Risk-Focused Examination Program

This letter highlights some of the examination changes you will see beginning in the early fall of 2002. The National Credit Union Administration (NCUA) is changing the way we perform examinations through development of the risk-focused examination (RFE) process. Some of the improvements you will see over our existing examination program will be:

• Less examination time spent on credit union premises;
• Enhanced emphasis on improved communication;
• Increased focus on areas of risk;
• Optional meetings with the board of directors for qualifying credit unions;
• Customized examination reports; and
• Greater emphasis on supervision where appropriate.

In an effort to better allocate agency resources and assist in meeting the agency’s strategic goals, we have made several recent changes that support the RFE program. In July of 2001, NCUA implemented the risk-based examination scheduling program that eliminates the requirement to perform annual examinations in low risk credit unions. (See Letter to Credit Unions 01-FCU-05, issued in August of 2001, for more information on risk-based scheduling.) Additionally, NCUA recently approved collecting quarterly 5300 call reports from all credit unions, including those with less than $50 million in assets. Collection of this data allows examiners to more consistently monitor and evaluate risk potential.

The RFE process is designed to be forward-looking, with more focus on management’s ability to identify and monitor current and potential areas of risk. It is a forward-thinking approach that allocates resources to the credit unions and areas exhibiting weaknesses or adverse trends. Examiners allocate time and apply the most scrutiny to activities posing the highest risk (i.e. risk-focused).

Rather than evaluating a credit union solely on its performance to date or focusing on areas of minimal risk, examiners will evaluate both credit union performance and management’s ability to identify, measure, monitor, and control risk.

Key Enhancements of the RFE Program

• Less examination time spent on credit union premises. Because we are placing more emphasis on the planning phase of the exam, examiners may request some preliminary information and perform an initial analysis off-site. This allows the examiner to use on-site time more efficiently in discussing issues with management and evaluating the credit union’s control structure and operating environment.
  
  The amount of time spent on-site will vary based on the preliminary information available and the examiner’s familiarity with the credit union. As you might expect, an examiner who is unfamiliar with your credit union will need to spend more time in the credit union, meeting with management and staff and getting familiar with the operating environment.
• Enhanced emphasis on improved communication. Examiners will meet with management to more thoroughly discuss risk assessments during the examination process. This gives management the opportunity to share additional insight into operations and to establish dialogue with the examiners regarding individual circumstances affecting a credit union’s risk assessment.
• Increased focus on areas of risk. Through an assessment process, examiners will determine examination steps that are appropriate for a particular credit union. Examiners will concentrate on areas of risk, risk mitigation, and your credit union’s ability to identify and adapt to changing conditions.
• Optional meetings with the board of directors for qualifying credit unions. For credit unions assigned an overall CAMEL 1 or 2 rating, the joint conference (meeting with the credit union board) will be optional. This option may be exercised by the examiner or by the credit union officials. It is important for you to know that you have the right to request a joint conference and, if you so request, our examiners will gladly meet with your board.
  
  This option was not intended to eliminate the interaction between the officials and the examiner but is reflective of feedback from credit union officials who believe the meetings are not necessary in every examination, every year.
  
  Examiners will continue to hold exit meetings during each examination. An exit meeting differs from a joint conference in that an exit meeting does not require that a quorum of the board attend. Generally, attendance at an exit meeting consists of top management, key staff and possibly one or more officials. At an exit meeting, the examiner discusses the risk profile of the credit union, exam findings (normally minor in nature), needed corrections, and any necessary action that management must take to the next board meeting, with the agreement that management will notify the examiner of the actions taken. In cases where no joint conference is scheduled, one or more officials are encouraged to attend the exit meeting.
  
  For credit unions assigned an overall CAMEL rating of 3, 4, or 5, examiners will meet with the board of directors at the conclusion of each examination.
• Customized examination reports. Examiners will individualize each exam report given to the officials, providing the financial data and narrative information necessary to communicate the examiner’s analysis, conclusions, and recommendations. Although CAMEL ratings will still be disclosed in the report, the discussion will focus on significant items in terms of risk, and areas of lesser risk may be communicated in means other than inclusion in the formal exam report.
• Greater emphasis on supervision where appropriate. With more time between examinations in low risk credit unions, interim monitoring becomes increasingly vital in the supervision process. Examiners will be performing exams less frequently in some credit unions; however, it is likely that management will receive more frequent communication (via telephone, short on-site contacts, email, etc.) regarding current events and noted changes in the credit union’s risk profile.

