In the credit union world, we talk a lot about risk. Whether it be tied to exams, audits, RCSAs, and even (hopefully) within strategic planning, the risk discussion gets thrown around a lot. We’ve built frameworks, facilitated risk committee meetings, ran risk models and scenario analysis, and considered various operational and strategic scenarios. Some risk discussions are good, some aren’t so good.
Then, we generate reports. But if we’re being honest, how often do those reports actually lead to better decisions?
That’s a question we at Rochdale have been asking ourselves lately. We think it’s time to take a closer look at how we approach Enterprise Risk Management (ERM) reporting, not just as a compliance requirement, but as a tool for real insight.
There’s no doubt that risk reporting involves a lot of technical work. We gather data, run models, and build dashboards. That’s the science. But if we stop there, we miss the bigger picture… and often the greatest value.
The art of risk reporting is just as important, if not more, than the science. It’s about how we communicate the story behind the numbers. It’s about making sure our reports don’t just inform but actually influence the people who read them. I’m reading a book right now about the art and value of storytelling and it resonates as I think about risk reporting as well. This is your chance to truly tell a story and make an impact!
Ask yourself, are your risk reports driving decisions, moving the needle, creating efficiencies, informing on something not already known, highlighting opportunities that others might not see?
- Highlight the identification of emerging risks, such as economic downturns, cybersecurity threats, competitive moves, or opportunities for new products or services, and how the credit union should take proactive steps to address them.
- Example: Our processes have detected a strong indication of rising interest rate risks, allowing us to adjust our lending strategy, protect member savings and ensure loan affordability.
- Discuss how risk assessments are aligned with member needs and values, ensuring services remain accessible, secure, and beneficial.
- Example: We were able to proactively increase the budget to enhance fraud detection systems after identifying increased phishing attempts across multiple product lines, safeguarding members’ financial well-being.
- Ensure ERM informs strategic planning, helping the credit union pursue opportunities while managing downside risks.
- Example: Risk analysis supported expansion into digital lending, balancing innovation with compliance and cybersecurity safeguards.
- Use risk data to make informed, timely decisions that benefit the organization and its members.
- Example: “Risk trend analysis led us to revise our loan approval criteria, reducing defaults while maintaining access to credit.”
Too often, risk reports are treated like a formality. We send them out once a quarter, maybe present a few slides to the board, and then move on. But that’s not how risk works. Risks don’t wait for the next reporting cycle. They evolve constantly.
That’s why we need to shift our mindset. ERM reporting should be as much a conversation as a document or presentation. It shouldn’t be limited to a one-way communication, rather, something that helps leaders across the organization think more clearly about what’s ahead and how to prepare for it.
One of the biggest mistakes is assuming that one report fits all. The board doesn’t need the same level of detail as a department head. And a department head doesn’t need a heat map if it doesn’t help them make a decision. It’s not about just doing more… it’s time we focus on doing better!
We risk folks need to meet people where they are. That means using plain language, focusing on what matters most to each audience, and connecting risk to strategy and performance. When we do that, ERM becomes a lot more relevant and a lot more powerful.
At the end of the day, our goal isn’t to produce pretty reports. It’s to help our credit unions thrive in a world that’s full of uncertainty (and opportunity). Let’s stop thinking of ERM reporting as just another task to check off. Let’s treat it as a chance to lead, to guide, and to make a real difference.