1. Irish League of Credit Unions, 2012 W E L O O K A T T H I N G S D I F F E R E N T L Y Risk Management for Credit Unions September 2013 Risk Management for Credit Unions September 2013

2. Irish League of Credit Unions, 2012 W E L O O K A T T H I N G S D I F F E R E N T L Y Objective To provide you with an overview and understanding of risk management: Rationale, terminology Components of a risk management system, Benefits of risk management How to do it!

3. Irish League of Credit Unions, 2012 W E L O O K A T T H I N G S D I F F E R E N T L Y 3 Agenda 1.What is Risk Management? – Definitions & Terms – Process 2.Risk Management System 3.Risk-Based Approach to Decision Making 4.Questions & Answers Identify Analyse & Measure Evaluate Internal Controls Residual Risk Action Plan

4. Irish League of Credit Unions, 2012 W E L O O K A T T H I N G S D I F F E R E N T L Y 4 Section 1: What is Risk Management?

5. Irish League of Credit Unions, 2012 W E L O O K A T T H I N G S D I F F E R E N T L Y 5 Risk Management A formal process that analyses risks facing the credit union and identifies appropriate responses for addressing them.

6. Irish League of Credit Unions, 2012 W E L O O K A T T H I N G S D I F F E R E N T L Y 6 Risk Any event that would negatively impact upon the credit union External versus internal Day-to-day versus strategic Current & future Financial institutions must pro- actively manage risk

7. Irish League of Credit Unions, 2012 W E L O O K A T T H I N G S D I F F E R E N T L Y Impact of Risks Financial Cost Disruption to Operations Reputational Damage

8. Irish League of Credit Unions, 2012 W E L O O K A T T H I N G S D I F F E R E N T L Y 8 Dealing with Risk Avoid the risk Accept the risk Minimise the impact of the risk Minimise the likelihood of the risk occurring Transfer the risk (e.g. Insurance)

9. Categories of Financial Risk (PRISM) 9 Strategy / Business OperationalGovernance Credit Environ- ment ConductLiquidity Insurance Capital Market

10. Irish League of Credit Unions, 2012 W E L O O K A T T H I N G S D I F F E R E N T L Y 10 Risk Management Terms Risk Management Culture - a credit union’s collective system of values that shape its risk decisions Risk Capacity – how much risk can we afford to take? Ultimately determined by our capital Risk Appetite* – amount and type of risk that we are prepared to seek, accept or tolerate Risk Tolerance* – our readiness to bear the risk after risk treatments in order to achieve our objectives * Risk Appetite & Risk Tolerance, Institute of Risk Management, 2011

11. Irish League of Credit Unions, 2012 W E L O O K A T T H I N G S D I F F E R E N T L Y 11 Benefit of formal Risk Management Transactional Organisational

12. Irish League of Credit Unions, 2012 W E L O O K A T T H I N G S D I F F E R E N T L Y 12 Conducting a Risk Audit Identify risks Step 1 Analyse risks Step 2 Determine “residual risk” Step 3 Report & Monitor Step 4

13. Irish League of Credit Unions, 2012 W E L O O K A T T H I N G S D I F F E R E N T L Y 13 Section 2: Risk Management System

14. Irish League of Credit Unions, 2012 W E L O O K A T T H I N G S D I F F E R E N T L Y 14 Step 1: Identifying Risks Identify risks (current & future) which could impact upon the credit union Will be similar (but not identical) for all credit unions – Depends on structures, products, services, delivery channels, risk appetite, etc. Description of each risk is important – must be clear and specific! – Should detail impact, event, cause

15. Irish League of Credit Unions, 2012 W E L O O K A T T H I N G S D I F F E R E N T L Y 15 Example: Wording Risks Disruption to operations and reputational damage is incurred when a large number of member records are permanently deleted due to a server failure. 1.Impact: Disruption to operations and reputational damage…. 2.Event: ….a large number of member records are permanently deleted…. 3.Cause: ….due to a server failure.

16. Irish League of Credit Unions, 2012 W E L O O K A T T H I N G S D I F F E R E N T L Y 16 Step 2: Analysing Risks Impact & likelihood of occurrence – The impact of each risk is scored 1 to 5 – The prevalence (likelihood of occurrence) is scored 1 to 4. Scoring is a subjective exercise – look for consensus Both scores are multiplied to get the risk ranking score Low scoring risks may be excluded High scoring risks taken to next stage

17. Irish League of Credit Unions, 2012 W E L O O K A T T H I N G S D I F F E R E N T L Y 17 Prevalence of Risk How likely?Score This risk is very unlikely to occur1 There is some possibility that the risk will occur2 It is likely that this risk will occur3 It is almost certain that the risk will occur4

18. Irish League of Credit Unions, 2012 W E L O O K A T T H I N G S D I F F E R E N T L Y 18 Impact of Risk What is the impact?Score There is little or no impact on the credit union1 There is a minor impact on the credit union2 There is a significant impact on the credit union3 There is a very serious impact on the credit union which would undermine the stability of the organisation 4 There is a disastrous impact on the credit union which could result in termination of business 5

