With the issuance of NCUA's Letter to Credit Unions (10-CU-03) on concentration risk, many credit unions are taking a long look at their overall risk-management processes.
Generally, the letter provides guidance on how the regulators, will review concentration risk. CUs should take advantage of this opportunity to assess and fine-tune not only their concentration-risk management methods, but also their broader-reaching enterprise risk management (ERM), allowance and product-profitability capabilities.
NCUA's Key Points
Letter 10-CU-03 deals with the key processes, policies and systems a CU should have to anticipate, manage and track concentration risk across all aspects of its operations. The highlights:
• Identify the risk in each product or service line, quantify it and set appropriate concentration limits, based on the analysis.
• Look across types of assets to consider the layered effects of concentration risk from different products and services, such as similar risk exposures from holdings of mortgage loans and mortgage-backed securities.
• Perform a risk assessment that demonstrates an understanding of the risk associated with a product or service, quantifies potential loss exposure, and documents a rational business decision on the acceptable concentration level, based on the analysis.
• Make use of data-warehousing services tomonitor changes in risk exposures over time.
• Measure the individual risks against net worth, as well as the consolidated risk level.
• Establish board policies on concentration limits related to net worth, on the basis for those limits in the context of the CU's strategic plan.
• For more complex credit unions, establish a risk-management committee, composed of senior managers and possibly board members, to monitor overall risk management processes.
The Rochdale Group believes many CUs already meet the majority of NCUA's requirements. Thus, they should strive to meet the provisions of Letter 10-CU-03 not through a single process or checklist, but by employing a collection of effective risk-management practices.
In addition, keep the right goals in mind: producing actionable information that you can use to meet your board's strategic objectives, while optimizing your returns at a given risk level. By improving risk-based pricing, you can weed out undesirable underwriting buckets, and improve your overall balance-sheet positioning, among other results.
Steps To Consider:
1) Board policies. Ensure your policies set comprehensive concentration limits for asset and liability classes consistent with your credit union's risk posture and capital position.
2) ERM. Establish a structured ERM process to periodically identify, assess and act on key risk exposures. Coupled with the work your CU already may be doing in support of ALCO and credit committee functions, you will be able to identify situations where A/L concentrations have undesirable effects on credit, interest-rate, liquidity and other risk exposures.
3) Identifying and understanding the factors that influence such exposures will lead your credit union to the types of detailed, multi-dimensional analysis it must perform to appropriately track and manage its risk exposures.
4) Analyze external events. Using the ERM process, analyze the layered effects certain external events will produce across all areas of the operation. This will augment the scenario analysis on various risks most CUs already perform.
5) Capital calculations. Use economic capital calculations to measure overall risk position against capital. Economic capital represents an estimate of your potential exposure to losses in a near-worst-case scenario. Comparing such calculations with actual capital provides a means of determining your CU's capital adequacy, given its unique portfolio of risk exposures.
6) Diagnostic review. All CUs would be well-served by completing a diagnostic review of overall risk-management processes compared with the requirements of Letter 10-CU-03. The review should include an inventory-like description of current risk-management policies, analyses, and systems.
Generally, the review will show that your CU meets most requirements for managing concentration risk, while also identifying several opportunities for improvement. You can use the results to gain a better view of how your processes combine to manage concentration risk-valuable when demonstrating risk-management expertise to external parties, such as examiners and auditors. Implementing the identified improvements also will help your CU improve its risk-return performance and enhance its strategic direction.
At first glance, the concentration-risk requirements outlined in Letter 10-CU-03 seem daunting to most CUs, but they likely just represent a more coordinated application of your existing risk-management processes-not a need for wholesale changes. The best way to ensure compliance is to take an enterprise-wide approach to risk management. Your CU should review your existing practices in the context of the letter, and then implement the changes that are beneficial for your credit union, given your unique exposures and risk posture.
Scott Hood serves is a consultant for The Rochdale Group, and has experience in risk management, process improvement and other strategic initiatives. He can be reached at 913-890-8014.
