Interest Rate Risk Policy and Program Frequently Asked Questions

Dear Board of Directors and Chief Executive Officers:

Beginning September 30, 2012, certain federally insured credit unions will be required to have a written policy on interest rate risk (IRR) management and a program to implement this effectively.¹

We have hosted or participated in four webinars since the issuance of Letter to Credit Unions 12-CU-05 in which we discussed the new interest rate risk rule. In these webinars, we addressed concerns and questions with examiners and federally insured credit unions (FICUs), following the approval of the rule. This Letter answers the most frequently asked questions to facilitate clear and open communication on this subject.

In Letter 12-CU-05, we noted that NCUA and other financial regulators issued guidance in the past on the management of IRR. NCUA also previously issued a number of Letters to Credit Unions on subject areas concerning IRR.² We encourage you to review these as you evaluate your credit union’s IRR policy and program. When the rule becomes effective, on September 30, 2012, examiners will use the new examination questionnaire we distributed in Letter 12-CU-05. The questionnaire conforms to Appendix B of the IRR Rule and you should consider the guidance this provides to examiners as you evaluate the credit union’s policies and program.³

We encourage you to discuss any questions you have with your examiners, as you implement this important rule at your credit union.

Interest Rate Risk Rule 741.3(b)(5): Frequently Asked Questions

General Questions

Why is the Interest Rate Risk (IRR) rule written as a requirement for insurance?

Interest rate risk is a core risk which confronts FICUs; similar risks exist with regards to lending and investments for which regulatory requirements for insurance already exist. As a requirement for insurance the rule applies to all FICUs. The rule combines the many elements of asset liability management into a comprehensive framework for managing core risk. Of the seven risks in a risk focused exam, Interest Rate Risk is the primary concern of the rule.

What will NCUA do to implement the rule?

Effective September 30th of 2012, NCUA will replace the existing interest rate risk questionnaire with a new questionnaire, as circulated in Letter to Credit Unions 12-CU-05. Examiners will review the policy and asset liability management programs for effective identification, measuring, monitoring and control of interest rate risk. The objective is to implement the rule consistently while taking into account size and complexity differences among FICU’s.

Are other Letters to Credit Union on IRR still applicable?

Yes, previous Letters to Credit Unions deal with specific sources of risk. (For example, Letters to Credit Unions cover subjects on Non-maturity Shares, Liquidity, Real estate Concentration, and Balance Sheet Risk.) The rule concentrates on policy and program development. The rule requires a written policy and an effective management program for IRR.

Will my examiner seek to remove my insurance because of failure to comply with the rule?

The rule requirement is a condition of insurance because it uniformly applies to federal and state chartered credit unions. It is not the intent of the rule to provide reasons for removing insurance. The purpose of the appendix is to provide clear, comprehensive guidance, not to create a compliance test. Therefore examiners will not summarily remove insurance from FICU’s.

What is the purpose of the Supervisory Interest Rate Risk Ratio (SIRRT)?

The purpose of the SIRRT ratio is to reduce regulatory burden without adding new reporting requirements to the call report. The rule also seeks to cover the majority of the assets. Credit unions between $10 and $50 million in assets where the SIRRT ratio is less than 100% are exempt from the rule. Credit unions under $10 million in assets are also exempt. The ratio is only for the purpose of determining for whom the rule applies.

What are the components of the SIRRT Ratio?

The SIRRT ratio is calculated from call report fields. Total First mortgages is added to Total investments 5 years and greater and then divided by total net-worth. The result of the calculation is a ratio.

This ratio is computed based on the most recent call report data and is viewable on the ratio page of the Financial Performance Report (FPR).

What is the purpose of the guidance (Appendix B) contained in the rule?

The guidance lays out a framework for the development of an effective program. From policy, implementation, measuring and monitoring, to decision making, the guidance focuses on the core components necessary for an effective risk mitigation program. The guidance compliments existing guidance by describing best practices for your credit union to consider as you write an IRR policy and construct IRR management programs. The guidance is not intended as a checklist, nor is any specific part mandatory. Examiners will look at the size and complexity of your credit union and work to determine whether the program is effective as opposed to running through the guidance in a checklist type manner.

IRR Policy

Who is responsible for the adequacy of the policy?

