Skeptical? No, Strengthening

To appropriately oversee their CUs' risk profiles, boards need to ask executives good, challenging questions about key focus areas.

It's a cliché by now, but like most overused phrases, the line from the movie "Cool Hand Luke" has more than a little truth to it: "What we have here is a failure to communicate."

Directors put a lot of time and trouble into choosing the best CEOs. But if leaders don't get-and give-their CEOs' vital information about managing risk, the credit union may end up in a place the directors never intended it to be.

To get your organization where you want it to go, credit union directors need to communicate clearly and successfully with CEOs. They need to formulate questions that are hard, strategic, initiative-strengthening and skeptical-yet still supportive.

Risk Appetite and Strategy

Ancin Cooley, principal of Synergy Credit Union Consulting (www.syncuc.com), Elgin, 111., says a crucial starting question for boards to ask CEOs is, "What is our risk appetite?" That question leads to: "What opportunities fit our risk appetite?"

Cooley, whose company provides risk management, audits and training, is a former regulator. He points out that answering the risk appetite question allows credit unions to establish their specific risk "diets."

"Someone may have hamburgers (riskier food) three days and broccoli (safer food) four days-and it works for them," he says. In financial services industry terms, a CU might want to focus more on mortgages (safer food) than on business loans (riskier food). The trick is finding the risk diet that works for your credit union, no matter how it may appear toothers, Cooley asserts.But that's not all. Once you establish your risk appetite, directors need to ask an equally important question: "Does our risk appetite align with our strategic plan?"

For example, he says, a credit union might set a goal of a 3 percent increase in loans for a particular year. Then an opportunity walks in the door to do a hotel loan. The credit union may have never done a hotel loan, however, the opportunity appears attractive within the strategy of increasing the size of the loan portfolio.

"But you have to ask whether it matches your credit union's risk appetite," Cooley says. Making the loan is not necessarily wrong, but it may not fit your diet.

It's important to be certain that everyone on the board is on the same page as far as risk appetite, Cooley adds. "Often, I see that there might be a written strategic plan that is different than what is communicated to loan officers (by the board-hired CEO) on a day-today basis."

In fact, Cooley says that one of the greatest dangers associated with strategic plans is that they simply fall by the wayside. Directors need to ask their CEOs at every board meeting how they are pushing forward the CU's strategic initiatives.

"Too often, the strategic initiative established in November or December of 2013 becomes an antiquated document by the end of February 2014, because priorities change and management has to constantly put out fires," Cooley says.

Boards must press management when strategic initiatives are not being accomplished. Cooley says it often comes down to the type of questions that are asked of management in board meetings.

It may be acceptable for an initiative not to be accomplished if there is a good reason and the board is informed. But simply letting an initiative fall by the wayside can't be tolerated, he says.

"Often when projects are off track and inquiries are made by the board, CEOs and CFOs can take the first round of questions with management speak," he warns. But when the board is knowledgeable and prepared, more specific questions canand should-be asked.

A first-round question may be simply, "Why is this project off schedule?"; a second-round question gets down to the details: "What specifically can we do to get it back on track?" or "Is the delay related to not having enough resources or is the project simply not a priority?"

Understanding Lending Risks

CUES member William D. Vogeney argues that it is not essential for directors to manage risk. Rather, "they need to understand the risk the credit union is taking," says Vogeney, EVP/chief lending officer for $3.9 billion, 234,716-member Ent in Colorado Springs, Colo.

For example if the board is considering approval of a subprime loan offering, directors should be asking some key questions to better understand the CU's credit risk position, Vogeney adds.

First, ask, "Does the credit union have the right collections infrastructure to go significantly deeper into the credit risk pool?" (In other words, is the credit union overall set up to do a good job with collections on loans to higher risk borrowers?)

While loans made to borrowers with less than perfect credit command higher rates of interest, Vogeney says many CUs don't have the right mentality to do an effective job with collections on such loans.

"We tend to assume the best," he says. But many sub-prime borrowers don't respond well to being given a 10-day grace period. If the due date is the fifth of the month, they may need to be called on the sixth.

In addition, "many credit unions use staff (to collect loans) that do other things or have not made collections a career." And the collection team will benefit from being supported by tools that can prioritize the collection queue not just by size of loan or type of loan, but by FICO (credit) score.

A second question the board should be asking is, "Does the CU's loan origination process lend itself well to originating subprime loans?"

