PRSRT_STDPRSRT_STD 2/13/01 2/13/01 8:52 8:52 AM AM Pag Pag YearYearYearYear ofof ofof TransitionTransition TransitionTransition Regulatory Regulatory RegulatoryRegulatory ExpectationsExpectations ExpectationsExpectations e e ee GreatGreat GreatGreat BankBank BankBank RobberyRobbery RobberyRobbery CAROLINA BANKER SPRING 2016 BANKER CAROLINA SPRING 2016 BANKER CAROLINA SPRING 2016 BANKER CAROLINA SPRING 2016 BANKER CAROLINA WhatWhatWhatWhat would would wouldwould REGULATORYREGULATORYREGULATORYREGULATORY RELIEFRELIEFRELIEFRELIEF meanmeanmeanmean for for forfor North North NorthNorth Carolina’s Carolina’s Carolina’sCarolina’s hometowns?hometowns?hometowns?hometowns? ItIt It Itmeansmeans meansmeans creatingcreating creatingcreating jobs.jobs. jobs.jobs. ItIt It Itmeansmeans meansmeans stimulatingstimulating stimulatingstimulating economiceconomic economiceconomic growth.growth. growth.growth. ItIt It Itmeansmeans meansmeans stronger,stronger, stronger,stronger, moremore moremore prosperousprosperous prosperousprosperous communities.communities. communities.communities. SignSignSignSign thethe thethe petitionpetition petitionpetition toto toto passpass passpass regulatoryregulatory regulatoryregulatory reliefrelief reliefrelief (S.1484)(S.1484) (S.1484)(S.1484) now.now. now.now. VisitVisitVisitVisit aba.com/RegReliefaba.com/RegRelief aba.com/RegReliefaba.com/RegRelief NorthNorthNorthNorth CarolinaCarolina CarolinaCarolina YoungYoungYoungYoung BankersBankers BankersBankers MeetMeetMeetMeet thethe thethe NorthNorth NorthNorth CarolinaCarolina CarolinaCarolina YoungYoungYoungYoung BankersBankers BankersBankers AdvisoryAdvisoryAdvisoryAdvisory CouncilCouncil CouncilCouncil ©© 2015 ©2015© 2015 2015 AmericanAmerican AmericanAmerican BankersBankers BankersBankers AssociationAssociation AssociationAssociation Reg RegRelief Relief SBA SBA Ad NC.indd Ad NC.indd 1 1 11/5/201511/5/2015 1:51:03 1:51:03 PM PM PRACTICAL CONSIDERATIONS FOR COMMUNITY BANKS - ENTERPRISE RISK MANAGEMENT On October 22, 2012, the Deputy Comp- foundation on which to build an effective troller of the Office of the Comptroller ERM process. of the Currency made some prepared remarks at a community bank enterprise The Framework indicates that ERM en- risk management seminar in Washington, compasses: D.C. Most thought those remarks were the • Aligning risk appetite and strategy prelude to Enterprise Risk Management • Enhancing risk response decisions (ERM) becoming the new hot topic in • Reducing operational surprises and banking with substantial regulatory focus losses and scrutiny. It was also presumed these • Identifying and managing multiple Doug Mims, CPA, is heightened expectations would be ac- and cross – enterprise risks the Financial companied by specific formal guidance for • Seizing opportunities Institution Industry banks both large and small in the form of • Improving deployment of capital partner with Carr, interagency guidance and the like. Riggs & Ingram, LLC. Further, the Framework defines ERM as Fast forward to 2016 and you will find follows: many community bankers still searching for guidance and unaware of the benefits of “Enterprise risk management is a process, an effective ERM program. This is particu- effected by an entity’s board of directors, larly true for community banks with less management and other personnel, applied than $1 billion in assets where the regula- in strategy setting and across the enter- tory expectations have been inconsistent prise, designed to identify potential events across agencies and assistance with practi- that may affect the entity, and manage cal solutions the same. risk to be within its risk appetite, to pro- vide reasonable assurance regarding the In September of 2004, the Committee of achievement of entity objectives.” Sponsoring Organizations (COSO or The Committee) of the Treadway Commission Several key elements of the above are published Enterprise Risk Management – important in understanding ERM and in Integrated Framework (The Framework). the effective application of its principles. This guidance was designed to expand The executive summary of the Framework upon the Committee’s Internal Control In- is an excellent overview and quick read for tegrated Framework (updated in 2013) and anyone that wants to better understand provide for a more “robust and extensive the foundation of ERM. focus on the broader subject of enterprise risk management”. In doing so, the Com- The Risk Management Association (RMA) mittee created a useful tool for banks and also developed a risk framework that is other companies to understand the theoret- thought provoking in considering the ical basis of ERM and provide a structural practical implications of ERM, adapted to Spring 2016 Carolina Banker 43 financial services. The