In a world where so many believe bigger is better, smaller community banks and credit unions are proving them wrong. Nimble and personal, smaller financial institutions can effectively compete with larger institutions—but there are challenges, especially when it comes to risk management and compliance.
Today we’re highlighting the Ncontracts webinar Small FIs, Big Plans and sharing some expert tips on managing risk and compliance at smaller FIs.
Tip #1: There is no one-size-fits-all compliance management system (CMS), so use that to your advantage and customize it to your size and risk tolerance.
An appropriate compliance management software for a smaller FI will look very different from the CMS of a larger, complex FI—and should be tailored to the institution based on complexity and risk tolerance. For example, there is no single way to structure compliance.
Related: ERM 101: What’s Your FI’s Risk Appetite?
Smaller FIs tend to embrace one of two models:
- Model 1: One very busy compliance officer wears a dozen hats. A jack-of-all-trades, they often help manage everything from compliance and BSA programs to conducting monitoring, testing, and training.
- Models: De-centralizing compliance and making each department own the responsibility for change management, including implementing new regs and keeping up with compliance requirements. (Ex: The lending department is charged with all lending compliance, the ops team takes deposit compliance, and IT handles information security and privacy.)
Whatever model your FI chooses, the goal of your CMS should be to prevent and mitigate consumer harm and include the basic building blocks of a CMS (board and management oversight and a compliance program with policies and procedures, monitoring and testing, complaint resolution, and tailored training.
Related: Examiners Want to Know: Does Your CMS Ensure Consumer Protection & Compliance?
Tip #2: De-centralized compliance requires centralized oversight and management.
When your institution has de-centralized compliance, with each department in charge of ensuring compliance, expectations must be clearly defined and frequently communicated. In de-centralized programs, board and senior management oversight become even more important as there is not just one department tasked with the authority to manage and oversee day-to-day operations, including developing and implementing the compliance program. Having clearly defined roles and consistent reporting back to the board are essential.
This is where investing in task management technology can also make sure compliance tasks don’t get forgotten. FIs with de-centralized compliance benefit from a compliance assembly line of sorts. Folks need to know what direction they should go, who is responsible for what, and how the effectiveness of the compliance program will be measured.
Tip #3: Have your compliance officer focus on the interpretation of regulation and guidance.
Tracking new laws, regulations, and guidance is time-consuming, and a FI is much better served when a compliance officer focuses on interpretation. While there are plenty of technologies and partners that can track regulation, only your compliance officer can engage in in-depth analysis to understand how to best effectively and efficiently implement the rule at your FI. Removing tasks that may not require a compliance officer’s particular set of skills frees up their time to focus on higher-value tasks like interpretation and implementation.
Related: Four Ways to Streamline Your CMS
Tip #4: Examiners don’t expect a one-size-fits-all approach—but they do expect to see some form of risk management.
Relatively basic risk-management systems may be adequate for smaller FIs that:
- Engage solely in traditional banking activities
- Have robust management actively involved in the details of day-to-day operations
The key focus should be foundational. Be consistent with risk management and leverage your work in your business decisions to get the most value from risk management activities.
Tip #5: There is no such thing as too small for enterprise risk management (ERM).
ERM is essentially risk management that allows your FI to better identify opportunities in the market and enhance strategic decision making.
Many institutions lack the resources, management support, or data to conduct adequate testing. Other compliance officers worry their testing and review plan isn’t robust enough and requires more specific scoping and better monitoring. Address this issue by using your risk assessment to recognize which controls you are relying on the most to prevent the biggest risks and focus your testing and monitoring on those controls. When it’s impossible to do everything, focus on the most significant issues that present the most risk. ERM helps you do all these things.
Tip #6: Try to attract a diverse board with great skills.
Board members at smaller institutions can provide incredibly helpful advisory services. For example, a regulatory expert can provide assistance. Those with accounting or fraud experience can serve on ALCO or audit committees. Those with a strong technology or cyber background can help with managing cyber risk.
While this isn’t generally the role of a board member, a smaller institution with very limited resources can capitalize on its board of directors’ expertise to save money and increase oversight.
Tip #7: Customer-facing technology is important, but don’t forget the back office.
If your back office is still running tons of manual processes, your FI is at increased operational risk due to employee mistakes. Seek out areas where your FI can automate back-office processes. Replacing manual processes with automation can save money, especially if a variety of staff members are spending significant amounts of money completing manual processes on a daily basis.
Read also: Discover Home Loans and Ncontracts partner to streamline the mortgage process for customers
Want more tips and insights from smaller financial institutions like yours? Download our on-demand webinar today.
Related: Creating Reliable Risk Assessments
Subscribe to the Nsight Blog
Share this
What Is Compliance Risk Management?
What Will Examiners Look for in 2022? OCC Releases Supervisory Priorities
