ALEXANDRIA, Va.–Members of the NCUA board heard an update on the agency’s Risk Appetite Statement, with one board member urging credit unions to take a “fresh look” at their own existing risk appetite statements or to begin the process.
The board voted 3-0 in favor of approving the statement.
Addressing the board and offering the update were Rendell Jones, deputy executive director in the Office of the Executive Director, and Jim Holm, supervisory budget analyst in the Office of the Chief Financial Officer. The statement was created and updated by NCUA’s Enterprise Risk Management Council
Jones said the risk management statement is a management tool to provide guidance to the board on the amount of risk the agency is willing to take to reach its objectives, while Holm said the current risk management philosophy was approved by the board in March of 2022.
The statement is based on eight risk categories: Technology and IT risks, supervision risks, human capital risks, legal and regulatory risks, operational risks, governance and strategic risks, financial management risks, and external risks.
Averse Risk Appetite’
Chairman Todd Harper, who credited Board Member Rodney Hood for encouraging the NCUA to take a holistic approach to its enterprise risk management program, and Vice Chairman Kyle Hauptman for improvements to the final document, said he will ensure the agency permits innovation to continue within the credit union system, adding he was pleased to see NCUA has an “averse risk appetite when addressing identified safety and soundness concerns at credit unions. This means we will be risk-focused and ready to act expeditiously, if needed.”
“Risk may be unavoidable when carrying out the NCUA’s safety and soundness and consumer protection missions. However, this enterprise risk appetite statement establishes boundaries for the NCUA on the risks it is willing to accept. Effective enterprise risk management and a well- articulated risk appetite are solid management practices for federal agencies and credit unions alike,” Harper said. “A sound risk appetite statement creates an understanding needed to achieve organizational objectives. Further, the NCUA’s enterprise risk management program models the behaviors the agency expects of all credit unions.”
CUs Urged to Take ‘Fresh Look’
Noting the increasing use of mobile apps and online banking by members and the increasing potential for cyberattacks, Harper encouraged credit unions to take a “fresh look” at their existing risk appetite statements or to begin the process of adopting a risk appetite statement.
“Assess the potential risks your institutions face. Implement processes and structures to manage those risks appropriately,” Harper said. “It will ensure your credit union can adapt to the changing marketplace and weather all challenges.”
Hauptman: Many Lessons Have Been Learned
Vice Chairman Kyle Hauptman said that over the past two years the agency and credit unions have learned a lot about their tolerance of risk.
“When deposits flooded into credit unions, and net worth ratios were dropping, we came close to calling for a premium for the share insurance fund. It took courage and patience to battle back our aversion to risk,” said Hauptman. “In hindsight, it was the right decision as it allowed credit unions to keep helping members rather than making us more comfortable. The beneficiaries were credit union members – average consumers.”
Hauptman said some credit unions experienced “difficult lessons” during the pandemic, including delaying digital transformation projects.
“We know there are risks in acting, but not doing something is also a risk,” said Hauptman. “There are a lot of reasons why a credit union might not want to move forward with a project. One of those considerations could be how an examiner might view the risk of spending of capital to achieve business goals.”
Hauptman noted the NCUA’s Risk Appetite statement is designed to:
- Encourage consistency in understanding, measuring, and managing risk across the enterprise while fostering credit union system innovation and growth.
- Show acceptance of some risk is often necessary to foster innovation and agility.
- Ensure credit unions manage their risk…and maintain their ability to evolve and compete effectively through innovation.
- Encourage implementation of policies and regulations to address emerging and innovative products and technologies that foster credit union system competitiveness, consistent with consumer financial protection.
Hood: ‘You Cannot Avoid Risk’
Noting risk cannot be avoided, Board Member Rodney Hood observed, “Today’s board item probably could have been done via notation vote, but I am glad the chairman elected to do this in a public forum because it is a good opportunity to discuss holistic risk management for credit unions, as well. Enterprise risk management is something that I have cared about since my previous time on the board, when I did Enterprise Risk Management Summits for the credit union industry over a decade ago, and ERM is still relevant today.”