Management remains responsible for holding capital beyond the minimum that fits its risk profile, and more capital is no substitute for fixing weak controls (SRP10.2, SRP10.4). Pillar 2 addresses risks not fully captured by Pillar 1 (such as credit concentration), risks Pillar 1 leaves out (such as IRRBB and business and strategic risk) and external factors such as the business cycle, and checks ongoing compliance with the qualifying criteria of advanced Pillar 1 methods (SRP10.5, SRP20.38 to SRP20.40). Supervisors review the bank's internal assessment through on-site work, off-site review, management discussion, external audit work and periodic reporting, so the bank must be able to evidence its targets, their monitoring and the suitability of its capital composition (SRP20.31 to SRP20.36). Under Principle 3 the bank is expected to run with a buffer above Pillar 1 minimums, and supervisors can require capital above the minimum, for example through trigger and target ratios (SRP20.3, SRP20.42, SRP20.43). Under Principle 4 supervisors intervene early and may intensify monitoring, restrict dividends, require a capital restoration plan or require immediate new capital (SRP20.4, SRP20.44). All risks, especially complex capital market risks, should be covered by capital including Pillar 2 add-ons, and the bank must stay compliant during and after stress (SRP30.3).
The graph holds this control, the 0 it maps to, and the evidence behind each claim, over MCP and REST.