Risk and strategy are big topics this time of year, and for good reason. Yet, risk management (especially enterprise risk management) and strategic planning have traditionally been treated as two separate streams of activities at credit unions. When discussed at all, risk management is often at a cursory level and revolves mainly around credit and ALCO with interest rate, market, and liquidity risk. Other types, such as strategic risk, are often given short shrift. The lack of explicit consideration and discussion creates a risk profile for the institution that exceeds what boards and management teams may be comfortable with — and they may not even know it.
For example, projections and financial objectives are key elements of a strategic plan. However, what is the impact on the projections (both upside and downside) of a given strategy? If launching a new product, what happens if sales don't meet expectations? How will that impact earnings and the opportunity cost of people and capital? If entry into a new market is based on speed, are there processes and capacity to support it? Want to double the investment in social media? What's the impact if the investment is made or not?
These types of questions need to be answered — especially if the credit union's future hinges significantly on it. In many respects, the CU should be stress testing key areas of its strategy and business model, such as payments, delivery channels, etc.
The single most important risk management activity is to define the strategic objectives for the CU and determine the risk appetite to achieve those objectives. To achieve a 1% ROA or serve the members a very specific way, how much overall risk is the board willing to accept?
The risk appetite is a "lens" through which these types of questions and answers would be evaluated. Unfortunately, most credit unions don't have a defined risk appetite, much less engage that depth of discussion during planning efforts.
Let's illustrate Risk Appetite by looking at the diagrams above. The dark blue line represents the projections from the strategic plan. The first is the total range of possible outcomes of a strategic plan. Clearly, no institution is going to accept the variability — and potential losses — without some risk management in place. The second diagram represents a CU's Risk Appetite — the variability that the CU is willing to accept to achieve the projections. So let's revisit the questions earlier about new product and new markets. The board and management need to be looking at these strategies through the risk "lens" to see where things might fall with respect to Risk Appetite — inside or outside the lines. If the right risk management questions are not asked during planning, the CU may actually have a risk profile that is outside of the risk appetite. One could argue that many of the issues from the financial crisis (credit-related and non-credit) were due to leaders being surprised by the institution's actual vs. perceived risk profile.
Incorporating this assessment into planning is not as difficult as it may seem. The business owners of these strategies should have already thought through the risks and opportunities associated with a strategy. Remember, they picked one assumption out of a range of assumptions to put into the projections. I would encourage management and the board to go one step further.
When I was a financial services executive, we created projections, but we also quantified opportunities and risks that helped the board and management understand the variability in the earnings from the proposed strategy. This is the "one step further" or strategy stress testing that I would urge CUs incorporate into their planning process. While it's not meant to be predictive, it creates a vehicle to have more meaningful discussions on strategies and the risks (both good and bad) as well as the opportunities to talk about contingency plans.
Boards and management teams need to tighten the linkage between risk assessment and management with their plans. I strongly urge boards and management to do three things in this year's planning cycle:
- Incorporate risk appetite definition/assessment as part of the planning process, including a candid assessment of the credit union's current risk profile. Stress test two or three scenarios that would impact the plan (positively and negatively) and determine what things can and should be done to manage those potential scenarios.
- Quantify the key opportunities and risks and "append" to financial projections and ensure they are linked to specific strategies and owners
- Risk management is not meant to block initiatives but to foster discussion on improving the upside while managing the downside. As such, it should be an integral part of the strategic planning discussion.
Vincent Hui is a senior director with Cornerstone Advisors, which is based in Scottsdale, Ariz.
