NCUA LETTER TO FEDERAL CREDIT UNIONS 02-FCU-09 -- Risk-Focused Examination Program

NCUA LETTER TO FEDERAL CREDIT UNIONS

NATIONAL CREDIT UNION ADMINISTRATION
1775 Duke Street, Alexandria, VA 22314

DATE: May 2002 LETTER NO.: 02-FCU-09

TO: Federal Credit Union Officials

SUBJ: Risk-Focused Examination Program

ENCL: Risk Indicators List

This letter highlights some of the examination changes you will see beginning in the early fall of 2002. The National Credit Union Administration (NCUA) is changing the way we perform examinations through development of the risk-focused examination (RFE) process. Some of the improvements you will see over our existing examination program will be:

Less examination time spent on credit union premises;
Enhanced emphasis on improved communication;
Increased focus on areas of risk;
Optional meetings with the board of directors for qualifying credit unions;
Customized examination reports; and
Greater emphasis on supervision where appropriate.

In an effort to better allocate agency resources and assist in meeting the agency’s strategic goals, we have made several recent changes that support the RFE program. In July of 2001, NCUA implemented the risk-based examination scheduling program that eliminates the requirement to perform annual examinations in low risk credit unions. (See Letter to Credit Unions 01-FCU-05, issued in August of 2001, for more information on risk-based scheduling.) Additionally, NCUA recently approved collecting quarterly 5300 call reports from all credit unions, including those with less than $50 million in assets. Collection of this data allows examiners to more consistently monitor and evaluate risk potential.

The RFE process is designed to be forward-looking, with more focus on management’s ability to identify and monitor current and potential areas of risk. It is a forward-thinking approach that allocates resources to the credit unions and areas exhibiting weaknesses or adverse trends. Examiners allocate time and apply the most scrutiny to activities posing the highest risk (i.e. risk-focused). Rather than evaluating a credit union solely on its performance to date or focusing on areas of minimal risk, examiners will evaluate both credit union performance and management’s ability to identify, measure, monitor, and control risk.

Key Enhancements of the RFE Program

· Less examination time spent on credit union premises. Because we are placing more emphasis on the planning phase of the exam, examiners may request some preliminary information and perform an initial analysis off-site. This allows the examiner to use on-site time more efficiently in discussing issues with management and evaluating the credit union’s control structure and operating environment.

The amount of time spent on-site will vary based on the preliminary information available and the examiner’s familiarity with the credit union. As you might expect, an examiner who is unfamiliar with your credit union will need to spend more time in the credit union, meeting with management and staff and getting familiar with the operating environment.

· Enhanced emphasis on improved communication. Examiners will meet with management to more thoroughly discuss risk assessments during the examination process. This gives management the opportunity to share additional insight into operations and to establish dialogue with the examiners regarding individual circumstances affecting a credit union’s risk assessment.

· Increased focus on areas of risk. Through an assessment process, examiners will determine examination steps that are appropriate for a particular credit union. Examiners will concentrate on areas of risk, risk mitigation, and your credit union’s ability to identify and adapt to changing conditions.

· Optional meetings with the board of directors for qualifying credit unions. For credit unions assigned an overall CAMEL 1 or 2 rating, the joint conference (meeting with the credit union board) will be optional. This option may be exercised by the examiner or by the credit union officials. It is important for you to know that you have the right to request a joint conference and, if you so request, our examiners will gladly meet with your board.

This option was not intended to eliminate the interaction between the officials and the examiner but is reflective of feedback from credit union officials who believe the meetings are not necessary in every examination, every year.

Examiners will continue to hold exit meetings during each examination. An exit meeting differs from a joint conference in that an exit meeting does not require that a quorum of the board attend. Generally, attendance at an exit meeting consists of top management, key staff and possibly one or more officials. At an exit meeting, the examiner discusses the risk profile of the credit union, exam findings (normally minor in nature), needed corrections, and any necessary action that management must take to the next board meeting, with the agreement that management will notify the examiner of the actions taken. In cases where no joint conference is scheduled, one or more officials are encouraged to attend the exit meeting.

For credit unions assigned an overall CAMEL rating of 3, 4, or 5, examiners will meet with the board of directors at the conclusion of each examination.

· Customized examination reports. Examiners will individualize each exam report given to the officials, providing the financial data and narrative information necessary to communicate the examiner’s analysis, conclusions, and recommendations. Although CAMEL ratings will still be disclosed in the report, the discussion will focus on significant items in terms of risk, and areas of lesser risk may be communicated in means other than inclusion in the formal exam report.