19. Irish League of Credit Unions, 2012 W E L O O K A T T H I N G S D I F F E R E N T L Y 19

20. Irish League of Credit Unions, 2012 W E L O O K A T T H I N G S D I F F E R E N T L Y 20

21. Irish League of Credit Unions, 2012 W E L O O K A T T H I N G S D I F F E R E N T L Y 21 Risk Ranking – Fraud RiskScore 1.2 An officer grants several large connected loans to family members / friends. 12 1.5 A member cashes a number of fraudulent cheques through the credit union resulting in a significant financial loss. 12 1.4 An officer of the credit union has been transferring funds from dormant member accounts. 8 1.1 An officer defrauds the credit union of significant sums of money by setting up false loans for fictitious members. 4 1.3 An officer of the credit union steals a series of small sums of cash from the cash drawer over a period of months. 4

22. Irish League of Credit Unions, 2012 W E L O O K A T T H I N G S D I F F E R E N T L Y 22 Step 3: Determining Residual Risk This step will determine the threat posed by a risk once internal controls have been considered A control is any measure deliberately put in place to manage risks Determine effectiveness of these internal controls Risk ranking score is multiplied by the controls’ effectiveness scores to determine residual risk

23. Irish League of Credit Unions, 2012 W E L O O K A T T H I N G S D I F F E R E N T L Y 23 Internal Controls A control will: – Minimise impact (protect) – Minimise likelihood of occurring – Transfer the risk (insurance) Tangible Control – The cash safe Intangible Control – Cash handling procedure

24. Irish League of Credit Unions, 2012 W E L O O K A T T H I N G S D I F F E R E N T L Y 24 Mapping Internal Controls Paperwork Practices People Policy / Plan

25. Irish League of Credit Unions, 2012 W E L O O K A T T H I N G S D I F F E R E N T L Y 25 Example: Credit Risk Plan: Loans Policy & Procedures People: Loans Officers, Credit Committee Practices: Credit scoring, lending limits Paperwork: Loan forms, Credit Agreements

26. Irish League of Credit Unions, 2012 W E L O O K A T T H I N G S D I F F E R E N T L Y 26 Example: Risk of Fire Plan: Fire evacuation procedure People: Fire Officer Practices: Fire alarms are tested monthly Paperwork: Register of visitors to building Physical: Fire doors

27. Irish League of Credit Unions, 2012 W E L O O K A T T H I N G S D I F F E R E N T L Y 27 Internal Control Effectiveness

28. Irish League of Credit Unions, 2012 W E L O O K A T T H I N G S D I F F E R E N T L Y 28 Calculating Residual Risk (Risk Ranking Score) x (Internal Control Score) = Residual Risk 12 x 0.2 = 2.4 (low residual risk) 8 x 0.6 = 4.8 (medium residual risk) 10 x 0.8 = 8.0 (high residual risk)

29. Irish League of Credit Unions, 2012 W E L O O K A T T H I N G S D I F F E R E N T L Y 29 What makes a good control? Answer: One that is free from material weakness. Strong control: Officers have their own password which they must update every three months Weak control: A shared password to log-on to the computers in the office.

30. Irish League of Credit Unions, 2012 W E L O O K A T T H I N G S D I F F E R E N T L Y 30 When conducting a risk audit we must ask……. 1.Are there controls in place to manage the risk? 2.How effective are these controls in managing risk?

31. Irish League of Credit Unions, 2012 W E L O O K A T T H I N G S D I F F E R E N T L Y 31 Step 4: What do we do with the findings? Report of findings from audit Develop risk response plan where necessary Delegate tasks to appropriate officers and set deadlines for delivery Review to ensure that the risk response plan is effective

32. Irish League of Credit Unions, 2012 W E L O O K A T T H I N G S D I F F E R E N T L Y 32 Example 1.Impact of risk4 2.Likelihood3 3.“Gross” Risk12 4.Internal Controls0.6 5.“Net” or Residual Risk7.2 6.Action plan required to mitigate this risk, review and monitor

33. Irish League of Credit Unions, 2012 W E L O O K A T T H I N G S D I F F E R E N T L Y 33 Section 4: Risk-based approach to decision making - example

34. Irish League of Credit Unions, 2012 W E L O O K A T T H I N G S D I F F E R E N T L Y 34 Introducing a new service Positives More services for members Additional income Cross sale opportunities Negatives Compliance requirements Conduct risks Cost v benefit?

35. Irish League of Credit Unions, 2012 W E L O O K A T T H I N G S D I F F E R E N T L Y 35 Lending Credit union has €1,000,000 in member savings It can lend this at 10% or it can invest it in a bank at 5% (capital guaranteed) What should it do?

36. Irish League of Credit Unions, 2012 W E L O O K A T T H I N G S D I F F E R E N T L Y 36 Thank you for listening! Any questions?