Enterprise risk management (ERM) is like a two-sided coin, says Tony Ferris, managing partner at The Rochdale Group, a CUNA strategic partner.
On one side, ERM provides both a safety net against the disastrous consequences of outside events and the unintended consequences of internal actions, he says.
On the other side, it can create value through the identification and seizure of emerging opportunities.
“Both views are important to have an effective ERM program,” Ferris says. “But one without the other can create imbalance, resulting in either missed opportunity or unabated risk taking. This is the fundamental notion of a true enterprise-wide risk management process that takes into account internal and external events, listens to every level of the organization, and provides measurable analysis in a continuous manner to help leaders make the appropriate decisions based on their unique value proposition and vision.”
Theran Colwell, risk management director for CUNA Mutual Group, is in a unique position to see the many risks facing credit unions.
“As an insurance provider, we’re in a position to see emerging trends,” he says, noting three of the biggest risks currently facing credit unions:
Another danger is treating one risk as a sole focus of attention, rather than looking at risks in their entirety, says Ferris. That’s why credit unions should embrace ERM, which he defines as “a portfolio of all the decisions an organization can make.”
Ferris says risk drives every engine in every enterprise. “We don’t talk about ‘risk,’ we talk about goals, objectives, and ways to mitigate the effects of risk taking.”
He broadens the concept of risk to include talking about the opportunities it presents. “We look at, calculate, and analyze both the upside and downside of risks. Ironically, the biggest risk credit unions now face is not seizing opportunities.”
Risk across the enterprise
Colwell says the key word in ERM is “enterprise.”
“You can’t operate ERM in silos,” he says. “It must consciously involve all levels of your organization.”
Ferris agrees. “At the board and C-suite level, they’ll oft en quickly get on board with our concepts of risk—it helps that we’re able to quantify each risk that’s on the table.
“When you point out that organizations may be leaving money on the table, how they respond depends on their level of risk tolerance,” he continues. “In some instances you may be talking about multiples of earnings.”
Ferris says some credit unions resist proactive risk management, seeing ERM solely as a way to check off regulators’ demands, or search for gaps or bad performance.
“But ERM is so much more than compliance,” he says. “We approach individual risks, then layer it up: What is the net bottom-line effect of an event over the next 12 months? How much can we or do we control?”
ERM best practices
“Although we’re not an ERM provider,” says Colwell, “we know the best steps to take to establish good ERM practices.” These include:
“Where credit unions often fall short is in not fully utilizing all the free risk management tools and resources we offer our bond policyholders,” Colwell says. “They can sign on to our Protection Resource Center where the dashboard allows them to see their risks relative to other credit unions’, to view one of our webinars, or to have us conduct face-to-face or virtual assessments of their processes and risk, followed by a written assessment.”
He cites three essential risk management steps:
Ferris says most ERM providers talk about protecting an organization instead of nurturing a willingness to seize opportunities.
“Credit unions don’t have a big incentive to take risks, in part because they don’t report to stockholders,” he says. “So they can overreact to situations that don’t call for alarm.”
One of the biggest issues facing credit unions, Ferris says, is underestimating the loss of staff talent. “Talent drives the credit union industry. Knowing how to hire talent is important because it affects the bottom line. You can hire cheaper help, but it will cost you if that help is not up to taking risks that increase the bottom line.”
Ferris says The Rochdale Group helps credit unions create a riskfocused culture and process. “We emphasize the psychology of the staff, including the all-too-human behavior of becoming complacent once you’ve achieved success.”
Ferris warns against the danger of playing it too safe.
“A credit union won’t die all at once from such decisions,” he says. “But it may die the death of a thousand cuts.”