· Greater emphasis on supervision where appropriate. With more time between examinations in low risk credit unions, interim monitoring becomes increasingly vital in the supervision process. Examiners will be performing exams less frequently in some credit unions; however, it is likely that management will receive more frequent communication (via telephone, short on-site contacts, e-mail, etc.) regarding current events and noted changes in the credit union’s risk profile.

Risk Terminology in the RFE Program

Throughout this letter, you will notice repeated use of the word “risk.” Risk is not necessarily a negative term. In the financial world, it is a necessity. NCUA does not seek to eliminate risk in credit unions; rather, we want to ensure risks are managed at appropriate levels, given the structure and net worth of the institution.

The RFE program is based on a foundation in which the examiner monitors a credit union’s risk profile. The risk profile is made up of seven specific categories of risk. The first three categories (credit, interest rate, and liquidity) are terms that are probably familiar to you. They can be assessed using objective financial data, combined with management’s awareness and ability to control the risk.

1. Credit Risk – Risk of default on expected repayments of loans or investments.

Example: Though we commonly identify credit risk with the chance that a member will not fully repay a loan, this risk is also present in investments. If a credit union has uninsured, overnight funds invested in another financial institution or entity, the invested funds are at risk. If the financial institution holding the overnight funds fails or is taken into conservatorship, the credit union stands to lose their funds as well as any accrued interest. Performing due diligence on institutions where funds are invested is just as important as evaluating the credit history of a potential borrower.

2. Interest Rate Risk – Risk that changes in market rates will negatively impact the income statement and balance sheet.

Example: If market rates increase, the credit union may find itself increasing dividend rates in order to stay competitive. If the credit union is holding a significant concentration of long-term investments and long-term loans, it may be unable to raise loan rates and make higher yielding investments. Increasing expenses without being able to similarly increase income would seriously decrease net income.

3. Liquidity Risk – Risk of an inability to fund obligations as they come due.

Example: If a credit union receives a large increase in share deposits and quickly loans it out or invests it, without considering the reasons for the increase and the likelihood the funds could be withdrawn as quickly as they were deposited, the credit union could be forced to borrow or pay above-market dividend rates to meet demands for subsequent withdrawals.

The last four categories of risk (transaction, compliance, strategic, and reputation) are more subjective and are difficult to measure using financial data. They must be evaluated in terms of the credit union’s control structure and risk management systems.

4. Transaction Risk – Risk of fraud or operational problems in transaction processing that results in an inability to deliver products, remain competitive, and manage information.

Example: If one credit union staff member has responsibility for gathering information, completing, and verifying the accuracy of the bank reconciliation, the risk that the information will be incorrect (due to error or intentional misstatement) is greater than if the duties for completing and validating are assigned to more than one individual.

5. Compliance Risk – Risk of violations and non-compliance with applicable laws and regulations resulting in fines, penalties, payment, or damages.

Example: If the credit union does not properly train staff regarding compliance with the Bank Secrecy Act, one result could be tellers failing to file required reports for large cash deposits. Failure to properly report could result in substantial penalties.

6. Strategic Risk – Risk of adverse business decisions through management’s actions or inactions.

Example: If management decides to add three new branches while emphasizing marketing of e-commerce services without a well-conceived business plan to demonstrate how these potentially conflicting initiatives can be accommodated, the membership could increase their use of electronic services rather than face-to-face transactions at the new branches. This has the potential, if not well planned, to result in the new branches being unprofitable.

7. Reputation Risk – Risk of negative public opinion or perception leading to a loss of confidence and/or severance of relationships.

Example: If management implements a real estate lending program without setting appropriate individual and overall loan limits, the credit union might be able to fund only a limited number of large real estate loans before it runs out of available funds. The credit union might have to significantly scale back the program or even cease real estate lending for a temporary period. The members could perceive this temporary cessation as a sign the credit union is having financial problems, resulting in members leaving the credit union or requesting large share withdrawals.

In order to provide you with additional guidance in these individual risk categories, we are enclosing guidance that examiners will be using when assessing risk levels. This guidance, along with new and revised chapters discussing the risk-focused program, will also be included in the revised Examiner’s Guide. The revised Examiner’s Guide is anticipated to be released in July of this year and will be made accessible to credit unions on the NCUA website (www.ncua.gov).

