Notes provided by: Deonna Grimes
Every risk management program should have
the following components:
Risk Identification (where are the risks?)
 Risk Measurement (how bad is it?)
 Risk Control (mitigating factors)
 Risk Monitoring (systematically review to
ensure key components have not changed)

Creating an ERM program can be difficult. An
effective program requires cooperation from
everyone in the organization
Key players in an ERM program include:






Board of Directors and CEO (have ultimate
responsibility for ERM)
Senior Management (likely have the biggest roles)
Department/Business Units
Support Functions
Internal Audit and Compliance
Risk Management (if resources allow)


Determine and document risk appetite. This
is the credit union’s chance to strategically
establish its risk tolerance (i.e. the capacity to
take risk and tolerance for potential loss)..
Although certain tasks may be delegated to
management, the Board and CEO are
ultimately responsible for all of the risk in the
organization
Categories of Risk:







Credit Risk
Interest Rate Risk
Liquidity Risk
Transaction Risk
Compliance Risk
Strategic/Reputation Risk
Fraud risk
Transaction Risk
 Risk to Earnings and Capital
 Arises from a Credit Union’s Inability to deliver
products or services, maintain a competitive
position, and manage information
 This type of risk is usually the result of:
- Fraud and errors
- A function of internal controls, operating
processes, information systems, and
employee integrity
Two Primary Types of Internal Fraud
1. Financial Misstatement—financial reporting fraud. Recent
economic conditions have resulted in a “spike”
2.
Embezzlement—can have direct and indirect
consequence
Formula

Motive

Opportunity—one thing we can control. Credit
unions can minimize opportunity through controls

Rationalization
The credit union made it too easy for the perpetrator.
Increased opportunity through:
Lack of supervision
 Lending committee approval is a sham (nothing
but a rubber stamp)
 Ineffective controls—loan reports are not
validated
 Separate data system was not integrated into the
credit union’s controls

Opportunity presented itself when the two
tellers shared their codes, and keys.
Mitigation Strategy
 Enforce segregation and password controls
 Periodic “full” audits with proper timing
 Training and education