Credit union risk management at a small credit union needs seven elements drawn from NCUA rules and examination procedures.
These elements include board oversight, an annual supervisory committee audit, written board-approved policies, a risk assessment organized by NCUA’s risk categories, internal controls, vendor oversight, and cybersecurity assessment with incident reporting.
This article covers where the essentials apply, the rule behind each element, what scales to a small staff, the records examiners review and how a risk platform applies them.
Minimum Elements of Credit Union Risk Management
Seven elements make up the program, each tied to a rule or examination procedure:
- Board oversight
Directors direct management in line with NCUA requirements and need a working grasp of basic finance and accounting within six months of election (12 CFR 701.4(b)).
- Supervisory committee audit and verification
The supervisory committee obtains an audit every calendar year and verifies members’ accounts at least once every two years (715.4, 715.8).
- Written, board-approved policies
Lending (741.3(b)(2)), liquidity (741.12), a Bank Secrecy Act program (748.2) and an information security program (748.0).
- Risk assessment
A credit union risk assessment rates exposure in each NCUA risk category on a scale the credit union sets.
- Internal controls
The supervisory committee ensures internal controls are established and effectively maintained (715.3(b)(1)).
- Vendor oversight
Due diligence, contract terms and monitoring of service providers (Appendix A, III.D).
- Cybersecurity assessment and incident reporting
NCUA’s Automated Cybersecurity Evaluation Toolbox (ACET) is voluntary; a reportable cyber incident goes to NCUA within 72 hours (748.1(c)).
Which Elements Scale and Which Do Not
Credit union risk management rules fix some requirements at every size and leave others for the credit union to set in its own policy:
| Element | Fixed by rule | Left to the credit union |
|---|---|---|
| Supervisory committee audit | Annual audit; verification every two years; CPA financial statement audit at $500 million or more (715.5) | Below $500 million, the committee, its internal auditor or another qualified person may perform the audit (715.7) |
| Liquidity | Written policy and contingent source list below $50 million; contingency funding plan from $50 million; federal liquidity source from $250 million (741.12) | No contingency funding plan rule below $50 million |
| Interest rate risk | Written interest rate risk (IRR) policy and program above $50 million (741.3(b)(5)) | No written policy rule below that size; SCUEP still reviews IRR |
| Bank Secrecy Act | Written program approved by the board and recorded in minutes (748.2) | Controls sized to the risk profile (26-CU-01) |
| Information security | Written program, board approval and 72-hour incident notice (Part 748) | Choice of assessment tool; ACET is voluntary |
| Vendor oversight | Due diligence, contract terms and monitoring (Appendix A, III.D) | Depth of review per vendor, set by criticality |
| Enterprise risk management | Formal ERM required only of corporate credit unions | Structure of the risk program and its rating scale |
Records an NCUA Examiner Asks For
Examiners work from NCUA’s SCUEP defined-scope procedures and its supervisory committee exam procedures.
Six questions come from them, each answered by a record:
- Who completed the supervisory committee audit, with what qualifications, and how was the auditor selected?
Record: audit report, engagement letter, committee minutes.
- Were member accounts verified on time, and do member statement totals reconcile to the share and loan trial balance and general ledger?
Record: verification results and the reconciliation.
- What material issues has the board discussed since the last exam?
Record: board and annual meeting minutes.
- Does the Bank Secrecy Act program meet the rule?
Record: the board-approved program and BSA questionnaire answers.
- How is member information protected?
Record: the written Gramm-Leach-Bliley Act (GLBA) information security program and Data and Network Controls questionnaire responses.
- Is the disaster recovery plan current?
Record: the plan, which SCUEP procedures review every other calendar year.
Credit Union Vendor Management Without NCUA Authority
Small credit unions lean on vendors and credit union service organizations (CUSOs) that NCUA cannot examine. The agency’s temporary authority, granted in 1998, expired on December 31, 2001, according to NCUA’s Third-Party Vendor Authority paper.
Credit union vendor management therefore rests on the credit union’s own file: due diligence, contract terms and monitoring records, the core of a vendor management program.
A bill to restore it, Representative Bill Foster’s Strengthening Oversight for the Financial Sector Act, was introduced on September 2, 2026 and referred to the House Financial Services Committee. No date for further action has been announced as of publishing this article.
Frequently Asked Questions
Do Small Credit Unions Need Enterprise Risk Management?
Small credit unions do not need a formal enterprise risk management framework. NCUA’s Examiner’s Guide, citing Supervisory Letter 13-12, requires formal ERM only of corporate credit unions and notes that a program does not have to be called ERM to be effective. The supervisory committee audit, written policies and information security program still apply.
What Are NCUA’s Risk Categories?
NCUA’s risk categories are credit, interest rate, liquidity, transaction, compliance and strategic risk. Reputation risk was a seventh until Letter 25-CU-05 ended its use in examinations on September 25, 2025, and NCUA no longer assigns ratings to the categories. Examiners also look at concentration risk, where a concentration could cause losses large enough to threaten solvency.
Is the NCUA ACET Required?
The NCUA ACET is voluntary: Letter 21-CU-15 says credit unions do not have to use the toolbox or complete its maturity assessment. NCUA offers it at no cost and updated it on September 16, 2025 to incorporate NIST Cybersecurity Framework 2.0. The Part 748 information security program and the 72-hour cyber incident notice apply either way.
A risk and issues management solution tailored to the needs of community banks and credit unions.
Request Demo- Preloaded Dashboards
- Pre-Built Workbooks
- Scalable Platform
- Preconfigured Assessments