Each of the seven risk categories will be assessed a level (High, Moderate, or Low) reflecting the current and prospective risk to the credit union’s earnings and capital. Assessing risk enables the examiner to provide a common supervisory philosophy while recognizing the differing levels and complexities of risk present in each credit union. One size does not fit all because all credit unions do not reflect the same risk factors.

In August 2002, we will train examiners on the RFE process. Following this training, NCUA will fully implement the risk-focused examination program. The survey credit unions receive at the completion of each examination will be revised to reflect this new program. We believe you will find increased value in this new exam program, and we welcome your feedback as you have the opportunity to experience this more risk-focused examination approach and as we continue to improve the program as it evolves into an even more effective approach for both NCUA and the credit unions we regulate and insure.

Sincerely,

/S/

Dennis Dollar
Chairman

Enclosure

Credit Risk Indicators

Factor	Low	Moderate	High
*Board and Operational Management Understanding*	Fully understands all aspects of credit risk and has a fully effective process in place to control that risk.	Reasonably understands key aspects of credit risk and has an adequate process in place to control that risk	Does not understand risks, has chosen to ignore, or does not have a satisfactory process in place for key aspects of credit risk.
*Risk Management*	Management anticipates and identifies issues before they become problems, including those resulting from changes in market conditions.	Management has an adequate system in place to identify problems and adequately respond to those signals, including those resulting from changes in market conditions.	Management does not anticipate problems or is ineffective in responding to problems once they occur.
*Policies*	Current, effective and followed.	Satisfactory.	Ineffective.
*Diversification*	Credit risk diversification is actively managed.	Adequate attention to credit risk diversification.	Unsatisfactory credit risk diversification.
*Loans Granted, Loans or Investments Purchased*	Conservative in structure, terms, growth, or settlement practices. Effective due diligence.	Prudent in structure, terms, growth, or settlement practices. Due diligence is adequate.	Aggressive in structure, terms, growth, or settlement practices. Due diligence is lacking, ineffective, or inadequate.
*Underwriting Standards*	Sound and few or no exceptions exist.	Sound with a limited volume of exceptions.	Not adequate or are not prudent and a large volume of exceptions exist.
*Concentrations*	Appropriate diversification	Adequate diversification.	Significant concentrations exist.
*Collateral Values*	Collateral values satisfactorily support credit exposure.	Values protect credit exposure.	Collateral is illiquid or values provide inadequate support.
*Problem Assets*	Low volume, resolution times are within normal course of business and process is controlled.	Moderate volume, reasonable resolution times, and adequate reporting.	High volume, extended resolution times, and inadequate reporting.
*Reserves*	Reserves adequately cover inherent losses. Exposure to loss of earnings or capital from credit risk is minimal.	Inherent losses should not seriously deplete current reserves or require more than normal provisions. Exposure to loss of earnings or capital is manageable.	Losses may seriously deplete current reserves or require abnormal provisions. Exposure to loss of earnings or capital is substantial.
*Internal Audit and Review*	Timely, comprehensive, and independent. Promotes early identification of emerging risks. Management responds to findings quickly.	Acceptable. Promotes reasonable identification of problems. Management responds to findings.	Serious weaknesses exist such as lack of independence, timeliness, or scope of review. Does not promote early identification of problems and risk. Management ignores findings.
*ALLL Methodology*	Evaluation method is sound, well documented, and appropriate coverage of risks exists.	Method is generally acceptable and provides an acceptable coverage of risks.	Method is flawed and provides insufficient coverage of risks.

