With the issuance of NCUA's Letter to Credit Unions (10-CU-03) on concentration risk, many credit unions are taking a long look at their overall risk-management processes.
Generally, the letter provides guidance on how the NCUA and, by extension, other regulators, will review concentration risk. Credit unions should take advantage of this opportunity to assess and fine-tune not only their concentration-risk management methods, but also their broader-reaching enterprise risk management (ERM), allowanceand product-profitability capabilities.
NCUA's Key Points
Letter 10-CU-03 deals with the key processes, policies and systems a credit union should have in place to anticipate, manage and track concentration risk across all aspects of its operations. Listed below are some of the highlights:
• Identify the risk in each product or service line, quantify it and set appropriate concentration limits, based on the analysis.
Look across types of assets to consider the layered effects of concentration risk from different products and services, such as similar risk exposures from holdings of mortgage loans and mortgage-backed securities.
• Perform a risk assessment that demonstrates an understanding of the risk associated with a product or service, quantifies potential loss exposure, and documents a rational business decision on the acceptable concentration level, based on the analysis.
• To ensure good data, make use of data-warehousing services so the credit union can monitor changes in risk exposures over time.
• Measure the individual risks against net worth, as well as the consolidated risk level.
• Establish board policies on concentration limits related to net worth, with a rationale on the basis for those limits in the context of the credit union's strategic plan.
• For more complex credit unions, establish a risk-management committee, composed of senior managers and possibly board members, to monitor overall risk management processes.
Meeting These Requirements
At The Rochdale Group, we believe many, if not most, credit unions already meet the majority of NCUA's requirements. Thus, they should strive to meet the provisions of Letter 10-CU-03 not through a single process or checklist, but by employing a collection of effective risk-management practices.
In addition, keep the right goals in mind as you go about this work: producing actionable information that you can use to meet your board's strategic objectives, while optimizing your returns at a given risk level. By improving risk-based pricing, you can weed out undesirable underwriting buckets, and improve your overall balance-sheet positioning, among other results.
Steps To Consider
• Board policies. Ensure your policies set comprehensive concentration limits for asset and liability classes consistent with your credit union's risk posture and capital position.
• ERM. Establish a structured ERM process to periodically identify, assess and act on your credit union's key risk exposures. Coupled with the work your credit union already may be doing in support of ALCO and credit committee functions, you will be able to identify situations where A/L concentrations have undesirable effects on credit, interest-rate, liquidity and other risk exposures. Identifying and understanding the factors that influence such exposures will lead your credit union to the types of detailed, multi-dimensional analysis it must perform to appropriately track and manage its risk exposures.
• Analyze external events. Using the ERM process, analyze the layered effects certain external events will produce across all areas of the operation. This will augment the scenario analysis on various risks most credit unions already perform.
• Capital calculations. Use economic capital calculations to measure your credit union's overall risk position against its capital. Economic capital represents an estimate of your potential exposure to losses in a near-worst-case scenario. Comparing such calculations with actual capital provides a means of determining your credit union's capital adequacy, given its unique portfolio of risk exposures.
• Diagnostic review. All credit unions would be well-served by completing a diagnostic review of overall risk-management processes compared with the requirements of Letter 10-CU-03. The review should include an inventory-like description of current risk-management policies, analyses, and systems.
Generally, the review will show that your credit union meets most requirements for managing concentration risk, while also identifying several opportunities for improvement. You can use the results to gain a better view of how your credit union's processes combine to manage concentration risk-valuable when demonstrating risk-management expertise to external parties, such as examiners and auditors. Implementing the identified improvements also will help your credit union improve its risk-return performance and enhance its strategic direction.
Bottom Line
At first glance, the concentration-risk requirements outlined in Letter 10-CU-03 seem daunting to most credit unions, but they likely just represent a more coordinated application of your existing risk-management processes-not a need for wholesale changes.
The best way to ensure compliance is to take an enterprise-wide approach to risk management. Your credit union should review your existing practices in the context of the letter, and then implement the changes that are beneficial for your credit union, given your unique exposures and risk posture.
Scott Hood is a consultant with The Rochdale Group, and has experience in risk management, process improvement and other strategic initiatives. He can be reached at 913-890-8014.