The Board of Directors is responsible for a credit union’s IRR policy. The policy should integrate with the credit union’s business policies and risk tolerance. The policy should be routinely reviewed and, if necessary, modified to address current financial conditions and address measurement of balance sheet risk. The policy should also delineate actions and authorities required for any exceptions to policy.

Is there a specific form the policy should take?

No, there may be one policy or it may be integrated into investment, ALM, funds management or other policies. Regardless of form, the credit union must clearly document their IRR policy in writing and review it for applicability at least annually.

What should the policy include?

A written policy should:

• Identify parties responsible for review of the credit unions IRR exposure.
• Direct appropriate actions to ensure management identifies, measures, monitors, and controls IRR exposure.
• State the frequency with which monitoring and measurement will be reported to the board.
• Set risk limits for IRR exposure based on selected measurement. (for example GAP, NII or NEV)
• Choose tests such as interest rate shocks, that the credit union will perform using the selected measures.
• Provide for periodic review of material changes in IRR exposure and compliance with board approved policy and risk limits.
• Provide for assessment of the IRR impact of any new business activities prior to implementation.
• Provide for an annual review of policy to ensure it is commensurate with size, complexity and risk profile of the credit union.
• When appropriate, establish monitoring limits for individual portfolios, activities, and lines of business.

Oversight and Management

How should management implement the Board policy?

Management should:

• Develop and maintain adequate IRR measurement systems;
• Evaluate and understand IRR exposures;
• Establish an appropriate system of internal controls (risk taker should be separate from those measuring. i.e. does the modeler also pick the investments?);
• Allocate sufficient resources for an effective IRR program (should include competent staff with technical knowledge of the IRR program);
• Identify procedures and assumptions involved in the IRR measurement system (i.e. the credit union’s IRR model inputs);
• Establish clear lines of authority for managing IRR; and
• Provide a sufficient set of reports to comply with Board approved policies.

Measuring and Monitoring

Which measurement tools should be considered for my credit union?

Model usage depends on size and complexity. GAP, Income Simulation, Asset Valuation and Net Economic valuation are methods available for modeling interest rate risk. In general, a credit union should have a system in place that identifies material risk to the balance sheet. Management should require that interest rate risk measurements and tests be sufficiently rigorous to capture risk. Management should have documented assumptions that are reasonable and supportable. Changed assumptions should include documentation based on observations.

Does my model need an outside validation?

Model validations can be performed by either internal or external parties. Validating IRR models is a fundamental part of a credit union’s system of internal controls. An important element of model validation is independent review of the logical and conceptual soundness. The scope of the independent review should involve assessing a credit union’s measurement of IRR, including the reasonableness of assumptions, the process used in determining assumptions, and the back testing of assumptions and results. Smaller credit unions that do not have the resources to staff an independent review function should have processes in place to ensure the integrity of the various elements of their IRR management processes. Often, smaller credit union will use an internal party that is sufficiently removed from the primary IRR functions or an external auditor to ensure the integrity of their risk management process.

When should I consider my IRR management program as being effective?

Your program will be considered effective when it has a well-defined policy and it identifies, measures, monitors and controls interest rate risk, and you use these to guide decision making. Your program should be able to adjust as products are added or increased, interest rates shift, balance sheet changes and capital positions change. It is the FICU’s responsibility to effectively manage its potential IRR. NCUA expects credit unions to incorporate the program results and information obtained into the credit unions decision making.

Internal Controls

How should internal controls be designed?

The purpose is to ensure the integrity of all elements of their IRR management process, including the adequacy of corporate governance, compliance with policies and procedures, and the comprehensiveness of IRR measurement and management information systems. As much as possible, risk taking should be separated from risk measuring.

May I consider staff limitations with regard to separating duties?

The size and complexity of the credit union will primarily determine the need for staff in these areas. The key is to identify where risks are taken and create oversight over the risk taking where needed. It is management’s responsibility to make sure appropriate resources are applied to monitoring and measuring interest rate risk.

Decision-making Informed by IRR Measurement Systems

Should management be making decisions based on IRR modeling?

Yes, operational decisions should reflect IRR measurement results to control balance sheet makeup, funding, pricing and business strategies. This gains importance as net worth decreases, income becomes negative and interest rate risks approach board approved maximum or minimum levels. Measures to manage and control IRR should be considered in these cases.