Risk, by definition, implies uncertainty. In today'sever-changing regulatory environment, credit unions must developand implement an effective enterprise-wide compliance riskmanagement program to mitigate and manage their compliance risk. Tobe clear, risk management is not the elimination of risk, butrather the responsible balancing of risk versus reward. In order toeffectively manage compliance risk, credit unions must conductcompliance risk assessments on their products, services,operations and the regulatory impact on such. You cannot mitigaterisk if you do not know it exists.

A compliance risk assessment is used to identify risk to thecredit union and its members (both consumer and commercial) byincorporating the inherent risks in a particular line of business,product or service and the quality of controls implemented by theinstitution to manage and mitigate those risks. An effectivecompliance risk assessment should include, at a minimum, riskidentification, measurement, control, monitoring and reporting.During my 20 years in the industry, I've found there are five keycomponents that contribute to the success of a compliance riskmanagement program.

1. Put a system in place.