In this special archive episode of With Flying Colors, Mark Treichel is joined by Steve Farr and Todd Miller — both former NCUA leaders — to revisit a foundational topic that continues to shape credit union supervision today: risk appetite, risk culture, and concentration risk.

While regulators often emphasize capital levels, history shows that capital alone cannot offset poor risk governance. This conversation explores why concentration risk continues to challenge institutions — even those that appear well capitalized.

Drawing on decades of regulatory experience, the team walks through the core components of a modern risk management framework and discusses how boards should think about oversight in today’s environment.

What We Cover

🔹 Risk Culture Starts at the Top

• Why tone from the board and CEO matters more than policies
• How troubled institutions often trace back to cultural breakdowns
• The board’s role in defining acceptable risk

🔹 Risk Appetite: Limit or Goal?

• What a risk appetite statement actually means
• Why limits must be measurable and monitored
• The difference between qualitative intent and quantitative control

🔹 Concentration Risk in the Real World

• The taxi medallion example and what it taught the industry
• Why 15%+ capital ratios were not enough
• How concentration risk interacts with capital and stress scenarios

🔹 The Three Lines of Defense

• Frontline business units
• Risk management oversight (including the Chief Risk Officer role)
• Internal audit and supervisory committee functions

🔹 Examiner Expectations Today

• Stress testing and concentration limits
• Supporting board-approved limits with data
• What happens when limits are breached
• Why documentation and reporting matter

Key Takeaways

• Capital can absorb losses — but it cannot fix poor diversification.
• Risk appetite should reflect capital strength, strategic goals, and institutional complexity.
• Concentration limits are not aspirational targets — they are guardrails.
• Effective risk management requires culture, measurement, and accountability.

Why This Still Matters

Regulatory guidance continues to evolve, but the core principles of risk governance remain unchanged. Whether you lead a $300 million credit union or a multi-billion-dollar institution, understanding how risk culture, appetite, and oversight interact is essential.

This archive episode remains highly relevant as examiners increasingly scrutinize concentration risk and enterprise risk management practices.