ENTERPRISE RISK MANAGEMENT: AN OVERVIEW
         Enterprise Risk Management is a method for identifying, assessing, controlling, and 
          reporting risk throughout the enterprise
         The board and management have responsibilities for governing the bank’s structure, 
          operations, and risks, especially by establishing a risk culture and risk appetite
         Enterprise risk management typically engages three separate, independent functions 
          (commonly referred to as the three lines of defense: front line business units 
          (sometimes called risk control), independent risk management, and internal audit
         ERM Requirements for Financial Institutions $50 Billion and Larger are not discussed in 
          this presentation – those requirements are reflected in the source materials on the last 
          slide of this presentation
      WHAT IS ENTERPRISE RISK MANAGEMENT (ERM)? 
         ERM is a process by which a regulated financial institution:
               Establishes a risk culture for the enterprise and a risk appetite for the businesses and 
                processes in which it engages;
               Identifies the risks associated with those businesses and processes
               Controls the risk associated with those businesses and processes
               Monitors its businesses and processes to determine if the controls are effective at 
                preventing and detecting the risks associated with the businesses and processes
               Reports to the board and management on key indicators of those risks and the effect on 
                the financial performance, safety, and reputation of the financial institution 
      ERM AND THE FEDERAL RESERVE’S SR 16-11
         The Federal Reserve places significant supervisory emphasis on an institution’s 
          management of risk, including its system of internal controls, when evaluating the 
          overall effectiveness of an institution’s risk management
         An institution’s failure to establish a management structure that adequately 
          identifies, measures, monitors, and controls the risks of its activities has long been 
          considered unsafe-and-unsound conduct
         Principles of sound management should apply to all risks facing an institution 
          including credit, market, liquidity, operational, compliance, and legal risk
         SR 16-11 Supervisory Guidance for Assessing Risk Management at Supervised Institutions with 
          Total Consolidated Assets Less than $50 Billion
      ERM IS IMPORTANT FOR SUPERVISORY RATINGS 
         Besides limiting credit and operating losses, effective ERM affects the CAMELS 
          rating
         The “M” in CAMELS represents an assessment of the quality of board oversight and 
          management supervision 
         The “management” rating reflects examiner conclusions about the board and 
          management’s willingness and ability to effectively address governance, risk 
          management, compliance, bank operations, and financial performance.
      THE BOARD AND MANAGEMENT ARE 
      RESPONSIBLE FOR EFFECTIVE ERM 
         The board and senior management are expected to use good corporate governance 
          and risk governance practices to:
               Set the bank’s strategy, objectives, and risk appetite
               Establish the bank’s risk governance framework
               Identify, measure, monitor, and control risks
               Supervise and manage the bank’s business
               Protect the interests of depositors, protect shareholders’ or members’ (in the case of a 
                mutual FSA) obligations, and take into account the interests of other stakeholders
               Align corporate culture, activities, and behaviors with the expectation that the bank will 
                operate in a safe and sound manner, operate with integrity, and comply with applicable 
                laws and regulations