Interest Rate Risk Indicators

Factor	Low	Moderate	High
*Board and Operational Management Understanding*	Fully understands all aspects of IRR.	Reasonably understands key aspects of IRR.	Does not understand or ignores key aspects of IRR.
*Responsiveness to Market Conditions*	Anticipates and responds well to changes.	Adequately responds to changes.	Does not anticipate or take timely and appropriate actions in response to changes.
*Monitoring & Measuring*	Process is independent from those executing risk-taking decisions. Adequate reporting of IRR exists.	Process is independent from those executing risk-taking decisions. Adequate reporting of IRR exists.	Process is not independent from those executing risk-taking decisions. Lack of monitoring and reporting of IRR.
*Risk Exposure*	Little repricing risk and minimal exposure to basis and yield curve risk.	Repricing risk, basis risk, yield curve risk, and options risk exposures are collectively maintained at manageable levels.	Significant levels of repricing risk, basis risk, yield curve risk, or significant levels of options risk exist.
*Mismatches*	Mismatched positions are short- term.	Mismatched positions may be longer but are managed effectively.	Mismatched positions are longer term and inadequately managed.,
*Risk to Capital and Earnings*	Mismatches are unlikely to cause earnings or capital volatility due to the movement of interest rates.	Substantial volatility in earnings or capital due to the movement of interest rates is not anticipated.	High probability of substantial volatility in earnings or capital due to the movement of interest rates.
*IRR Process*	Effective, documented, and proactive.	Adequate.	Deficient.
*Measurement Tools and Methods*	Enhance decision making by providing meaningful and timely information under a variety of defined and reasonable rate scenarios.	Minor weaknesses, but are appropriate given size and complexity of the credit union’s on-and off-balance-sheet exposures.	Overly simplistic in light of the relative size and complexity of the credit union’s on- and off-balance-sheet exposures.
*MIS Reporting*	Timely, accurate, complete, and reliable.	For the most part, timely, accurate, complete and reliable.	Significant weaknesses.
*Risk Limits*	Clear parameters, that are regularly reviewed, are set for risk to earnings and the economic value of equity under defined stressed interest rate scenarios.	Adequate to control the risk to earnings and the economic value of equity under defined stressed interest rate scenarios.	Not reasonable or do not reflect an understanding of the risks to earnings and the economic value of equity.

Liquidity Risk Indicators

Factor	Low	Moderate	High
*Board and Operational Management Understanding*	Fully understands all aspects of liquidity risk.	Reasonably understands key aspects of liquidity risk.	Does not understand, or chooses to ignore key aspects of liquidity risk.
*Management Responsiveness*	Anticipates and responds well to changes in market conditions.	Adequately responds to market condition changes.	Does not anticipate or take timely or appropriate actions in response to changes.
*Liquidity Position and Risk Exposure*	Favorable position with negligible exposure to earnings and capital.	Not excessively vulnerable to funding difficulties should an adverse change in market perception occur. Earnings or capital exposure is manageable.	Access to funds is impacted by poor market perception or market resistance, resulting in substantial exposure to loss of earnings or capital.
*Funding Sources*	Ample funding sources exist. Funding sources provide the credit union with a competitive cost advantage.	Sufficient funding sources exist to provide cost-effective liquidity.	Funding sources and portfolio structures suggest current or potential difficulty in sustaining long-term and cost-effective liquidity.
*Borrowing Sources*	Widely diversified, with little or no reliance on wholesale or other credit-sensitive funds providers.	Diversified with few providers or groups sharing common investment objectives and economic influences.	Concentrated in a few providers, or providers with common investment objectives or economic influences.
*Future Liquidity Position*	Market alternatives exceed demand for liquidity with no adverse changes expected.	Liquidity position is not expected to deteriorate in the near term.	Liquidity needs may be increasing with declining medium- and long-term funding alternatives.
*Risk Management Process*	Processes reflect a sound culture that has proven effective over time.	Processes are adequate.	Processes are deficient.
*MIS Reporting*	Timely, complete, reliable, and reviewed by management.	For the most part, timely, complete, reliable, and reviewed by management.	Do not provide useful information for managing liquidity risk.
*Balance Sheet Management*	Appropriate attention is given to balance sheet management and the cost effectiveness of liquidity alternatives.	Attention to balance sheet management is appropriate. Access to funding markets is properly assessed and diversified based upon size and complexity.	Attention to balance sheet management is inappropriate. Management has not realistically assessed the credit union’s access to funds and has not paid sufficient attention to diversification.
*Contingency Plans*	Well-developed and effective.	Effective and the cost of liquidity alternatives is adequately considered.	Nonexistent or incomplete. Cost of alternatives has not been adequately considered. High probability exists that contingency funding sources are needed. Improvement is not expected in the near future.
*Cash Flow Analysis*	Effective, reliable and timely analyses are conducted.	Adequate analysis conducted based upon size and complexity.	Analysis not done or is inadequate.

