|
What credit unions need to know about enterprise risk management.
By David M. Wallace
In the midst of the continuing economic and financial crisis, our troubled minds may search far and wide for comfort, knowledge and insight. When one of America’s greatest philosophers, Benjamin Franklin, wrote that “where sense is wanting, everything is wanting,” he could be channeling the mind of today’s credit union executive reflecting on risk management.
As this article is being written, the state of the economy overall and the financial services industry in particular remains very uncertain. The National Association of Business Economists forecast in late February that the real gross domestic product for the U.S. will decline almost 1 percent for 2009 while the unemployment rate will rise to 9 percent by year-end.
The credit union industry has also been affected by the crisis. NCUA took action to stabilize the corporate credit union system through its conservatorship of US Central Corporate FCU and Western Corporate FCU. The “Financial Trends in Federally Insured Credit Unions” report from NCUA also highlighted deterioration in loan portfolio quality characterized by rising delinquencies and the average net charge-off ratio, both of which rose by more than 20 basis points in 2008.
In this article I will highlight a few of the crisis lessons that apply to risk management in credit unions. Along the way we will also reflect on some lessons from our good friend Ben.
Failing to prepare
Enterprise risk management (ERM) was recently (and simply) defined by Gregory Monahan in Enterprise Risk Management: A Methodology for Achieving Strategic Objectives as “dealing with un-certainty for the organization.”
The Committee of Sponsoring Organizations of the Treadway Commission (COSO), the industry group formed by several accounting and auditing groups, states that ERM “is a process … applied in strategy setting and across the enterprise, designed to identify potential events that may affect the entity and manage risk to be within its risk appetite, to provide reasonable assurance regarding the achievement of entity objectives.”
Both of these definitions emphasize the focus of ERM on the entire organization.
If we look at the lessons of the current financial crisis, it would be easy to conclude that proper preparation did not occur and that risk was not assessed throughout many organizations. There have been many articles written that discuss how risk management activities were managed in business unit silos of major financial services firms that have since ceased to operate or have been acquired by other firms.
In a September 2008 worldwide risk management survey by the Economist Intelligence Unit, only 35 percent of respondents agreed with a statement that described risk management as being integrated across business units. In the same survey, 70 percent of the respondents stated their belief that failure to address risk management was largely to blame for the credit crisis. Clearly, the lesson from our good friend Ben is that firms were “preparing to fail” by “failing to prepare.”
What should credit union executives do?
Establish a nervous system
1. Ensure that your ERM program includes more than just credit risk. Assess how the combination of credit risk, market risk, interest rate risk, counterparty risk, operational risk and reputational risk could affect your institution.
2. Establish a nervous system of continual assessment of these risks and ensure both senior executives and the board are updated on both the current state and the risks in each category.
One simple technique to use for the nervous system mentioned above is the SOAR (Strategic Objectives At Risk) process Monahan refers to in his book:
■ Setting metrics for each of the defined strategic categories
■ Observing metric values
■ Analyzing movements in metric values
■ Reacting to what the analyses reveal
Monahan also created a simple graphical representation of the SOAR process that is reproduced below by permission.
Don’t rely on credit scores
Another lesson from the financial crisis is related to credit scoring. According to RealtyTrac, in 2008 there were almost 3.2 million foreclosure filings on over 2.3 million properties, an 81 percent increase over 2007. It has been well-documented that the credit crisis began as a consequence of growth in subprime mortgages and the resulting securitizations of these mortgages.
One aspect of the crisis that should be further reviewed is that of standardized credit scores. The FICO (Fair Isaac Corp.) credit score has been a standard measure of consumer credit risk since the late 1980s. In a recent St. Louis Federal Reserve article, economist Yuliya Demyanyk states that an analysis shows “that the credit score has not acted as a predictor of either true risk of default of subprime mortgage loans or of the subprime mortgage crisis.”
