Irish League of Credit Unions, 2012 W E L O O K A T T H I N G S D I F F E R E N T L Y Risk Management - Principles & Process UCC Summer School May 2013 Kevin Loughnane & David Matthews Risk Management - Principles & Process UCC Summer School May 2013 Kevin Loughnane & David Matthews

Irish League of Credit Unions, 2012 W E L O O K A T T H I N G S D I F F E R E N T L Y Objective To provide you with an overview and understanding of risk management: Rationale, terminology Components of a risk management system, Benefits of risk management How you might go about doing it!

Irish League of Credit Unions, 2012 W E L O O K A T T H I N G S D I F F E R E N T L Y 3 Agenda 1.Principles of Risk Management – Definitions & Terms – Process – Risk Appetite & Tolerance 2.Risk Management System 3.Risk Management Structures 4.Risk-Based Approach to Decision Making 5.Questions & Answers Identify Analyse & Measure Evaluate Internal Controls Residual Risk Action Plan

Irish League of Credit Unions, 2012 W E L O O K A T T H I N G S D I F F E R E N T L Y Anytown Credit Union Total Assets €40m Loans€16m Investments€22m Fixed Assets€2m Savings€35m Capital (12.5%)€5m Unattached Savings €28m Issues Loans falling by 12% per annum Savings falling by 3% per annum Limited services for members Premises needs refurbishment Manager and six tellers

Irish League of Credit Unions, 2012 W E L O O K A T T H I N G S D I F F E R E N T L Y A case to consider Introduced “secured” loan product in 2012 PRISM RMP – No risk assessment of major decisions Board view – risk free so no risk assessment required Do you agree? Are there risks associated with secured loans?

Irish League of Credit Unions, 2012 W E L O O K A T T H I N G S D I F F E R E N T L Y 6 Section 1: Principles of Risk Management

Irish League of Credit Unions, 2012 W E L O O K A T T H I N G S D I F F E R E N T L Y 7 Definitions A risk is anything that could impact negatively on your credit union – transactional or organisational Risk Management is a formal process that analyses prevailing risks facing the credit union and identifies appropriate responses for addressing them Impacts: Financial Loss, Disruption to Operations, Reputational Damage, Physical Responses: Accept – Mitigate – Transfer – Avoid

Irish League of Credit Unions, 2012 W E L O O K A T T H I N G S D I F F E R E N T L Y 8 Risk Management Terms Risk Management Culture - a credit union’s collective system of values that shape its risk decisions Risk Capacity – how much risk can we afford to take? Ultimately determined by our capital Risk Appetite* – amount and type of risk that we are prepared to seek, accept or tolerate Risk Tolerance* – our readiness to bear the risk after risk treatments in order to achieve our objectives * Risk Appetite & Risk Tolerance, Institute of Risk Management, 2011

Irish League of Credit Unions, 2012 W E L O O K A T T H I N G S D I F F E R E N T L Y 9 Section 2: Risk Management System

Irish League of Credit Unions, 2012 W E L O O K A T T H I N G S D I F F E R E N T L Y 10 Risk Management System Overview Identify risks Step 1 Analyse risks Step 2 Determine “residual risk” Step 3 Report & Action Plan Step 4

Irish League of Credit Unions, 2012 W E L O O K A T T H I N G S D I F F E R E N T L Y 11 Step 1: Identifying Risks Identify risks (current & future) which could impact upon the credit union Will be similar (but not identical) for all credit unions – Depends on structures, products, services, delivery channels, risk appetite, etc. Description of each risk is important – must be clear and specific! – Should detail impact, event, cause

Irish League of Credit Unions, 2012 W E L O O K A T T H I N G S D I F F E R E N T L Y 12 Step 2: Analysing Risks Impact & likelihood of occurrence – The impact of each risk is scored 1 to 5 – The prevalence (likelihood of occurrence) is scored 1 to 4. Scoring is a subjective exercise – look for consensus Both scores are multiplied to get the risk ranking score Low scoring risks may be excluded High scoring risks taken to next stage

Irish League of Credit Unions, 2012 W E L O O K A T T H I N G S D I F F E R E N T L Y 13 Impact of Risk What is the impact?Score There is negligible or no impact on the credit union1 There is a minor impact on the credit union2 There is a significant impact on the credit union3 There is a very serious impact on the credit union which would undermine the stability of the organisation 4 There is a disastrous impact on the credit union which could result in termination of business 5

Irish League of Credit Unions, 2012 W E L O O K A T T H I N G S D I F F E R E N T L Y 14 Prevalence of Risk How likely?Score This risk is very unlikely to occur1 There is some possibility that the risk will occur2 It is likely that this risk will occur3 It is almost certain that the risk will occur4

Irish League of Credit Unions, 2012 W E L O O K A T T H I N G S D I F F E R E N T L Y 15 Risk Ranking – Fraud RiskScore 1.2 An officer grants several large connected loans to family members / friends A member cashes a number of fraudulent cheques through the credit union resulting in a significant financial loss An officer of the credit union has been transferring funds from dormant member accounts An officer defrauds the credit union of significant sums of money by setting up false loans for fictitious members An officer of the credit union steals a series of small sums of cash from the cash drawer over a period of months. 4