For example, Vogeney says, Ent is really good at originating loans quickly to borrowers with good credit. But income and employment verification are more important when making a subprime loan decision, which slows down the process.

In addition, Vogeney is a big fan of what he calls a "story loan," where the CU collects information on the cause of the member's past delinquency, determines whether the problems are tied to such events as a job loss or family issue, and whether the story matches the actual credit problem.

"All of that takes time and slows down the process," Vogeney says. The staff needs to determine when it's appropriate to collect that additional information-including income verification-typically waived for many consumer loans to prime borrowers.

Finally, subprime borrowers are more likely to need a pep talk at loan closing to understand that the CU expects the payments to be made promptly. Some staffs aren't prepared to have such conversations.

Third, ask: "What kind of variation has the credit union seen in lower credit tier loan performance over the last 10 years?"

"I think that's an important question to ask," Vogeney says. "If you looked at how, say, indirect used auto loans have performed over the last 15 years at Ent for the credit tier in the low 600 FICO score range, you would see in the best of times, losses are around 1 percent. In the worst of times, those losses were as high as almost 10 percent annually." This kind of information shows the board the range of possible scenarios for this type of lending, so directors can decide if they are comfortable with a greater emphasis on subprime lending.

A fourth question is, "Has the credit union tried to model a worst-case scenario that considers several variables for near prime and subprime lending?"

"A reasonable example might include the credit union modeling an increase in repossessions per 100 loans, an increase in the loss due to lower used car prices, and an increase in loss due to a breakdown in underwriting discipline, like higher loan-to-values and extended terms," Vogeney says. Or the credit union can use historic loss ratios and model a higher percentage of its portfolio with lower FICO scores.

Five, ask, "How will the credit union compete for subprime business?"

"It seems as though the subprime business is much more cyclical than the lending business as a whole," Vogeney says. Right now, he points out, there is a lot of competition looking for yield, and relaxing standards and lowering rates to compete. At some point, the new book of near prime and subprime business will be unprofitable, he predicts.

"In the near prime space, many credit unions compete by allowing for rate markups at the dealer level, which is being heavily scrutinized by the CFPB (Consumer Financial Protection Bureau, www.cfpb. gov), and will certainly be an area NCUA (National Credit Union Administration, www.ncua.gov) evaluates, as well for compliance with Fair Lending laws," Vogeney says.

"In the subprime area, rates are typically 18 percent to 24 percent, plus lenders actually charge dealers for buying the contract instead of the dealer charging the lender. How will a credit union profitably book that kind of business if they can't charge above 18 percent?" he asks. The maximum loan rate that can be charged by a federal credit union is 18 percent; state-chartered CUs might be allowed to charge a higher rate.

Six, ask, "How well does management understand this business overall?"

Directors should ask staff about expertise in the subprime area, who in the organization chart is knowledgeable, and how management intends to manage and mitigate risk in the future.

In addition, the further the CU looks beyond its current field of membership for subprime volume, the more concerned the board should be.

"Established credit union members pay better than new members," Vogeney says. "Credit union member pay their loans to the credit union better than bank customers pay their bank loans. That's been proven during the validation process of the FICO odds chart. If the credit union is trying to make a big impact using new members signed up at the dealership, or in a new geographic area not previously served, be concerned."

Compliance

Even a decade ago, it would have been hard to imagine the importance that compliance has taken on for all financial institutions, with credit unions no exception, says John DeLoach, president of the Florida-based law firm of Williams, Gautier, Gwynn, DeLoach & Sorenson, RA. (www.williams gautier.com).

"There's been a huge escalation over the years," DeLoach observes. When he started his practice in the 1990s, regulators concentrated on three or four regulations. Now, he says, there are more than 20 of prime importance.

Part of the change, DeLoach says, is the number of lawsuits brought by consumer protection attorneys over the last six to eight years.

In the same period, he adds, there has been a big push for directors to be more involved. In fact, they are required to do so; NCUA has codified that demand in rule 701.4 (http://tinyurl.com/7014ncua).

According to DeLoach, directors should address four key compliance areas with the questions they ask the CEO and senior management team.

1. Education. "Directors must have at least a 30,000-foot level education on various laws and regs," he says.

A new director needs a survey course dealing with primary compliance issues. A yearly update will keep directors current on what's hot. There are no shortcuts on good director education, he notes.

2. Appropriate plans. Before directors can monitor how a CU is doing, they must first ask about the credit union's compliance program. (Read more about the elements of such a program in a free article at cues.org/092613oncompliance.)