According to this research, “the higher the credit score, the larger the increase in serious delinquency rates.” Also consider this remarkable statement made by Lloyd Blankfein, CEO of Goldman Sachs, in a Financial Times article: “… too many financial institutions and investors simply outsourced their risk management. Rather than undertake their own analysis, they relied on the rating agencies to do the essential work of risk analysis for them.”
What should credit union executives do?
Remember the five C’s of credit
1. Don’t just rely on outside credit scoring models.
2. Build in-house models that leverage the information from your credit union’s own experience and information about members and the segments they are in.
3. Don’t just look at analysis of individual loans. Focus on loan portfolio assessment and performance in order to achieve your goals in ERM.
4. Loan concentration continues to be an important risk factor that should be evaluated and monitored.
5. Continue to rescore your portfolios to include the latest information available to stay ahead of the curve on housing values and other factors.
6. The five C’s of credit (character, capacity, capital, collateral and conditions) should continue to be the primary watchwords for lending.
Wescom Credit Union is one institution that has moved beyond only utilizing outside credit scoring information. Anna Mendez, chief credit officer of Wescom, advocates a dual approach that includes both top-down portfolio analysis as well as traditional bottom-up loan level analysis.
She reports that Wescom’s system looks at the past performance of each loan portfolio and correlates it to economic variables available from outside services like Moody’s in order to do loss forecasting.
“We can gauge expectations of economic variables and plan how our portfolio should perform as a result,” said Mendez. “This can include forecasted economic trends, such as a huge unemployment rate, and how our portfolio’s foreclosures and delinquency rates will be affected in that scenario.”
A small leak will sink a great ship
One topic that has come to the fore recently is that of stress testing. The Treasury Department’s Financial Stability Plan discusses stress testing as part of the program to strengthen the banking system.
What is stress testing and what does it have to do with ERM? Simply put, stress testing is a method used to evaluate the potential impact on portfolio values of unlikely, although plausible, events or movements in a set of financial variables.
Stress testing can be used to estimate a portfolio’s potential losses when subjected to exceptional or extreme events. Shocks can be applied to risk factors like interest rates or housing values that, in turn, drive the value of instruments in the portfolio.
In this way, portfolio profit and loss can be examined assuming extreme movements in the underlying risk factors. The stress testing results can then be used by decision makers to diversify a portfolio so that an extreme event will not wipe it out.
Stress testing represents an essential component of an effective risk management framework for both credit and market risk. It is meant to augment traditional risk measures, such as portfolio value at risk, by explicitly capturing events that may occur in the tail of the portfolio loss distribution.
Successfully executing a stress testing program requires a technology framework that enables data, scenarios, analytics and reports to be integrated across the organization. So, what may look like a small leak from one perspective could be seen to be a big leak coming in the future as a result of stress testing.
What should credit union executives do? Stress testing is an ERM best practice today, and it may become a regulatory requirement in the future. You can build a foundation for stress testing now by implementing a firmwide view of risk through ERM. Performing stress testing through various scenarios, including modeling extreme economic events, is the key to risk disaster preparedness.
Final lessons from Ben
For all of us who have experienced the extraordinary events associated with the financial crisis during the past two years, we can take comfort that our friend Benjamin Franklin was able to see into the future to both foretell the crisis and to advise us on the course of action now.
Ben could have been speaking about assessing risks when he stated that “this type of calculation is more complicated and more difficult than one might think. It demands a great sagacity generally above the power of common people. The success of charlatans, sorcerers, and alchemists — and all those who abuse public credulity — is founded on errors in this type of calculation.”
Ben also could have been speaking about credit unions when he observed that “it takes many good deeds to build a good reputation, and only one bad one to lose it.” By staying close to the communities and members that credit unions serve, and by implementing the principles of enterprise risk management, credit union executives can protect the good reputation that this movement has built.
David M. Wallace is global financial services marketing manager for SAS (www.sas.com), a NAFCU Services Preferred Partner.
|
