How Risk Governance Works in Banks and Credit Unions

Risk governance in a bank or credit union is the set of boards, committees, charters and reporting lines that makes a named person accountable for risk. It only works if a person in a risk role can say something the business does not want to hear to somebody who can act on it, without first asking the business for permission. US banks and credit unions reach that goal through very different structures, even when the two institutions are the same size.

Every reporting line is a control

Governance is often taught as an organization chart, where you memorize which box sits above which other box. That misses the point. Every line on a governance chart is a control. A reporting line decides who can be overruled and by whom, who can be fired for saying something unwelcome, and whose budget depends on the answer being yes. Change one line and you change what the institution is able to notice about itself.

Any reporting line answers five questions:

1. Who can overrule this person, and on what?
2. Who decides whether they keep their job?
3. Who sets their objectives and pays their bonus?
4. Who can they reach without asking permission first?
5. Can bad news travel up the line without being edited along the way?

The test for any risk role: can this person say something the business does not want to hear to somebody who is able to act on it, without asking the business for permission first? If the answer is no, the chart is decorative, whatever it says.

An institution can have a chief risk officer, a risk committee and a full framework. If the risk officer's bonus is set by the person whose deal they are supposed to challenge, none of it will work when it truly matters. The structure was fine, but the lines were wrong.

What the board cannot delegate

One principle governs everything the board does with risk: the board delegates execution, but it does not delegate accountability. That is why boards get criticized after failures. Directors were not running the trading desk, but they were accountable for an institution they had not asked hard enough questions about.

These responsibilities stay with the board:

• Approving the risk appetite, the statement of how much risk the institution intends to carry
• Approving the framework and the policies underneath it
• Appointing, and being able to remove, the people who run risk management
• Receiving reporting and challenging it, not just receiving it

Supervisors read board minutes. They are not mainly checking whether the board met or who attended. They are looking for evidence that somebody asked a difficult question and that the answer changed something. A minute that records a report as noted, month after month, is itself a finding. The board's job is not to run risk management. It is to be the body that cannot be fired by the people it supervises, and that can therefore ask hard questions.

Bank risk governance under Regulation YY

For the bank, the requirements are written down in a precise rule. Take the fictional Acme Bancorp, whose four-quarter average total consolidated assets are 102 billion dollars. That figure is an average over the holding company's last four quarterly reports. It is not the period-end total, and it is not the leverage ratio denominator. Because the average is above the 100 billion dollar line, the holding company falls under the subpart of Regulation YY written for holding companies at that level and above. What matters is crossing the threshold, not how large the company is above it.

The common mistake is to say these requirements apply to the bank. They apply to the holding company. The Federal Reserve supervises the holding company, and Regulation YY is a Federal Reserve rule. Acme Bank, a national bank, is supervised by the OCC.

The risk committee

The rule requires a risk committee that:

• Reports directly to the board of directors
• Is independent, with risk management policies as its sole and exclusive function, so it cannot be the audit committee wearing a second hat
• Has at least one member with experience identifying, assessing and managing risk exposures of large, complex financial firms
• Is chaired by a director who is not an officer or employee and has not been one for the previous three years, which deliberately stops last year's chief executive from taking the chair
• Meets at least quarterly and fully documents and keeps records of its proceedings

The rule requires the paper trail because the paper trail is the evidence.

The chief risk officer's dual reporting line

The chief risk officer owns the framework day to day, oversees the setting of risk limits across the whole enterprise, monitors compliance with them, and brings the combined picture to the committee. The most important detail is this: the chief risk officer must report directly to both the risk committee and the chief executive officer.

A chief risk officer who reported only to the chief executive would have authority inside the business but no protection from it. One who reported only to the committee would have protection but no ability to make anything happen. Two lines give both, and they also give bad news a route to the board that does not pass through management. Independence is not a statement about anyone's character. It is structural, or it does not exist.

Management committees and their charters

Most decisions are made in management committees. Apart from credit approval authority, these bodies are not generally required by rule, and their names and shapes vary a lot. Institutions typically run:

• An asset and liability committee covering interest rate risk, funding and the shape of the balance sheet
• A credit committee approving exposures above what individual lenders can decide alone
• Forums for operational and technology risk
• A new products body, often missing, whose absence shows up later as a product nobody assessed
• An enterprise risk management committee that sees across all of them

The principle underneath does not vary. Above a certain size, a decision stops being one person's to make. A committee creates a record, requires a reason, and gives somebody a place to object.

Read the escalation clause first

The charter is where a committee's authority actually lives. It sets out what the body can decide as opposed to what it only advises on, what must be escalated and when, who must be present for a quorum, how often it meets, what information it receives, and to whom it reports. When assessing a charter, read the escalation clause before anything else. The rest describes normal operations, when nobody opens the charter. The escalation clause describes what happens when something has gone wrong. A vague escalation clause will fail on the day it is needed.

How credit union governance differs

A credit union is not a bank with smaller boxes. It rests on a different statute and achieves independence through a different mechanism. A bank's board is elected by shareholders, who are a different group from its customers. A credit union's board is elected annually by and from the members, so owners and customers are the same people.

Neither the Federal Credit Union Act nor NCUA rules contain a Regulation YY style requirement for a risk committee or a chief risk officer. Instead, it has a supervisory committee of three to five members, appointed by the board. Under the Federal Credit Union Act, this committee makes or arranges an annual audit, reports it to the board, and gives a summary to the members at the next annual meeting.

The power to suspend

By unanimous vote, the supervisory committee may suspend any officer, any member of the credit committee (the loan approval body), or any member of the board. A suspension then goes to a meeting of the members held not less than 7 and not more than 14 days later, and the members decide whether it stands. By majority vote, the committee may also call a special meeting of the members to consider a violation or a practice it considers unsafe. The final say rests with the membership, not with the committee.

There is a balance built in. The board can suspend a supervisory committee member by simple majority, while the committee needs a unanimous vote to suspend a director. Neither model is obviously better. The bank protects a risk officer's reporting line. The credit union gives an audit body the power to suspend and the members the final say.

How governance architecture fails

Governance works when the risk view reaches the board without being edited by the people it describes, and when challenge happens and is recorded. It fails in three typical ways:

1. The chief risk officer reports only into the business, which disables everything else.
2. Committees meet and write minutes, but thresholds are set where nothing reaches them, so escalation never triggers.
3. The board receives volume instead of judgment, such as 200 pages with no view, no recommendation, and nothing flagged as important.

The failure to be most suspicious of passes inspection: a complete chart, full attendance, detailed reporting packs, current charters, and no challenge anywhere. Every artifact is present, but the thing it is supposed to prove is missing.

Key takeaways

• Every line on a governance chart is a control, not just administration.
• The core test is whether a risk role can deliver unwelcome news to someone able to act, without the business's permission.
• Boards delegate execution but keep accountability, and supervisors read minutes looking for challenge.
• Under Regulation YY, the requirements attach to the holding company, including an independent risk committee and a chief risk officer reporting to both the committee and the chief executive.
• Read a charter's escalation clause first.
• Credit unions rely on a supervisory committee that can suspend directors by unanimous vote, with the members having the final say.