Risk Is the Product: Why Banks and Credit Unions Fail

Enterprise risk management (ERM) in a bank or credit union asks one question: given everything the institution is exposed to at once, and given how those exposures move together, can it absorb the loss and keep operating? It is not about making risk smaller. It is about making sure every risk is measured, priced, limited and capitalized, and then judging the pieces as a whole.

Risk is the product, not the problem

The most common misconception about this field is that risk management means making risk smaller. It does not. A bank or a credit union does not earn a living by avoiding all risk. It earns a living by taking risk on purpose. Somebody hands over money today for the promise of more money later, and the whole business is the judgment about whether that promise holds. Take the risk away and you have taken the business away with it.

So if risk is not the problem, what is? The failure mode is risk that was mishandled in one of four ways:

• Unmeasured: risk that nobody measured.
• Unpriced: risk that was taken but never priced, so the institution was not paid for carrying it.
• Unlimited: risk that grew past any limit because no limit was ever set.
• Uncapitalized: risk that had no capital behind it when it went wrong.

Measured, priced, limited, capitalized. Those four words are a working checklist for any exposure an institution carries.

Risk management versus enterprise risk management

Risk management and enterprise risk management are different jobs. Risk management measures and controls a single exposure. Does the borrower repay? Does the system fail? Does a rate move hurt us? Each of those is a real question with a real specialist attached to it, and each can be answered well.

Enterprise risk management asks something no single specialist can answer. Given everything we are exposed to at once, and given how those exposures move together under conditions we have not seen recently, can this institution absorb the loss and keep operating?

The distinction matters because institutions very rarely fail because one risk was measured badly. They fail because several risks were each measured adequately in isolation, by capable teams who never compared notes, and then all of them moved in the same direction at the same time. Correct parts, wrong whole. That is the gap ERM exists to close.

Three ways institutions actually fail

The idea only becomes useful when you can see it happen. Here are three patterns.

Rates rise on a safe-looking balance sheet

Picture a loan book that is genuinely well underwritten, with surplus deposits invested in high-quality securities. That looks safe. Then rates rise sharply. The securities fall in value. The depositors who funded them start moving money to chase yield. Now the institution is selling securities at a loss to fund those withdrawals, and a loss that existed only on paper becomes a real one. Neither the credit team nor the investment team was wrong about its own exposure.

A model that was never tested

A model predicts default really well, but it was built on data covering only good years. That model is not validated. It is untested, which is a completely different thing, and the difference does not show up until conditions change.

Diversification that was never real

A concentration in one property type looks fine at origination. But it is the same property type that stops performing when the local economy turns, and the diversification the portfolio seemed to have was never real to begin with.

In each case, no individual specialist made an obvious error. The failure lives in how the exposures interact.

Why banks and credit unions have to be compared side by side

Banks and credit unions differ in structure, not just in name. A credit union is a member-owned cooperative. It has no common stock to issue, so it builds capital essentially in one way, by retaining earnings. A bank in the same position has another option: it can raise equity.

That single difference spreads outward into everything else:

• Different capital rules.
• A different primary federal regulator.
• Different vocabulary for what is functionally the same supervisory finding.
• When capital gets thin, a materially different set of things the institution can actually do about it.

Even interest rate risk carries its own credit union requirement: NCUA now rates it under the same CAMELS "S" component the bank agencies use, but credit unions above $50 million in assets must also maintain an interest rate risk policy and program under a separate NCUA rule. Study either charter on its own and it starts to look like the natural order of things. That is exactly how expensive mistakes get made when somebody moves between the two.

A risk number means nothing without economic context

One idea separates people who can reason about risk from people who can only compute: a risk number without an economic context is not really information. Say a portfolio has a 1% default rate. You have learned almost nothing, because 1% in the middle of an expansion and 1% in the second year of a contraction describe completely different portfolios heading in completely different directions.

Useful history covers several distinct regimes, each of which stresses an institution differently:

1. A through-the-cycle baseline, the long-run reference everything else is measured against.
2. The 2008 and 2009 financial crisis, which was credit-led.
3. The 2020 shock, which came from outside the financial system entirely and was met with enormous policy support. For that reason, the performance data it left behind will mislead you if you are not careful.
4. The 2022-2023 rate shock, which was rate-led and broke things that credit-focused frameworks were not watching.

This is where the difference between point in time and through the cycle measurement comes from, and it underpins much of serious risk work.

What a complete ERM capability looks like

A practitioner working across both charters should be able to:

• Explain who regulates a given institution, under what authority, and what that supervision means in practice.
• Build a credit risk model from raw loan data, measure it properly, validate it against conditions it was not trained on, and document it so it survives independent review.
• Compute a lifetime expected credit loss allowance by more than one method and defend the choice, because there is no single right answer and the defense is the skill.
• Test a lending portfolio for disparity using a method that holds up when somebody competent challenges it.
• Measure interest rate risk both on earnings and on economic value.
• Run a stress test end to end: design the scenario, translate it into loss and revenue, project the balance sheet, and carry the result into a capital conclusion.
• Compute capital adequacy under both regimes on the same balance sheet and explain every difference in treatment.
• Assemble all of it into one enterprise risk profile that a board can act on.

The order matters. Data governance comes before any analytics, because analytics built on ungoverned data is where the expensive surprises live. Credit risk basics come before expected credit loss. And stress testing comes before capital, even though capital feels more basic, because post-stress capital adequacy is exactly the question capital planning exists to answer. Without a stress test, you have a set of ratios and nothing to test them against.

Reproducibility, scope and honesty about regulation

Three habits run underneath good ERM work.

Reproducibility. Anyone holding your work should be able to rebuild every number you report from the raw inputs on their own machine. In a regulated setting, an analysis nobody can reproduce is only an assertion. If you cannot show how a number was produced, you have not produced evidence. A related rule: when a document reports a number, it should read that number from wherever it actually lives, rather than having a person copy it into several places and hope it stays true.

Scope. Any risk assessment that does not say what it leaves out is incomplete, and sooner or later someone senior will ask you exactly that question about your own work.

Regulatory humility. Financial regulation moves. Rules get proposed, revised, litigated and replaced, and supervisory expectations shift without any rule changing at all. Check regulatory facts against primary sources, keep track of the items most likely to have changed, and say so plainly when something is unsettled. An examiner will not accept the training said so, and neither should you.

Key takeaways

• Risk is the product of a bank or credit union, not the problem. The failure mode is risk that was never measured, priced, limited or capitalized.
• Risk management controls single exposures. Enterprise risk management asks whether the institution survives when all of them move together.
• Institutions rarely fail from one bad measurement. They fail from correct parts assembled into a wrong whole.
• Banks and credit unions differ in structure, starting with how they can raise capital, and that difference reaches into regulation, vocabulary and options under stress.
• A risk number means little without economic context. Point in time and through the cycle views tell different stories.
• Analysis that cannot be reproduced is an assertion, not evidence.