These exercises highlight that not enough data are available for a bottom-up approach, assessing the vulnerabilities specific to Group clients and incorporating their response and remediation functions on a forward-looking basis.