What is your credit union’s appetite for risk?

The Rochdale Group’s consultants work with a large number of credit unions of all sizes that are in a variety of stages in implementing Enterprise Risk Management (ERM) programs. One of the most common questions we field in helping credit unions implement ERM programs is “how do we set the risk appetite for our credit union?” Although all of these credit unions already have a wide variety of risk management practices in place, few, if any, have taken steps to objectively think about their appetite for risk and, maybe more importantly, determine if their current actions are consistent with their risk appetite. This article will present the initial steps a credit union should take to address these issues.

All credit unions employ a large array of risk management practices. These include loan underwriting, collections, loss mitigation, fraud prevention, asset/liability management (ALM) modeling, information security, business continuity planning, vendor management, insurance analysis and other techniques. Within these areas, credit unions either voluntarily or due to regulation set many risk limits. These include various loan underwriting criteria on loan approvals such as credit ratings, loan-to-value ratios, debt-to-income ratios, and other factors, as well as concentration limits on broad types of loans and more specific limits based on other metrics. They use investment diversification guidelines to limit investments by type, maturity, credit ratings, optionality, and other cash-flow characteristics. Credit unions also set limits on interest rate and liquidity risk using net interest income (NII), net economic value (NEV), liquidity and other modeling, often around the allowable changes in these parameters in different interest rate scenarios. Credit unions clearly set a large number of very specific limits on their risk-taking activities.

These same credit unions will go on to tell us that they are “very risk averse,” “low risk,” “conservative,” or feel as if they have some other general level of riskiness. Given this tremendous amount of information and effort, why do all of these credit unions still feel lost in determining and understanding their risk appetites? The answer is that very few of them have taken the next steps of discussing their risk appetites, documenting those revelations, and then using those principles in guiding their strategies and making decisions.

A credit union should take several steps in determining its appetite for risk.

Step One – Hold a Qualitative Risk Appetite Discussion

Although most credit unions tend to have a general perception of their overall risk profile, very few of them have taken the time to hold structured discussions on risk appetite, at the board or senior management level. Thus, the first step is to hold a qualitative risk appetite discussion. This will provide an opportunity to introduce the entire risk appetite topic, and give participants the chance to articulate the credit union’s appetite for risk. Moreover, we find that the participants enjoy this opportunity to provide their input in reaching a consensus view of the credit union’s risk appetite.

A key consideration here is selecting the group for this discussion. Some credit unions hold these sessions with their boards while others prefer to hold the sessions with senior management and then present resulting recommendations to their boards for review and approval. The COSO Integrated Framework for ERM suggests formulating the credit union’s qualitative risk appetite first at the management level, with discussion and approval by the board.

We suggest approaching this with a facilitated discussion on the credit union’s willingness to assume risk in a variety of situations. We develop a list of questions structured around either balanced scorecard groupings (e.g., financial, people, members, process and compliance) or risk categories (e.g., compliance, credit, interest rate, liquidity, reputation, strategic and transaction risk) to pose to the group. We generally develop three to five questions in each category. In the Members category, a representative question might be “How willing are you to create dissatisfaction by growing market share at the expense of current members?” A question in the Financial category might include “How willing are you to accept above-average charge-offs if loans are priced commensurate with their risks?” We first like to present the questions individually to management and/or the board members in anonymous surveys, and then compile the individual results. The facilitated session then reviews the results of the individual surveys, highlights areas of differing opinions, and strives to get the group to reach consensus on the risk appetite in each situation. We find a surprising level of agreement on risk appetite in most areas, but the surveys reveal striking differences in at least a handful of areas. It is the discussion of the commonalities and resolution of the differences that helps management and the board really understand and articulate the credit union’s appetite for risk.

Step Two – Develop Risk Appetite Statements

So how do you leverage these first-ever discussions on risk appetite? We suggest using the results to draft qualitative risk appetite statements that will provide guidance to management and staff. Think about the qualitative statements in much the same way as your credit union’s mission statements or core values. The qualitative risk appetite statements won’t replace other risk limits but they will articulate the credit union’s appetite toward assuming risk in a variety of situations. In most cases, these statements will be the first documentation of how the credit union wants to approach risk management in a broad sense. The statements will provide management and the board with the power to judge their actions within the broader context of a risk appetite framework. This will empower management to more freely make decisions because they now will have a roadmap of risk appetite, knowing they will have the full support of the board while operating within the risk appetite parameters.

Step Three – Communicate the Qualitative Risk Appetite Statements

Much like the credit union’s mission and strategic plan, the qualitative risk appetite statements will be most effective only if you communicate them to your people. At a minimum, present the risk appetite statements to your board and senior management. Also, think about holding an internal campaign to explain the statements and their intent. Ask your people to think about the statements as they go about their normal activities. As you re-evaluate existing products, services and processes, or develop new ones, “throw them up against the qualitative risk appetite statements to see if they stick.” We like to provide examples of current activities at the credit union that fit and do not fit with the statements. It then will be up to management and the board to make decisions as to whether the credit union should modify certain activities to better fit with the qualitative risk appetite.