Irish League of Credit Unions, 2012 W E L O O K A T T H I N G S D I F F E R E N T L Y 16 Where to draw the line? Determined by Risk Tolerance and Risk Capacity Financial Loss – relate to your capital – What amount would take your capital ratio below 7.5%? – Total Assets €40m, capital €5m, 7.5% = €3m – Disastrous impact circa €2m, negligible impact €10k – If capital was €4m, disastrous impact would be circa €1m Disruption to Operations - time Reputational Damage – may lead to financial loss

Irish League of Credit Unions, 2012 W E L O O K A T T H I N G S D I F F E R E N T L Y 17 Step 3: Determining Residual Risk This step will determine the threat posed by a risk once internal controls have been considered A control is any measure deliberately put in place to manage risks Determine effectiveness of these internal controls Risk ranking score is multiplied by the controls’ effectiveness scores to determine residual risk

Irish League of Credit Unions, 2012 W E L O O K A T T H I N G S D I F F E R E N T L Y 18 Mapping Internal Controls Paperwork Practices People Policy / Plan

Irish League of Credit Unions, 2012 W E L O O K A T T H I N G S D I F F E R E N T L Y 19 Example: Credit Risk Plan: Loans Policy & Procedures People: Loans Officers, Credit Committee Practices: ICB, credit scoring, lending limits Paperwork: Loan forms, proofs, Credit Agreements

Irish League of Credit Unions, 2012 W E L O O K A T T H I N G S D I F F E R E N T L Y 20 Internal Control Effectiveness

Irish League of Credit Unions, 2012 W E L O O K A T T H I N G S D I F F E R E N T L Y 21 Calculating Residual Risk (Risk Ranking Score) x (Internal Control Score) = Residual Risk 12 x 0.2 = 2.4 (low residual risk) 8 x 0.6 = 4.8 (medium residual risk) 10 x 0.8 = 8.0 (high residual risk)

Irish League of Credit Unions, 2012 W E L O O K A T T H I N G S D I F F E R E N T L Y 22

Irish League of Credit Unions, 2012 W E L O O K A T T H I N G S D I F F E R E N T L Y 23 Step 4: Report & Action Plan Report of findings from audit Process has identified internal controls that must be improved Develop risk response plan Delegate tasks to appropriate officers and set firm deadlines for delivery

Irish League of Credit Unions, 2012 W E L O O K A T T H I N G S D I F F E R E N T L Y 24 Section 3: Risk Management Structures

Irish League of Credit Unions, 2012 W E L O O K A T T H I N G S D I F F E R E N T L Y 25 External Auditor and Central Bank Internal Audit & Board Oversight RM & Compliance Board & staff Members Assets Protecting Your Members Assets

Irish League of Credit Unions, 2012 W E L O O K A T T H I N G S D I F F E R E N T L Y 26 Key Officers Risk Management Officer Implements & maintains RM system Board Resource and oversee RM system & policy Risk Committee Optional body which the RM Officer reports to CEO / Manager Implements internal controls Internal Audit Independent check of controls

Irish League of Credit Unions, 2012 W E L O O K A T T H I N G S D I F F E R E N T L Y 27 Risk Management System Risk Management Officer Internal Audit Risk Committee Manager Board of Directors 1. Conducts audit and reports findings to the board / comm. 3. Improve internal controls and reports progress to board 4. Independently reviews the work of management team and reports to the board 2. Also reports to manager 5. Performance management & policy

Irish League of Credit Unions, 2012 W E L O O K A T T H I N G S D I F F E R E N T L Y 28 Individual Roles & Reporting Officer…Does…Reports… Risk Management Officer Risk audit Maintains RM Policy Consults w/ management team on risk response Training Reports findings to board and manager Manager Maintains system of internal control Reports progress to board Board Oversees RM system & policy Performance manages manager (& RM officer?) Decisions on RM policy and performance via Board Report Internal Audit Independently audits the effectiveness of internal controls Reports issues to the board

Irish League of Credit Unions, 2012 W E L O O K A T T H I N G S D I F F E R E N T L Y 29 Question Think about your individual role in risk management system, is there anything listed that is not within your capability?

Irish League of Credit Unions, 2012 W E L O O K A T T H I N G S D I F F E R E N T L Y 30 Section 4: Risk-based approach to decision making - examples

Irish League of Credit Unions, 2012 W E L O O K A T T H I N G S D I F F E R E N T L Y 31 Purchasing a new premises Risks? Cost as % of assets Cost overruns Location Future valuation Existing premises Disruption to services Member perception

Irish League of Credit Unions, 2012 W E L O O K A T T H I N G S D I F F E R E N T L Y 32 Introducing a new service Positives More services for members Additional income Cross sale opportunities Negatives Compliance requirements Conduct risks Cost v benefit?

Irish League of Credit Unions, 2012 W E L O O K A T T H I N G S D I F F E R E N T L Y 33 Staff Structure Manager and six tellers What if the manager is on leave or gets sick? Manager may spend too much time on admin work No promotional opportunities for staff But – lower cost, quick decisions and communication

Irish League of Credit Unions, 2012 W E L O O K A T T H I N G S D I F F E R E N T L Y 34 Secured loans revisited Loss of income Increased LPLS costs Cannibalisation Wealthy members get a better deal But – what about the risk of not offering them?

Irish League of Credit Unions, 2012 W E L O O K A T T H I N G S D I F F E R E N T L Y 35 Thank you for your attention! Any questions?