structure of their on an equally robust strategic planning ERM components is as follows: process that establishes clear measurable • Coverage: What are all the risks to our strategic objectives (business strategy). business strategy and operations? • Risk Appetite: How much risk are we Establish the bank’s risk appetite. Risk willing to take? appetite can also be thought of as “risk • Governance & Policies: How good are tolerance” and is a vital element in de- we at overseeing risk taking? veloping the bank’s ERM infrastructure. • Risk Data & Infrastructure: How do Developing a risk statement is one avenue we ensure we have the right informa- to clearly articulate the bank’s risk toler- tion to manage risk? ance but is not an absolute. However, the • Measurement, Evaluation and Com- bank must clearly articulate the amount munication: How do we determine of risk it is willing to assume to execute the size and scope of the risk and its strategy. report the results? • Control Environment: How well do Identify an ERM “champion” or equiva- we manage the risks? lent. Depending on the size and com- • Response: What are we doing about plexity of the institution, consideration of the risks? identifying or hiring a Chief Risk Officer • Stress testing: What else can go wrong is an option. Regardless of title, someone and how are risks interconnected? in executive management must “own” ERM and facilitate many of the activities Furthermore and worthy of note, the discussed herein. foundation of the RMA’s components is “C u l t u r e”. Establish a management level risk com- mittee. While the BOD must “own” the While the aforementioned documents process, in most instances, management provide a theoretical basis and hopefully will be the “doers”. The success or failure “frame” ERM for the reader, they do not of the ERM designee will be in large part provide implementation guidance or “next based on the support he or she receives steps for community banks”. However, from executive management. A manage- there are a number of practical steps a ment level committee can be an effective community bank can take to begin de- means by which to allocate responsibility veloping an efficient and effective ERM for tasks and send a clear united message process. to employees that ERM is inherent in the culture of the bank. Establish a risk committee of the Board of Directors (BOD) or equivalent. The Educate executive management and tone at the top drives the bank and ERM BOD. Depending on the institution, is no exception. The BOD has to “buy in” ERM may still be “out there” for the and both facilitate and accept responsibil- BOD and executive management. A little ity for a number of key elements of the practical training as part of a BOD retreat practical considerations offered below. might be in order. Define measurable strategic objectives Develop an ERM policy. A robust ERM that are aligned with the bank’s risk ap- policy will encompass many of the ele- petite. Most community banks perform ments discussed above and provide a some level of strategic planning. However, clear road map for an effective ERM a robust ERM process is largely dependent process. 44 Carolina Banker Spring 2016 Perform an enterprise-wide risk assess- ment and the BOD need to establish the ment. Most banks currently have a num- metrics that will allow them to monitor ber of elements of an enterprise wide risk progress towards strategic objectives and assessment already in place. It may just be measure the relative risk being assumed. a matter of pulling existing risk analyses Most of this data is readily available and together, identifying gaps, supplement- simply needs to be pulled together in a ing where necessary and compiling one concise manner also known as a “dash cohesive document. The resulting analy- b o ard .” sis should be periodically reviewed and approved by the BOD. While none of the above considerations are ground breaking, they are hopefully Inventory current practices, policies thought provoking for community banks and procedures and identify gaps. still uncertain as to how to get started Similar to the risk assessment, many of or regain momentum in establishing an the policies and practices for the ERM effective and efficient ERM process. The program are already in place. They simply concepts of formal BOD oversight of risk, need to be identified and brought to- robust strategic planning, clearly defining gether in order to identify gaps and build risk tolerance and effective monitoring a bridge to ERM. are sound business practices, regardless of the acronym. After all, effective ERM Measure and monitor on an appropri- is not about regulators and policies – it’s ate frequency – develop a dash board. C about maximizing shareholder value. B All of the