Ken Schaafsma likens setting a risk threshold to crossing a speed bump. When you’re about to make impact, it’s time to slow down.
"Sometimes risk appetites are quantitative, sometimes they’re qualitative,” says Schaafsma, vice president of enterprise risk management (ERM) and chief risk officer at $10.6 billion asset Alliant Credit Union in Chicago. “Most of the time, they’re both. Below that risk appetite level, our executives have set tolerance levels—kind of like speed bumps—that warn us when we’re getting close to the risk appetite.”
ERM is one early warning system that allows credit unions to both manage risks and tap new opportunities. The discipline is a comprehensive, organization-wide framework that aligns risk with risk appetite to fulfil strategic objectives.
“ERM helps an organization define, track, and measure risk in a holistic environment,” says Cathy Smoyer, senior vice president and chief risk officer at $8 billon asset Mountain America Credit Union in Sandy, Utah.
It both sharpens strategic thinking and communicates to others in the organization how to deal with risk.
“It allows management to make good, risk-informed decisions,” Schaafsma says. “They can choose to avoid risks. They can choose to reduce risks. They can choose to accept risks. It gives management a framework in which to understand and respond to the risks they face.”
“Business involves taking risks,” says Tony Ferris, CEO of Rochdale Paragon Group, which provides ERM consulting. It’s all about “making business decisions around uncertainties and making that a business process that has a financial return.”
ERM involves identifying risk categories—among them credit, credit, liquidity, transaction, compliance, strategic, reputational, physical, technology, and legal risks—and determining the credit union’s risk appetite for each, or the maximum amount of risk the credit union is willing to accept. The credit union also establishes upper and lower risk tolerances within that appetite.
While the process is complicated, Schaafsma says working through the challenges can be eye-opening.
“Coming to grips with how much fraud we were willing to accept was difficult,” he says. “We don’t like the institution losing money to fraudsters. But we recognize that we can’t have zero appetite for that and stay in business.
"Once we had the difficult conversations and agreed on a fraud risk appetite, it helped provide a roadmap as to how we’re going to deal with our fraud-prevention activities.”
Determining a credit union’s risk appetite can have other lasting benefits, such as sharpening strategic goals and ensuring organizational alignment.
“You really get clarity on your strategic plan,” says Ferris. “It shows how you are aligned, what you have to do, and the expectations for performance.”
At one of Rochdale Paragon’s credit union clients, for example, the board and senior management had a rocky relationship. Ferris says going through the risk appetite process revealed that the board and the executive team had major differences in interpreting strategies.
“We were able to start to align them,” Ferris says. “Everyone started to understand what it would take to accomplish the goals and objectives, and it created more harmony.”