The NCUA's New Stance on Risk Ratings and Reputation Risk!

Last week, the NCUA announced that examiners were no longer assigning risk ratings or utilizing reputation risk in the examination and supervisory process. It generated considerable discussion, and I saw some LinkedIn posts stating that boards and CEOs should be alarmed by this. One individual stated that this action was like installing smoke detectors in a house and waiting for someone else to tell credit unions when they were going off.  Having spent half of my career building risk programs and beating the drum on the value of risk management, I have a slightly different perspective, and I believe this is a long-overdue and necessary shift.

Risk ownership and the management of risk have always belonged with the credit union. The NCUA’s decision doesn’t change that; it simply removes a regulatory crutch that has allowed a reactive culture to persist. For too long, risk professionals have been forced to use negative exam and audit findings as leverage just to get the budget and support needed for essential work and backing in their initiatives. This is a symptom of a deeper issue: a fundamental misunderstanding of the role of risk management versus that of audit/assurance. 

Drawing on the example of the smoke detector: expecting your examiners to manage your risk is like asking the fire department to install your smoke detectors and then also monitor them for you. Examiners serve an essential assurance function, evaluating past and current actions against a standard. A risk manager's skillset is entirely different and forward-looking. We are supposed to identify biases in decision-making, point out blind spots, enable risk assessments that focus on the future and possible emerging risks, and quantify the potential impact and likelihood of what lies ahead. 

To truly protect a credit union, risk management must be woven into the fabric of the organization, not simply bolted on to meet a requirement. The role of risk management is to facilitate important conversations—surfacing underlying issues and stress-testing decisions for the collective good. The objective is shared resilience, not criticism. Since risks persist regardless of our attention to them (or examiners assigning a number), leadership from the board and executive team is crucial in building an environment where these challenges can be confronted openly and resolved together. 

The backbone of modern ERM isn’t a collection of heat maps or dashboards. Risk management is about so much more than color coded reports that rarely trigger questions. It is an engine that supports a credit union in achieving its strategic goals while maintaining safety and soundness. It’s a framework for making better, risk-aware decisions. It's the discipline of breaking down silos to understand the full complexity of the organization and how existing and emerging risks can impact the credit union. 

In today's competitive environment, this is not optional. I always compare a risk manager to the navigator in a rally car. The organization provides us a map - the strategic plan - and we tell you where the sharp turns are, where to slow down, and where you can safely accelerate. An examiner’s risk rating is a look in the rearview mirror; it is not enough to navigate the road ahead. 

With exams becoming less frequent, this change is maybe the catalyst credit unions need to become more proactive. My hope is that it prompts leaders to consider their risk management function differently—not as a cost center, but as a strategic partner. It’s a call for boards and leadership teams to engage their risk professionals directly, and to finally have the substantive conversations about risks that they should have been having all along. In the end, a culture that embraces proactive accountability for risk, driven unequivocally from the top, is the institution's most vital safeguard. 

If you found this article valuable, sign up for my newsletter. Each edition is designed to help credit union leaders navigate complex challenges, drive strategic growth, and build more resilient organizations.

Subscribe Here!