How to Prepare for Increased Regulatory Scrutiny With Enterprise Risk Management

While the focus areas identified in the NCUA’s 2024 Supervisory Priorities may seem familiar and fall under well-established regulatory guidelines, it’s also clear that now is the time for credit unions to sharpen their focus on credit risk, liquidity risk, consumer financial protection, cybersecurity and interest rate risk to better prepare for increased regulatory scrutiny. Enterprise Risk Management (ERM) can be a key tool for cooperatives of all sizes to identify warning signs and proactively address potential issues.

Hindsight Is Always 20/20; Preparation Is Key to Avoid Repeating History

As a curious but mostly amateur reader of history, I’m often intrigued by the role financial markets play and the evolution of banking throughout history, particularly during and after banking crises. Banking leaders across history appear to have a knack for developing contemporary methods to repeat historical events. The following is an incomplete list from different eras involving different actors, but any astute reviewer could locate common threads.

• 14th Century Italian Banking Crisis
• 17th Century European Banking Crisis
• 1929 US Great Depression
• 1970s and 1980s Latin America Banking Crisis
• 1990s Nordic Banking Crisis
• 1997 Asian Financial Crisis
• 2007 Global Financial Crisis
• 2010 Eurozone Crisis

In her prolific book “The Lessons of History,” Ariel Durant and her husband Will wrote, “The present is the past rolled up for action, and the past is the present unrolled for understanding.”

As each financial crisis has unraveled, the root causes, once clouded by pressing and immediate incentives, suddenly appear clearly and matter-of-fact in hindsight. We develop more precise risk management practices with each crisis, renewing our confidence to navigate the uncertainty a little longer. On the surface, this iterative process may appear futile; however, upon closer examination, each iteration slowly but steadily leads to more prudent banking practices, indirectly lifting the standard of living for future generations.

More Prudent Banking Practices

Regulators across the U.S. financial system are presented with quite a daunting task and are largely blamed for failing to act with armchair quarterback precision post-crisis. We know from history that financial crises happen, and the next one is not a question of if but when.

How is your institution preparing? Are you ready for increased regulatory scrutiny? Are you positioned to differentiate your institution positively, illustrating your risk management practices concisely and clearly?

We are all very familiar with the headline regulatory reforms and developments in risk management practices since the Global Financial Crisis (“GFC”). One of the more understated developments in response to the GFC was the emphasis on banking leadership to articulate their institution’s risk-taking philosophy.

This process resulted in the formal development of a risk appetite statement – a document that articulates risk guidelines across a complete risk taxonomy. Along the way, the risk appetite statement has gained traction, generating valuable discussion internally and allowing for a better understanding of how the institution views its risk exposure. It has evolved into the most efficient document to communicate the institution’s risk management practices, whether that communication is to the management team, the Board of Directors or the regulator.

Does your credit union have a risk appetite statement? If you do, does it meet the following criteria?

• Promotes proactive engagement from top-down Board leadership and bottom-up management in identifying, monitoring, measuring and reporting risk exposures;
• Embeds a risk-taking philosophy into the institution’s culture;
• Act as an inhibitor against excessive risk-taking and risk-avoidance; and
• Promotes a dialogue between management and the Board of Directors on whether the institution is achieving an appropriate balance between risk and reward.

A risk appetite won’t spare your institution from the next financial crisis, but it will help prepare you to navigate the uncertainty. If you haven’t developed a risk appetite statement or your existing statement collects dust in between its annual stamp of approval, here are several tips for a successful statement.

• Don’t stress over your risk taxonomy or comprehensive framework of risk categories. Your analysis matters more than your structure. There isn’t a U.S. regulator that prescribes a specific risk taxonomy. It’s recommended to use a proven and flexible method to categorize risks. Stick with the proven primary categories of credit, market, liquidity, operational, compliance and strategic, and allow sub-categories to develop within the aforementioned primary categories according to your institution’s needs.
• Risk exposures are derivatives of the products and services the institution offers. Itemize your products and services against your risk taxonomy to identify inherent risk drivers. Leverage your risk appetite statement to set forth allowed and disallowed products and services explicitly.
• Evaluate your strategic plan for risk drivers. What are the objectives? What are the internal and external threats? How might a strategy focused on increasing digital market presence differ from a strategy of deploying an ITM network? How does your balance sheet strategy influence your market and liquidity risk appetite?
• Integrate your stress test (IRR, capital, liquidity, etc.) scenarios and results into your risk appetite.
• Consider the macroeconomic data used during your budgeting and CECL process while developing the inherent risk factors.
• Leverage peer benchmarking data to challenge your risk appetite position. For example, I’ve worked with institutions whose credit risk appetite is “low”; however, their past due loan and concentration metrics, compared to the industry, would indicate a very different story.

Throughout history, banking crises have been associated with a range of factors, including economic imbalances, speculative bubbles, inadequate regulation and financial innovation. Each crisis has contributed to the evolution of financial regulations and risk management practices in an effort to prevent or mitigate future crises. How can you successfully navigate the uncertainty if you haven’t developed a process to communicate your enterprise risk? Take the time to develop a meaningful risk appetite statement and consider tapping the outside expertise of an industry partner, as needed, to help you monitor and manage your risks. Your regulator will thank you, your Board will thank you and history may just be on your side during the next crisis.

Ben Schexnayder is Director, Enterprise Risk Management for ALM First in Dallas, Texas.