By Jeff Owen

Strategic planning is one of the most important responsibilities of a credit union board. It sets the direction for growth, member service, and long-term sustainability. Yet, many boards overlook a critical factor that determines whether those plans succeed: risk appetite.

Risk appetite is much more than a regulatory requirement. It’s the board’s declaration of how much uncertainty the organization is/should be willing to accept in pursuit of its goals and objectives. Without clarity around risk appetite, even the most well-crafted strategic plan can lead to unintended consequences or disappointing results.

What Is Risk Appetite (and Why Should Boards Care)?

Risk appetite defines the boundaries within which management operates. It answers questions like:

• How aggressively should we pursue growth?
• How much liquidity risk can / should we tolerate?
• What level of technology investment and vendor outsourcing is acceptable given cybersecurity and member service concerns?

For boards, risk appetite is a meaningful tool in the governance toolkit:

• It clearly sets the tone at the top: It signals to management and regulators that risk is managed intentionally.
• It aligns expectations: It ensures strategic ambitions match the organization’s capacity to absorb risk and provides opportunity for management to outline what level of risk is required to achieve expected outcomes.
• It protects reputation and member trust: Misaligned risk-taking can lead to financial loss and erosion of member trust.

The Missed Opportunity

Too often, boards approve a risk appetite statement as a compliance exercise, or worse yet, have it defined by an outside party, and then just move on. The result? Strategic plans that ignore risk realities and/or risk frameworks that fail to support growth. This disconnect can lead to both overly cautiousstrategies resulting in missed opportunities or overly aggressivestrategies that expose the credit union to unacceptable risk. 

Integrating Risk Appetite into Strategic Planning

Boards can change this dynamic by making risk appetite a strategic enabler rather than a regulatory checkbox. Here’s how:

Start with Strategy

Define your credit union’s long-term objectives (growth, member experience, technology investment, community impact, etc.).

Overlay Risk Appetite

Ask: How much risk are we willing to take in pursuit of these objectives? Consider risks across all the risk categories (compliance, credit, interest rate, liquidity, reputation, strategic and transaction). We typically include information security or cybersecurity as a category all to its own given the growing emphasis in this area. Develop specific risk appetite statements for each category of risk.

Use Metrics

Then, establish quantitative Key Risk Indicators (KRIs) and Key Performance Indicators (KPIs). For example:

• Loan growth target vs. concentration limits
• Technology investment vs. cybersecurity risk thresholds

There are many KRIs and KPIs but find those that best support your ability to monitor adherence to stated risk appetite levels.

Monitor and Adjust

Risk appetite isn’t static. Boards should revisit it annually (at a minimum) or when major strategic shifts occur, such as mergers, new product launches, economic downturns or major evolution of technological capabilities.

Benefits for Boards

• Better Decision-Making: Aligning risk appetite with strategy gives directors confidence that bold moves are supported by disciplined risk management.
• Enhanced Oversight: Clear boundaries help boards fulfill fiduciary duties without micromanaging.
• Future-Proofing: In a rapidly changing financial landscape, integrated risk thinking positions your credit union to adapt and thrive.
• Alignment with Mission: Risk appetite should harmonize with the credit union’s overall mission and values.
• Member and Regulatory Confidence: Clearly communicating risk appetite to members and regulatory bodies demonstrates transparency and responsible governance. 

Questions for Your Next Board Meeting

• Does our strategic plan explicitly reflect our risk appetite?
• Are we confident management understands and operates within those boundaries?
• How often do we review and update our risk appetite in light of changes in the internal and external environment?

Closing Thought

Risk appetite isn’t about risk avoidance or elimination. It’s about laying the foundation for the organization to take the right risks for the right reasons. When boards integrate risk appetite into strategic planning, they transform uncertainty into opportunity and lead with confidence.

Jeff Owen is chief operating officer with Rochdale. For more information on risk appetite, contact Rochdale at [email protected].