WASHINGTON — The financial services industry is a risk-takingindustry, NCUA Deputy Director of the Office of Examination andInsurance Tim Segerson told CU Enterprise Risk Management traineesduring a lunch speaking slot Oct. 1 at the Capital Hilton. Creditunions that don't take risk earn less income, which makes them arisk to the share insurance fund, he said.

To effectively regulate risk, Segerson said the NCUA hasinstructed its examiners in its Examination Guide to step back from examination details and keyratios and think about the big picture. Examiners are also supposedto assess management's ability to correctly identify and managerisks.

That marks a long-term trend away from mathematical CAMEL matrices to a more qualitative review, which began in2003 when the NCUA began conducting risk-based exams, he said. Now,examiners implement an enterprise risk management approach in whichthey review seven risk categories–credit, liquidity, operational, reputation, interest rate, strategicand compliance–and weigh how they fit into the CAMEL matrix.

Those seven categories are very close to the seven riskcategories that make up enterprise risk management, according to anintroductory guide to ERM provided by the event's sponsor, TheSafety & Soundness Report. According to the guide, which wasreviewed in depth by instructor Bill Nayda, principal of the GlenAllen, Va.-based Second Pillar Consulting, the seven riskcategories that an effective ERM program address mirror the NCUA'sexam reviews, with the exception of compliance replaced bylegal.

The guide also repeats what Segerson said, that credit unionsshould be monitoring several risk categories and how one categorymay affect another.

“When NCUA or state examiners arrive for your next regularlyscheduled exam, your CU will need to have not just a sophisticatedunderstanding of ERM but also daily policies and procedures inplace to address potential and existing risk to your institution,its products and services, and your members,” the guide said.

Segerson confirmed that examiners don't just expect a creditunion to manage current risks but also be prepared to respond torisks of the future. He said he has repeatedly seen creditunions  experience risks that have emerged and grown soquickly, they've been shuttered within 18 months.

While an ERM program may just seem like additional work, butNayda said the discipline can actually make life easier for boardand committee members because the use of ERM tools prioritize acredit union's most important risks. That's a relief from monthlyboard packages that can grow to be two or more inches thick, hesaid, because they include full reports on all risks. Instead, ERMprograms use heat maps and peer benchmarks to show where true risklies. Managers can then refer volunteers to reports and data ifthey want to dig in deeper on a particular risk topic, he said.

Credit unions tend to be good managers of credit, liquidity andinterest rate risk, but they struggle with overhead risks such asoperational, reputation and legal, Nayda said.

The biggest hurdle to overcome in managing operational risk ishaving a game plan, he said.

“For example, a football team has a different play for first and10 versus fourth and one,” he said. “It all depends on how manyyards to go, so quantify your risks.”

Ways to quantify operational risk include reviewing internaldata and loss histories for bad wires, incorrect posting and otheroperational events that may already be documented by internalaudits.

The benefits of operational risk management include more preciseinsurance coverage and lower premiums, he added.

ERM also helps credit union managers show examiners they are ontop of risk management. Segerson provided a Top 10 list of examinerred flags when evaluating effective risk management that include alack of commitment to risk management, disengaged leadership,concentrated power over decision making, failure to adhere topolicies and procedures, disproportionately high yields compared torisk, and misaligned incentives.

Paying lending executives on volume without concern to qualityor sustainability will take credit unions down quickly, the examdeputy said. In fact, although he declined to name names, Segersonsaid volume-based incentives were the reason behind a credit unionfailure earlier this year.

The NCUA is working with nine other regulatory agencies to writenew rules that limit incentive-based compensation plans mandated bythe Dodd-Frank Act, he added.