3. Monitoring. Directors need to track the results of the compliance plan the CU has put in place. In addition, directors will need to check in with what regulators are saying needs to be done in today's fast-changing world. External auditors may also provide useful insights.

4. Plan corrections. No matter how small the credit union, if CFPB's regs are violated, directors are potentially liable for civil judgments, penalties and the like, DeLoach points out.

"CFPB really changed the landscape," he says. "They are the most prolific creator of regulations and amendments. The changes are staggering."

Technology-Related Risk

At $870 million, 65,000-member USAlliance Federal Credit Union (www.usalliance.org), Rye, N.Y., technology is "one of the board's stronger competencies," says President/CEO Kris VanBeek, a CUES member.

It makes sense, considering the CU's roots as an IBM employees' CU. But, VanBeek adds, any credit union can be on top of the technology angle: "It's really just a matter of getting the board comfortable."

The USAlliance FCU Board has a deep knowledge of technology and likes to inquire about specifics in terms of the CU's information technology architecture, an organized set of management decisions on policies and principles, services and common solutions, and standards and guidelines, as well as specific vendor products used.

VanBeek says USAlliance FCU has a robust risk-management system, and that technology is a core segment. "We don't look at technology as different from any other part of it," he says.

In terms of technology risk assessment, the best question boards can ask CEOs and top management, according to VanBeek, a former examiner for the Federal Reserve, is "What are the layers?"

The answer boards should hear is that there are layers, not just of physical security, but also of technological security. Should there be a firewall behind the firewall? Should there be an intrusion detector behind the intrusion detector? Should there be an intrusion preventer behind the intrusion preventer? Layers prevent single points of failure or weaknesses from causing major catastrophes.

Directors also should ask who is on their CU's IS steering group. Are they active? What are their skill sets? When trouble threatens, are they jumping on it?

VanBeek says USAlliance FCU has an active information security steering group. When a potential problem arises, such as the recent Heartbleed security bug, the group doesn't wait for the next meeting, but moves quickly.

Economic Future

What questions should directors be asking CEOs to prepare for the future economy?

The key is thinking through how your CU will respond to different probable scenarios, says Bill Conerly, Ph.D., economic and business strategy expert.

Conerly, principal of Lake Oswego, Ore.based Conerly Consulting LLC (www. conerlyconsulting.com), says we will soon see higher interest rates, perhaps in a year-and that includes short-term rates.

"The interest rate spread will improve, and that's obviously good news," Conerly says. But he cautions that some credit unions may have to worry about liquidity down the road.

He expects moderate growth in the economy. That can mean better loan opportunities, particularly in small business loans and home equity loans.

"More people will remodel due to rising home prices," he says. "If they need or want a bigger house, they will remodel, if they can't afford a new house with a higher mortgage rate."

He also stresses that credit unions will need to be more adaptable in almost every way. "There will be less predictability in the economy, technology and social competition," Conerly says.

Like a baseball player trying to steal second, CU executives must be prepared to go forward or backward, he says.

For example, Conerly explains, lower fixed costs can allow CUs to be more flexible than otherwise. So can better technology, as it provides answers faster.

Board members can ask their CEOs what the CU is doing to diversify, he says, as being diverse can support flexibility and the ability to respond appropriately to market changes. Don't count on member loyalty, as members are more likely than ever to change financial institutions over technology and pricing, he urges.

"Credit unions need to react faster," Conerly says. "This is critical."

A board may find that asking probing, but supportive questions of its CEO about the potential risks a credit union might face with any undertaking is not an easy task. But doing so is essential, experts say. It helps define strategy and tactics-and goes a long way to ensuring policies and procedures stick.

"CFPB really changed the landscape. They are the most prolific creator of regulations and amendments. The changes are staggering."

John DeLoach

Resources

The Center for Credit Union Board Excellence is designed to help directors excel in their fiduciary and oversight duties. Membership includes access to cues.org/ccube, which features information about risk management, governance, CEO/board relations and other key topics. Not yet member? Sign up for a 30-day free trial by emailing cues@ cues.org.

Read a CUES Skybox blog post about Conerly's thoughts on the value of keeping a flexible stance in the wake of change at http://tinyurl. com/flexgoalsstance.

Consider attending CUES Director Risk and Compliance Seminar, Sept. 15-16 in Williamsburg, Va. Learn more at cues.org/drcs.

Charlene Komar Storey is a veteran credit union writer based in New Jersey.