Risk Governance Framework—Lines of Defense

Determine the structure used to manage and oversee risk at the credit union and the people involved in the processes.

Prerequisites

Gather organizational charts and governance diagrams from the credit union and identify:

  • Risk taking groups, risk oversight groups and internal control groups

  • The official reporting structure of the credit union and the credit union’s governance structure

People to Interview

  • Leadership involved in policymaking

  • Head(s) of Risk Management and/or Internal Audit departments, if applicable

  • Audit Committee Chairperson, if applicable

  • Supervisory Committee Chairperson, if applicable

  • Board of Directors, if warranted

Documents to Review

  • Policies and procedures concerning risk management, risk governance, and risk reporting

  • Organization chart

  • Committee list

  • Board of director meeting minutes

Questions to Consider

  • Has the board of directors adopted a risk management or ERM policy that outlines the overall governing framework over risk management activities?

  • Has management developed a risk governance framework commensurate with the sophistication of the CU’s operations and business strategies?

  • Does the risk governance framework cover all applicable risks of the CU?

  • Does the credit union have a separate risk management department that oversees all aspects of the credit union's risk management activities? If not, is a compensating risk governance framework in place that involves the board of directors, the leadership team, business units, risk oversight, and internal audit?

  • Has the board of directors taken appropriate action to ensure the risk governance framework provides for independence and sufficient challenge points and accountability over other senior managers and business line activities?

  • Do procedures and policies clearly identify the roles and interactions between frontline and middle office business units and risk oversight functions relative to various aspects of the credit union’s financial and operational business activities?

Last updated on August 23, 2022.