix responding to the conditions described — and a set of management actions each with an owner, a trigger, an execution timeframe and a stated dependency.
The symptom of a weak answer is a business plan running unchanged through a severe multi-year downturn, or actions that assume asset sales into the market the scenario has just closed, capital raised at the moment the scenario says capital is unavailable, or cost reductions of a scale and speed the institution has never achieved in benign conditions.
Models, methodology and data#
A sound framework can state how scenario variables translate into risk-factor behaviour, where those relationships were estimated and on what period, what happens when the scenario moves outside the range the estimation covered, and which parts of the chain are expert judgement rather than model output.
The symptom of a weak answer is a translation layer nobody can explain in words, a set of relationships fitted only on benign years, or a data pipeline reassembled by hand each cycle — which is usually why the results arrive late.
Independent validation and challenge#
A sound framework can show that someone who did not build the models or design the scenarios examined both, had access to everything, and possessed the standing to withhold sign-off.
The symptom of a weak answer is validation that reviews arithmetic and formatting but not judgement, a validation function reporting to the people whose work it validates, or a multi-year record in which no material finding was ever raised.
A challenge process that has never changed a result is not a challenge process.
Governance and board engagement#
A sound framework can show a board that approved severity before the exercise ran, received results with the decisions attached, and has at least once sent something back.
The symptom of a weak answer is a board pack in which the stress results appear as an information item after the capital plan has been approved, minutes recording no questions, or a governing body that has never rejected a scenario, a severity or an assumed management action across several cycles.
Use and integration#
A sound framework can point to specific decisions that changed because of a stress result — a buffer raised, a concentration limit lowered, a facility arranged, a product repriced, a recovery option added or removed.
The symptom of a weak answer is a use test answered in the abstract: results are said to inform capital planning and risk appetite, but nobody can name a single thing that moved.
This is the area a reviewer weights most heavily, because it distinguishes a programme from a report, and it is the one that cannot be repaired in the weeks before an examination.
What the ten areas have in common#
Read together, the ten areas share a pattern: the quantitative questions are the easy ones.
What separates a framework that holds from one that does not is whether severity was chosen by someone accountable, whether the scenarios describe risks this institution recognises, whether anyone with standing was able to say no, and whether the results reached a decision in time to change it. An institution that can answer those four in specifics is unlikely to fail the other six.
Frequently asked
What does a stress-testing framework review cover?
A thorough review covers ten areas: where the scenarios came from and who owns them; how severity was chosen and by which forum; whether each narrative is internally coherent; which risk types are covered and whether the liquidity leg is genuine; whether reverse stress testing is real or decorative; whether the balance-sheet projection and management actions are executable; the models, methodology and data pipeline; independent validation and its standing; board engagement and approval sequencing; and use — the specific decisions that changed because of a stress result. The last area carries the most weight, because it distinguishes a programme from a report.
How can you tell a stress-testing framework is weak?
By symptoms rather than by documentation, which is usually adequate even where the framework is not. Scenario descriptions that could belong to any bank in any market. Results landing just above the regulatory minimum several years running. A business plan running unchanged through a severe multi-year downturn. Management actions that assume asset sales into a market the scenario has just closed. A validation function that has never raised a material finding. Board minutes recording no questions. And the most telling of all: nobody able to name a single limit, buffer, facility or price that changed because of a stress result.
Who should review a stress-testing framework?
Three parties, answering different questions. Independent model validation examines the methodology, the estimated relationships and the judgement layered on top of them, and must report somewhere other than to the people whose work it validates. Internal audit examines whether the framework operates as documented — approvals in the stated sequence, versions controlled, findings tracked to closure. A periodic external review adds the comparison an internal function cannot make, namely how the framework reads against what reviewers elsewhere are currently testing. None of the three substitutes for the challenge that should come from the business lines, who are the only people able to say whether an assumed management action is executable.
How often should a stress-testing framework be reviewed?
The scenario set and severity should be revisited every cycle, because carrying scenarios forward unchanged is the most common way a framework quietly stops describing the institution. The methodology and models warrant a deeper periodic review on a stated cycle, with validation coverage planned rather than opportunistic. Beyond the calendar, several events should trigger a review regardless of when the last one was: a material change in strategy, portfolio mix or funding structure; an acquisition; a significant move in market or macroeconomic conditions; a supervisory finding; and any occasion on which a real event produced losses materially different from what the framework would have predicted — the last being the most informative review trigger available and the most frequently ignored.
The programme behind this article
Work through this material with the practitioners who wrote it.
Basel III, Risk Assessment and Stress Testing Masterclass
Prudential stress testing as the primary tool of regulation — CCAR, DFAST, ECB/EBA/SSM and PRA regimes, tied back to the Basel III ICAAP.
View the programme →Advanced ICAAP, Stress Testing & Capital Planning Masterclass
An advanced masterclass that takes the ICAAP from binder to boardroom: capital and liquidity stress testing that survives supervisory challenge, documentation regulators accept, and economic capital allocated where it earns — carried through capital planning, risk appetite and the use test.
View the programme →Advanced ICAAP, Capital & Liquidity Stress Testing & Recovery Planning
The capital self-assessment and the recovery plan, built as one framework — shared scenarios, reconciled management actions, and triggers that fire while options still exist.
View the programme →