Members at the teller counter of a community-scale financial institution, mid-morning.
Home/ Industries/Credit unions
03 / 05 · Sector
Industry · 03/05

Credit unions.

NCUA-examined, member-owned. Distinct governance, capital, and BSA expectations.

01

The sector

Member-owned, examined by the NCUA, scrutinized like a bank.

A credit union's governance is its risk story.

Credit unions are not banks, but their examiners read the same playbook. The NCUA's National Supervision Policy Manual covers ALM, credit risk, BSA, IT, and consumer compliance with expectations that map closely to the FDIC's. The differences sit in the governance — a volunteer board, member-elected directors, and a supervisory committee that operates with a specific NCUA-defined role — and in capital, where the regulatory framework is its own.

Our practice for credit unions is built around the supervisory committee — the NCUA's required member-elected committee that oversees the credit union's audit function. We support the supervisory committee directly, run the internal audit work the committee is responsible for, and partner on examination preparation across BSA, IT, and consumer compliance.

Member-ownership changes the conversation. The findings get presented to a board that is not a typical board. The vocabulary, the patience for jargon, and the appetite for risk look different. We calibrate for it.

02

The regulators in the room

Who reads the workpapers.

Primary federal
NCUAfederal & federally-insured state CUs
State regulator
State CU dept.for state-chartered
BSA / AML
FinCENSAR / CTR, BSA examinations
Capital
Risk-Based CapitalRBC ratio for complex CUs
Consumer
CFPBover $10B in assets
IT / cyber
ACETNCUA's IT examination framework

03

What we do for this sector

The practice areas that show up most often.

04

A representative engagement

Anonymized, but the shape is real.

Institution profile Federal credit union, $3.2B assets, multi-state field of membership.
Trigger Supervisory committee request after a new CEO's first 90 days.
Duration Annual cycle (renewed twice)
Practice areas Internal audit · BSA · IT audit

A supervisory committee that wanted a real third line.

The supervisory committee of a $3.2B federal credit union engaged us as outsourced internal audit after the new CEO's first 90 days. The prior arrangement had been a local CPA firm doing a once-a-year visit. The committee wanted year-round coverage, NCUA-aligned scope, and findings the board would act on. Andres led; the engagement has now run two cycles.

What the audit committee saw
FINDING 01 Year-one risk assessment refactored; audit plan rebalanced from compliance-heavy to risk-driven.
FINDING 02 Two MRAs from the prior examination cycle remediated and re-tested.
FINDING 03 Committee briefings shortened from 90 minutes to 35; action tracking moved into the credit union's GRC tool.

05

Adjacent sectors

Who lives next door.

Start an engagement

Bring the partners to the table.