Transaction Risk Indicators

Factor	Low	Moderate	High
*Board and Operational Management Understanding*	Fully understands all aspects of transaction risk.	Reasonably understands key aspects of transaction risk.	Does not understand, or chooses to ignore key aspects of transaction risk.
*Responsiveness to Market and Technological Conditions*	Anticipates and responds well to changes.	Adequately responds to changes.	Does not anticipate or take timely or appropriate actions in response to changes.
*Risk Exposure*	Only a slight probability of damage to reputation, capital, or earnings.	Possible loss to reputation, earnings or capital exists but is mitigated by adequate internal controls.	Weak internal controls expose the credit union to significant damage to reputation, or loss of earnings or capital.
*Transaction Processing Controls*	History of sound operations. Likelihood of transaction processing failures is minimal due to strong internal controls.	History of adequate operations. Likelihood of transaction processing failures is minimized by generally effective internal controls.	History of transaction processing failures. Likelihood of future failures is high due to absence of effective internal controls.
*Systems and Controls*	Strong control culture that results in systems, internal controls, audit, and contingency and business recovery plans that are sound.	Adequate operating and information processing systems, internal controls, audit coverage, and contingency and business recovery plans are evident.	Serious weaknesses exist in operating and information systems, internal controls, audit coverage, or contingency and business recovery plans.
*MIS*	Satisfactory	Minor deficiencies may exist that relate to transaction and information processing activities.	Significant weaknesses in transaction and information processing activities.
*New Products or Services*	Favorable performance in expansions and introductions of new products and services.	Planning and due diligence prior to introduction of new services are performed although minor weaknesses exist.	Inadequate. CU is exposed to risk from the introduction or expansion of new products and services.
*Conversion Management*	Conversion plans are clear, comprehensive, and followed.	Conversion plans are evident, although not always comprehensive.	CU may be exposed to processing risks due to poor conversion management, either from the integration of new acquisitions with existing systems, or from converting one system to another.
*Problem Identification and Corrective Action*	Management identifies weaknesses quickly and takes appropriate action.	Management recognizes weaknesses and generally takes appropriate action.	Management has not demonstrated a commitment to make the corrections required to improve transaction processing risk controls.

Strategic Risk Indicators

Factor	Low	Moderate	High
*Risk Management Practices*	Practices are an integral part of strategic planning.	Quality is consistent with the strategic issues confronting the credit union.	Practices are inconsistent with strategic initiatives. A lack of strategic direction is evident.
*Strategic Planning*	Strategic goals, objectives, culture, and behavior are effectively communicated and consistently applied throughout the institution. The depth of management talent enhances strategic direction and organizational corporate efficiency.	Demonstrated the ability to implement goals and objectives and successful implementation of strategic initiatives is likely.	Operating policies and programs inadequately support strategic initiatives. The structure and talent of the organization do not support long-term strategies.
*Management/Staff Turnover*	Changes in key management or staff are well managed and minimal. Succession plans are documented and effective.	Key management or staff changes recently occurred. Succession plans are adequate.	Key management or staff turnover is high and poorly managed. Succession plans are non-existent, inadequate, or ignored.
*Track Record*	Management has been successful in accomplishing past goals and is appropriately disciplined.	Management has a reasonable record in decision-making and controls.	Deficiencies in management decision-making and risk recognition do not allow the institution to effectively evaluate new products, services, or FOM expansions.
*MIS*	Management information systems effectively support strategic direction and initiatives.	Management information systems reasonably support the credit union’s short-term direction and initiatives.	Management information systems supporting strategic initiatives are seriously flawed or do not exist.
*Risk Exposure*	Exposure reflects strategic goals that are not overly aggressive and are compatible with developed business strategies.	Exposure reflects strategic goals that are aggressive but compatible with business strategies.	Strategic goals emphasize significant growth or expansion that is likely to result in earnings volatility or capital pressures.
*Impact and Risk of Initiatives*	Initiatives will have a negligible impact on capital, systems, or management resources. The initiatives are well supported by capital for the foreseeable future and pose only nominal possible effects on earnings volatility.	Actual practices have only minor inconsistencies with planned initiatives. Initiatives are reasonable considering the capital, systems, and management. Decisions are not likely to have a significant adverse impact on earnings or capital and can be reversed without significant cost or difficulty.	The impact of strategic decisions is expected to significantly affect net worth. Strategic initiatives may be aggressive or incompatible with developed business strategies. Decisions are either difficult or costly to reverse.
*Appropriateness of New Products & Services*	New products/services are supported by sound due diligence and strong risk management. The decisions can be reversed with little difficulty and manageable costs.	New products/services will not materially alter business direction, can be implemented efficiently and cost effectively, and are within management’s abilities.	Strategic goals are unclear or inconsistent, and have led to an imbalance between the credit union’s tolerance for risk and willingness to supply supporting resources for new product/service offerings.