Risk Terminology in the RFE Program

Throughout this letter, you will notice repeated use of the word “risk.” Risk is not necessarily a negative term. In the financial world, it is a necessity. NCUA does not seek to eliminate risk in credit unions; rather, we want to ensure risks are managed at appropriate levels, given the structure and net worth of the institution.

The RFE program is based on a foundation in which the examiner monitors a credit union’s risk profile. The risk profile is made up of seven specific categories of risk. The first three categories (credit, interest rate, and liquidity) are terms that are probably familiar to you. They can be assessed using objective financial data, combined with management’s awareness and ability to control the risk.

1. Credit Risk – Risk of default on expected repayments of loans or investments.
   
   Example: Though we commonly identify credit risk with the chance that a member will not fully repay a loan, this risk is also present in investments. If a credit union has uninsured, overnight funds invested in another financial institution or entity, the invested funds are at risk. If the financial institution holding the overnight funds fails or is taken into conservatorship, the credit union stands to lose their funds as well as any accrued interest. Performing due diligence on institutions where funds are invested is just as important as evaluating the credit history of a potential borrower.
2. Interest Rate Risk – Risk that changes in market rates will negatively impact the income statement and balance sheet.
   
   Example: If market rates increase, the credit union may find itself increasing dividend rates in order to stay competitive. If the credit union is holding a significant concentration of long-term investments and long-term loans, it may be unable to raise loan rates and make higher yielding investments. Increasing expenses without being able to similarly increase income would seriously decrease net income.
3. Liquidity Risk – Risk of an inability to fund obligations as they come due.
   
   Example: If a credit union receives a large increase in share deposits and quickly loans it out or invests it, without considering the reasons for the increase and the likelihood the funds could be withdrawn as quickly as they were deposited, the credit union could be forced to borrow or pay above-market dividend rates to meet demands for subsequent withdrawals.

The last four categories of risk (transaction, compliance, strategic, and reputation) are more subjective and are difficult to measure using financial data. They must be evaluated in terms of the credit union’s control structure and risk management systems.

4. Transaction Risk – Risk of fraud or operational problems in transaction processing that results in an inability to deliver products, remain competitive, and manage information.
   
   Example: If one credit union staff member has responsibility for gathering information, completing, and verifying the accuracy of the bank reconciliation, the risk that the information will be incorrect (due to error or intentional misstatement) is greater than if the duties for completing and validating are assigned to more than one individual.
5. Compliance Risk – Risk of violations and non-compliance with applicable laws and regulations resulting in fines, penalties, payment, or damages.
   
   Example: If the credit union does not properly train staff regarding compliance with the Bank Secrecy Act, one result could be tellers failing to file required reports for large cash deposits. Failure to properly report could result in substantial penalties.
6. Strategic Risk – Risk of adverse business decisions through management’s actions or inactions.
   
   Example: If management decides to add three new branches while emphasizing marketing of e-commerce services without a well-conceived business plan to demonstrate how these potentially conflicting initiatives can be accommodated, the membership could increase their use of electronic services rather than face-to-face transactions at the new branches. This has the potential, if not well planned, to result in the new branches being unprofitable.
7. Reputation Risk – Risk of negative public opinion or perception leading to a loss of confidence and/or severance of relationships.
   
   Example: If management implements a real estate lending program without setting appropriate individual and overall loan limits, the credit union might be able to fund only a limited number of large real estate loans before it runs out of available funds. The credit union might have to significantly scale back the program or even cease real estate lending for a temporary period. The members could perceive this temporary cessation as a sign the credit union is having financial problems, resulting in members leaving the credit union or requesting large share withdrawals.

In order to provide you with additional guidance in these individual risk categories, we are enclosing guidance that examiners will be using when assessing risk levels. This guidance, along with new and revised chapters discussing the risk-focused program, will also be included in the revised Examiner’s Guide. The revised Examiner’s Guide is anticipated to be released in July of this year and will be made accessible to credit unions on the NCUA website (www.ncua.gov).

Each of the seven risk categories will be assessed a level (High, Moderate, or Low) reflecting the current and prospective risk to the credit union’s earnings and capital. Assessing risk enables the examiner to provide a common supervisory philosophy while recognizing the differing levels and complexities of risk present in each credit union. One size does not fit all because all credit unions do not reflect the same risk factors.

In August 2002, we will train examiners on the RFE process. Following this training, NCUA will fully implement the risk-focused examination program. The survey credit unions receive at the completion of each examination will be revised to reflect this new program. We believe you will find increased value in this new exam program, and we welcome your feedback as you have the opportunity to experience this more risk-focused examination approach and as we continue to improve the program as it evolves into an even more effective approach for both NCUA and the credit unions we regulate and insure.