Credit union boards are under increasing pressure to practice effective risk oversight, says Joette Colletts, regional manager of risk management with CUNA Mutual Group in the Credit Union Directors Newsletter.
This additional scrutiny comes from the perception that financial institutions weren’t adequately prepared to manage the risks they encountered during the recent financial crisis. While credit unions didn’t cause the financial crisis, they’ve been caught up in the regulatory backlash.
A credit union’s board of directors is ultimately accountable for risk oversight, including the evaluation of current risks and identification of emerging ones. Some credit unions employ formal risk oversight processes and policies, and some use informal ones. Some might even oversee risk on an ad hoc basis.
Whether sophisticated or simple, an effective risk oversight program is one that creates long-term protection and stability and requires boards to consistently discuss “what if” scenarios.
Boards can ensure proper risk management processes by challenging management to identify, assess, and manage the most significant enterprise-wide exposures. Doing so sets a positive tone and creates a risk-alert culture to guarantee safety and soundness and consistently achieve credit union goals.
Ten Types of Risk
Consider these 10 risk categories as you prepare written policies, suggests CUNA Mutual Group:
Keep in mind that NCUA includes the first seven as part of its risk-focused examinations
This culture will include processes and a written policy your board reviews and approves annually. This provides documented direction, keeping your board focused on risk oversight and subsequent decisions.
Proper risk oversight also protects directors’ personal reputations and assets and helps directors embrace the benefits of serving on the board of a first-class, well-governed credit union.
Keep in mind, risk is inherent in any business. Your oversight role shouldn’t be to eliminate risk, but to make sure it’s managed in a way that benefits your members.
Determine your credit union’s “risk appetite”—the amount of risk exposure or potential adverse impact from an event—your credit union is willing to accept and retain in pursuit of providing value to your members.
Because boards represent members, board and management should agree on an acceptable risk appetite. Your credit union then must implement risk management controls to bring the exposure level within the accepted range.
Address risk within your business strategy as a whole. Effective risk oversight by the board looks at risk holistically by examining the global risk possibilities your credit union could encounter.
Traditionally, boards have been concerned primarily with “pure” risk, where no positive outcome was possible. Such negative risks include property risks (fires or hurricanes), robbery (loss of cash), and employee dishonesty (loss of assets).
The board’s focus was on preventing, reducing, and transferring the risk through insurance. Boards now have to consider speculative or “positive” risks as well—those that could result in improvements to the credit union, but that might have negative effects.
These result in positive outcomes such as outperforming credit union goals: an increase in loans, higher return on investments, or an increase in market share.
An important but often-overlooked tool in managing risk is a written policy, developed with legal counsel and specifically addressing the board of director’s commitment to risk oversight. Include a list of key risk indicators as part of your written policies and procedures. Keep in mind risks evolve, so it’s critical to update these indicators regularly.
JOETTE COLLETTS is regional manager of risk management with CUNA Mutual Group. Contact her at 800-356-2644, ext. 5159.