Financial institutions are facing many risks in today’s banking landscape, from interest rate and liquidity risk loan portfolio risk to the impacts of increased capitalization rates, and so on. As a result, regulators are heightening their scrutiny, challenging banks and credit unions to strengthen their risk management efforts.
Increasingly examiners are requesting the data behind your controls — for example, vendor management policies and vendor external audit reports. The added attention may have been prompted by bank failures earlier in the year, but we’re likely to see increased scrutiny for some time as well as an expanding focus from particular areas of the organization to overall enterprise risk management (ERM).
It’s critical to be proactive to protect your bank from regulatory criticism during examination as well as to reduce exposure to the risks you face as you carry out your operations and serve your customers. The costs of not taking action are high: business disruption and financial losses if your institution experiences a risk event, reputational damage, reduced investor confidence, and potentially, the failure of your bank. Here’s are three ways to develop a proactive approach:
1. Develop a structured and robust ERM framework
A comprehensive ERM framework can help your bank comply with regulatory requirements and demonstrate a commitment to risk management best practices across your institution. Many community banks and credit unions think they’re too small to need a formalized ERM approach, but this is exactly what regulators are signaling they want to see.
An ERM framework should include processes for overall risk identification and assessment and, for each risk area, determination of the institution’s risk appetite and tolerance, designated ownership and accountability, and mitigation strategies. You’ll also want to document for examiners the reason why you believe your efforts are adequate.
A structured approach to ERM also helps you better direct your resources. It provides insight into the institution’s risk tolerance and can show you where you may be dedicating too many resources (for example, to risks that fall below your risk appetite) or too few (to risks that sit above it). With this information, you can reallocate limited resources to the areas where they’ll serve you best.
2. Enhance monitoring, reporting, and communication
Implementing effective risk monitoring and reporting processes can help community bank managers proactively identify and address emerging risks and avoid overlooking those that historically may have posed less risk. These processes should include regular review of risk exposures, mitigation efforts, and compliance with regulatory requirements.
Managers should also maintain open lines of communication with regulators, providing timely and accurate information about the bank’s risk management practices and any issues it’s identified.
3. Promote a strong risk culture and governance structure
It’s vital for risk management to be integrated into your institution’s strategic planning and decision-making processes. This starts with setting a clear tone at the very top, with senior management and your board of directors actively involved in risk management activities.
Managers also play a role in fostering a risk-aware culture, encouraging open communication about risks, and promoting accountability for risk management. Talent management is a key piece here. Ensure you have the right people with the right expertise responsible for the right risk areas, operations, and business processes. The branch teller you’re hoping to move into a management role may be better prepared to lead branch operations than deposits or compliance, for example. Routinely consider training needs so staff possess the knowledge and experience required for their respective areas of risk accountability.
As a core philosophy, you want your team to remain vigilant regardless of their position. You can encourage this with open communication and a “see something, say something” tone in all areas of the organization. From the newest college-grad hire to your longstanding staff, you want individuals to speak up when something doesn’t make sense. A high level of communication around and ownership of risk is critical, and it hinges on your people.
There’s opportunity in holistic risk management
In our current environment, financial institutions tend to be hyperfocused on liquidity and market risk. The focus is not unfounded, but think about it as a springboard for a more proactive, holistic approach that includes general compliance and operational risk across your institution.
Proactively formalizing your ERM program demonstrates management’s commitment to strong risk management practices. It reduces the likelihood of regulatory issues as well as the identified risks themselves. And, ultimately, it mitigates the threat of increased regulatory scrutiny.
And keep in mind that risk management isn’t static. True enterprise risk management is a dynamic process that incorporates both quantitative and qualitative factors to adapt to the ever-changing risk landscape. It's not just about identifying and mitigating risks but also about leveraging potential opportunities that arise from these risks. Financial institutions can only be genuinely ready for the unforeseeable challenges and opportunities of the future if they view ERM as a multifaceted, continuously developing discipline.
Formalize your risk management activities, but don’t overengineer. Assessment, implementation, monitoring, reporting. Carried out in a systematic way, ERM helps you maintain your bank’s reputation, protect the job security of your workforce, and demonstrate your commitment to the clients and community you serve. And whether you work with a trusted advisor or lead the initiative internally, the most important factor in mitigating risk is time — don’t wait to get started.
