Enterprise risk management: why now? This is a question that many credit unions may be struggling to answer. It must occur to each of you at some point that you have been able to manage risk all of these years without it.
Even if that may be true, think about how much has changed in recent years. For example who would have guessed that:
- The economy would take such a drastic downturn and that it would last as long as it has?
- Charge-offs and delinquencies would be as significant as they are?
- Margins would erode to the extent that they have?
- Few of us can say that we saw the full extent of what was to come. Although the implementation of Enterprise Risk Management (ERM) may not have given you the complete answers to these questions, if utilized correctly, they should have been on your radar. If they were, this may have given you the opportunity to mitigate some of the risks associated with these challenges.
- An effective ERM program is a proactive approach to managing risks and opportunities. Rather than simply looking at current risks within your organization, you would be looking for potential risks as well. A few ways this can be accomplished is by:
- Completing a Risk Appetite Statement that identifies how much risk you are willing to take and then aligning strategic objectives to remain within your risk appetite.
- Taking an enterprise wide view of risk and how risks associated with one area may also affect other areas within your financial institution.
- Completing risk assessments on the processes or products that have the highest degree of risk associated with them and then developing plans to mitigate those that were identified.
NCUA's Definition Of ERM
According to the NCUA, "Enterprise Risk Management is a comprehensive risk optimization process that integrates risk management across an organization. An organization's board of directors ultimately makes the decision to develop and implement an ERM framework, often with the goal of aligning risk with strategic objectives."
NCUA has recently released guidance and expectations regarding enterprise risk management. This is another answer to "why now." Regulators have increased their scrutiny regarding how financial institutions are managing risks. To what degree is dependent on the size and complexity of the organization.
So if all of this is not compelling enough, maybe the question to ask yourselves is why not?
Patty Graves is director of risk management with The Paragon Group. She can be reached at