Reputation Risk Indicators

Factor	Low	Moderate	High
*Board and Operational Management Response to Change*	Anticipates and responds well to changes of a market or regulatory nature that impact its reputation in the marketplace.	Adequately responds to changes of a market or regulatory nature that impact the institution’s reputation in the marketplace.	Does not anticipate or take timely or appropriate actions in response to changes of a market or regulatory nature.
*Organization and Overall Operations*	Management fosters a sound culture that is well supported throughout the organization and has proven very effective over time.	Administrative procedures and processes are satisfactory. Management has a good record of correcting problems.	Weakness may be observed in one or more critical operational or administrative activities. Management information at various levels exhibits significant weaknesses.
*Risk Management*	The credit union effectively self-polices risks.	The credit union self-polices risks.	The credit union’s performance in self-policing is suspect.
*Internal Controls and Audits*	Fully effective.	Generally effective.	Not effective in reducing exposure. Management has either not initiated, or has a poor record of, corrective actions to address problems.
*Net Worth Exposure*	Net worth is only minimally exposed by reputation risk. Minimal member complaints received, involving minor issues. Complaints are handled promptly, effectively, and efficiently.	The exposure of net worth from reputation risk is controlled. Adequate systems exist to process member complaints satisfactorily.	Net worth is substantially exposed by reputation risk shown in significant litigation, large dollar losses, or a high volume of member complaints. The potential exposure increases with the number of accounts, the volume of assets under management, or the number of affected transactions.
*Legal Risk*	Losses from fiduciary activities are low relative to the number of accounts, the volume of assets under management, and the number of affected transactions. The credit union does not regularly experience litigation or member complaints.	The credit union has avoided conflicts of interest and other legal or control breaches. The level of litigation, losses, and member complaints are manageable and commensurate with the volume of business conducted.	Poor administration, conflicts of interest, and other legal or control breaches may be evident.
*Disaster Recovery Plans*	Documented, tested, and effective plans are in place.	Adequate plans are in place.	Inadequate or non-existent plans.
*Promotional and Educational Efforts*	Effective promotional and educational efforts are made to reach existing and potential members.	Adequate promotional and educational efforts are undertaken.	Inadequate or non-existent promotional and educational efforts.

Compliance Risk Indicators

Factor	Low	Moderate	High
*Board and Operational Management Understanding*	Fully understands all aspects of compliance risk and exhibits a clear commitment to compliance. Commitment is communicated throughout the institution.	Reasonably understands the key aspects of compliance risk. Commitment to compliance is reasonable and satisfactorily communicated.	Does not understand, or has chosen to ignore, key aspects of compliance risk. The importance of compliance is not emphasized or communicated throughout the organization.
*Authority and Accountability*	Authority and accountability for compliance are clearly defined and enforced.	Authority and accountability are defined, although some refinements may be needed.	Management has not established or enforced accountability for compliance performance.
*Response to Changes*	Anticipates and responds well to market or regulatory changes.	Adequately responds to market or regulatory changes.	Does not anticipate or take timely or appropriate actions in response to market or regulatory changes.
*Product and Systems Development*	Compliance considerations are incorporated into product or systems development.	While compliance may not be formally considered when developing product or systems, issues are typically addressed before they are fully implemented.	Compliance considerations are not incorporated in product or systems development.
*Violations & Risk Exposure*	Violations, noncompliance, or litigation are insignificant, as measured by their number or seriousness.	The frequency or severity of violations, noncompliance, or litigation is reasonable.	Violations, noncompliance, or litigation expose the credit union to significant impairment of reputation, value, earnings, or business opportunity.
*Error Detection and Corrective Action*	When deficiencies are identified, management promptly implements meaningful corrective action.	Problems can be corrected in the normal course of business without a significant investment of money or management attention. Management is responsive when deficiencies are identified.	Errors are often not detected internally, corrective action is often ineffective, or management is unresponsive.
*Risk Management*	Good record of compliance. The CU has a strong control culture that has proven effective. Compliance management systems are sound and minimize the likelihood of excessive or serious future violations.	Compliance management systems are adequate to avoid significant or frequent violations or noncompliance.	Compliance management systems are deficient, reflecting an inadequate commitment to risk management.
*Controls and Systems*	Appropriate controls and systems are implemented to identify compliance problems and assess performance.	No shortcomings of significance are evident in controls or systems. The probability of serious future violations or noncompliance is within acceptable tolerance.	The likelihood of continued violations or noncompliance is high because a corrective action program does not exist, or extended time is needed to implement such a program.
*Training and Resources*	Training programs are effective and the necessary resources have been provided to ensure compliance.	Management provides adequate resources and training given the complexity of products and operations.	Management has not provided adequate resources or training.