Carl Lamoureux, Chief Risk Officer, First West Credit Union

What are the most prominent emerging risks facing credit unions and what steps are you taking to prepare for them?

Credit Unions are exposed to a variety of risks that require constant attention. Among the most prominent risks right now are 1) Credit risk, related to the macro-economic environment and 2) Cyber security risk.

Credit Risk

There is a lot of uncertainty with the economy. While no one can predict if a recession is on the horizon, we expect the recent and rapid increase in the Bank of Canada overnight rate will eventually impact the vast majority of households by increasing the cost to service their debt. We are starting to see a direct impact on variable rate mortgage holders, and over time, fixed rate mortgage holders will also be impacted when it becomes time to renew their mortgage. In addition, we are also seeing evidence that home prices in some regions are starting to decline. Finally, the central banks are increasing interest rates to curb the high inflation, which will slow down the economy and accentuate credit risk.

It’s difficult to model how all this will impact our lending portfolio. To prepare for this, we put in place various proactive and reactive measures to mitigate the potential increase in credit risk. The most important control is having sound and prudent underwriting. At First West, in 2019, we have adopted OSFI’s B-20 underwriting practices. This includes using a qualification rate that adds a 200 bps “buffer” to account for a potential interest rate increase. This is helping our members absorb the recent rate increase.

On the reactive front, we recently initiated various campaigns to reach out to our members who have been impacted by the increased debt payments. Different options are offered to assist them based on their unique situation. Finally, we increased the monitoring of our lending portfolio by following very closely metrics such as delinquency, LOC/HELOC utilization, credit score migration, etc. These early indicators will help us dictate our mitigation strategies going forward.

Cyber Security Risk

Cyber security is top of mind for every Chief Risk Officer. This is a type of risk that is very hard to forecast. An event such as a data breach or a ransomware normally happens without any advance notice, and it requires constant vigilance. While most organizations have cyber security insurance to offset the cost of remediation, the biggest impact that is difficult to mitigate is reputational risk. A series of controls are in place to mitigate cyber security across various dimensions: Identify security risk and data that requires protection; Defend by implementing multi-layer preventive controls such as patch management and access control; Detect malicious and unauthorized activity; and Respond, Recover and Learn from cyber security incidents.

Credit Unions are heading into a future of open banking, payments modernization, and other industry changes. In terms of risk and compliance heading into this future, where do you see the greatest opportunities for collaboration within individual credit unions, and between them and their industry partners?

There are many changes that will enhance the delivery of financial services. This is very positive for our members that expect the same efficiency and speed from their financial institutions, such as ordering from their favorite online store. While these changes are positive for the industry, they bring new risks or compliance issues that will impact all credit unions. There is a great potential for the system to combine effort to address these issues. Not only is this a more effective way to use our resources, but it also allows us to have a stronger voice at the table. For example, when we raise a concern with regulators or government officials through CCUA, it’s a voice that represents over 200 credit unions serving close to 6 million members. It is also in our DNA to share and collaborate among system members. This is not prevalent among Canadian banks. We are part of a system, are stronger when we work together with our industry partners.

In an environment of continually changing and increasing compliance requirements, how do you continue to foster an effective and meaningful risk culture throughout your CU without overwhelming your people, and what role can those outside of risk and compliance play in supporting this culture?

This is consistently on my mind as the list of regulatory requirements continues to grow longer every year. To keep everyone engaged and to keep our risk culture intact, I involve the business throughout the full life cycle: I.e., working to provide feedback to regulators on draft guidelines, keeping them updated on discussions with regulators, assisting them in performing self-assessment, gaps analysis, discussing potential controls, etc. As the second line of defense, Risk management needs to set the right balance between assisting the business in implementing new risk management practices and providing independent oversight.

Another critical element is to highlight the value of these requirements. These requirements are often imposed on us to protect our members, the credit union, and the financial systems as a whole. This is a good thing, and we should implement these requirements with this mindset.

Employees outside of risk and compliance play a key role in maintaining a good risk culture. They have a front row seat to many aspects relating to risk or compliance. They process transactions, they design processes or new products, and they interact with our members or third-party vendors. They are the ones that can quickly identify issues before it becomes a larger problem. That is why risk management cannot be the sole responsibility of the risk management and compliance group. This is why financial institutions operate under a three lines of defense framework. This is not the most efficient way to manage risk, but it is very effective. This is important when we deal with our members’ money.