NEW ORLEANS—Enterprise risk management is not just misunderstood, it frequently gets a bad rap, according to one expert who, said that any credit union that doesn’t change that thinking is putting its own enterprise at risk.
Moreover, said Tony Ferris, managing partner with the Rochdale Group, not using ERM means surrendering what can be a significant competitive advantage.
“The problem I have with enterprise risk management is so many people confuse it, especially auditors and accounts,” Ferris told the CUNA CFO Council annual meeting. “Every decision we make involves risk/return trade-offs. ERM is absolutely and simply about strategically managing your organization. It has nothing to do with audits and controls, per se. What we’re trying to do is answer how we can drive more business intelligence to the business leaders so you can make better decisions.”
Brian Hague, left, and Tony Ferris of The Rochdale Group at CUNA CFO Council meeting.
It’s the word “risk” that bedevils many organizations, said Ferris, as “risk” is always associated with “something to be avoided, even though our whole industry is based on taking risks.”
“The biggest problem we have in credit unions is that most are unwilling to take enough risk,” said Ferris, before cautioning his audience, “Resting on our laurels is one way to ensure we are irrelevant in the future.”
Ferris said that when it comes to using ERM to drive a competitive advantage, there are two questions at the center of all of it:
1) How well do I know myself?
2) How well do I know the environment?
“If I know those things better than you, I will always outperform you,” said Ferris. “Most of the time at credit unions it’s the alignment piece that kills you. When credit unions are asked what’s your point of differentiation, most say ‘service.’ I say BS. Most banks are just as competitive on service.”
If service isn’t a differentiator, then what is the credit union advantage? “I believe it’s that risk/return trade-off; it’s driving value in your organization and taking advantage of the opportunities,” said Ferris. “It’s not about an audit and all the things you’re doing wrong and fixing them.”
Defining ERM
Ferris defined enterprise risk management as a reoccurring process that can drive information through an organization in a calculated way.
“It’s about alignment, whether in risk appetite, strategies and more. This needs to be owned by the business units,” he said. “What it’s not about is eliminating risk. That’s not how you show value in an ERM process. It’s what risks are you taking. Most of our clients will say the number-one benefit is they identify and jump on opportunities more quickly.”
Ferris said “executive risk aversion” is hardly unique to credit unions, citing one study of 1,500 execs in 90 countries that found ex demonstrated that execs are extremely risk-averse, regardless of investment. In the study, executives turned down opportunities even when expected NPV was positive at a 75% loss level. Instead, they only accepted a risk of loss from 1% to 20%, regardless of investment size.
When Ferris asked his audience of CFOs, “How many of you think you’re taking on all the risk you need now to be a viable organization 10 years from now?,” no hands were raised. “That value gap is dollars on the table,” said Ferris. “
Ferris urged credit unions to recognize that ERM is not about what happened yesterday, unless it can be used as a predictor of what might happen tomorrow.
What Should Be in the Plan
Among the “significant industry risks” that Ferris said every CU ERM plan should include:
- Talent management.
- Vendor/partner strategies.
- Succession planning.
- Infrastructure/scale.
- Big data confusion and diligence.
- Credit union industry disruption (trades, leagues, corporates, councils, collaborative groups).
- Digital sales velocity.
- Behavior around lifestyle/rewards.
Those risks, said Ferris, require a lot more than a once-a-year board/management retreat. “It’s really mind-boggling to think that on one day you’re really, really smart and you come up on with something on that one day,” he said. “Strategic planning is a year-long event.”
Using ERM as part of that day-to-day planning, he said, the objective should be to stir thought about the decision we make and how we make them in pursuit of the organization’s vision. The goal: creation of value through the development of a world class risk-management culture.