Table of Contents I. Introduction

A. Complexity

B. IRR Exposure

II. IRR Policy III. IRR Oversight and Management

A. Board of Directors Oversight

B. Management Responsibilities

IV. IRR Measurement and Monitoring

A. Risk Measurement Systems

B. Risk Measurement Methods

C. Components of IRR Measurement Methods

V. Internal Controls VI. Decision-Making Informed by IRR Measurement Systems VII. Guidelines for Adequacy of IRR Policy and Effectiveness of Program VIII. Additional Guidance for Large Credit Unions With Complex or High Risk Balance Sheets IX. Definitions I. Introduction

This appendix provides guidance to FICUs in developing an interest rate risk (IRR) policy and program that addresses aspects of asset liability management in a single framework. An effective IRR management program identifies, measures, monitors, and controls IRR and is central to safe and sound credit union operations. Given the differences among credit unions, each credit union should use the guidance in this appendix to formulate a policy that embodies its own practices, metrics and benchmarks appropriate to its operations.

These practices should be established in light of the nature of the credit union's operations and business, as well as its complexity, risk exposure, and size. As these elements increase, NCUA believes the IRR practices should be implemented with increasing degrees of rigor and diligence to maintain safe and sound operations in the area of IRR management. In particular, rigor and diligence are required to manage complexity and risk exposure. Complexity relates to the intricacy of financial instrument structure, and to the composition of assets and liabilities on the balance sheet. In the case of financial instruments, the structure can have numerous characteristics that act simultaneously to affect the behavior of the instrument. In the case of the balance sheet, which contains multiple instruments, assets and liabilities can act in ways that are compounding or can be offsetting because their impact on the IRR level may act in the same or opposite directions. High degrees of risk exposure require a credit union to be diligently aware of the potential earnings and net worth exposures under various interest rate and business environments because the margin for error is low.

A. Complexity

In influencing the behavior of instruments and balance sheet composition, complexity is a function of the predictability of the cash flows. As cash flows become less predictable, the uncertainty of both instrument and balance sheet behavior increases. For example, a residential mortgage is subject to prepayments that will change at the option of the borrower. Mortgage borrowers may pay off their mortgage loans due to geographical relocation, or may increase the amount of their monthly payment above the minimum contractual schedule due to other changes in the borrower's circumstances. This cash flow unpredictability is also found in investments, such as collateralized mortgage obligations, because these contain mortgage loans. Additionally, cash flow unpredictability affects liabilities. For example, nonmaturity share balances vary at the discretion of the depositor making deposits and withdrawals, and this may be influenced by a credit union's pricing of its share accounts.

B. IRR Exposure

Exposure to IRR is the vulnerability of a credit union's financial condition to adverse movements in market interest rates. Although some IRR exposure is a normal part of financial intermediation, a high degree of this exposure may negatively affect a credit union's earnings and net economic value. Changes in interest rates influence a credit union's earnings by altering interest-sensitive income and expenses (e.g. loan income and share dividends). Changes in interest rates also affect the economic value of a credit union's assets and liabilities, because the present value of future cash flows and, in some cases, the cash flows themselves may change when interest rates change. Consequently, the management of a credit union's pricing strategy is critical to the control of IRR exposure.

All FICUs required to have an IRR policy and program should incorporate the following five elements into their IRR program:

1. Board-approved IRR policy.

2. Oversight by the board of directors and implementation by management.

3. Risk measurement systems assessing the IRR sensitivity of earnings and/or asset and liability values.

4. Internal controls to monitor adherence to IRR limits.

5. Decision making that is informed and guided by IRR measures.

II. IRR Policy

The board of directors is responsible for ensuring the adequacy of an IRR policy and its limits. The policy should be consistent with the credit union's business strategies and should reflect the board's risk tolerance, taking into account the credit union's financial condition and risk measurement systems and methods commensurate with the balance sheet structure. The policy should state actions and authorities required for exceptions to policy, limits, and authorizations.

Credit unions have the option of either creating a separate IRR policy or incorporating it into investment, ALM, funds management, liquidity or other policies. Regardless of form, credit unions must clearly document their IRR policy in writing.

The scope of the policy will vary depending on the complexity of the credit union's balance sheet. For example, a credit union that offers short-term loans, invests in non-complex or short-term bullet investments (i.e. a debt security that returns 100 percent of principal on the maturity date), and offers basic share products may not need to create an elaborate policy. The policy for these credit unions may limit the loan portfolio maturity, require a minimum amount of short-term funds, and restrict the types of permissible investments (e.g. Treasuries, bullet investments). More complex balance sheets, especially those containing mortgage loans and complex investments, may warrant a comprehensive IRR policy due to the uncertainty of cash flows.

The policy should establish responsibilities and procedures for identifying, measuring, monitoring, controlling, and reporting IRR, and establish risk limits. A written policy should:

• Identify committees, persons or other parties responsible for review of the credit union's IRR exposure;

• Direct appropriate actions to ensure management takes steps to manage IRR so that IRR exposures are identified, measured, monitored, and controlled;

• State the frequency with which management will report on measurement results to the board to ensure routine review of information that is timely (e.g. current and at least quarterly) and in sufficient detail to assess the credit union's IRR profile;

• Set risk limits for IRR exposures based on selected measures (e.g. limits for changes in repricing or duration gaps, income simulation, asset valuation, or net economic value);

• Choose tests, such as interest rate shocks, that the credit union will perform using the selected measures;

• Provide for periodic review of material changes in IRR exposures and compliance with board approved policy and risk limits;

• Provide for assessment of the IRR impact of any new business activities prior to implementation (e.g. evaluate the IRR profile of introducing a new product or service); and

• Provide for at least an annual evaluation of policy to determine whether it is still commensurate with the size, complexity, and risk profile of the credit union.

IRR policy limits should maintain risk exposures within prudent levels. Examples of limits are as follows:

GAP: less than ±I 10 percent change in any given period, or cumulatively over 12 months.

Income Simulation: net interest income after shock change less than 20 percent over any 12-month period.

Asset Valuation: after shock change in book value of net worth less than 50 percent, or after shock net worth of 4 percent or greater.

Net Economic Value: after shock change in net economic value less than 25 percent, or after shock net economic value of 6 percent or greater.

NCUA emphasizes these are only for illustrative purposes, and management should establish its own limits that are reasonably supported. Where appropriate, management may also set IRR limits for individual portfolios, activities, and lines of business.

III. IRR Oversight and Management A. Board of Directors Oversight

The board of directors is responsible for oversight of their credit union and for approving policy, major strategies, and prudent limits regarding IRR. To meet this responsibility, understanding the level and nature of IRR taken by the credit union is essential. Accordingly, the board should ensure management executes an effective IRR program.

Additionally, the board should annually assess if the IRR program sufficiently identifies, measures, monitors, and controls the IRR exposure of the credit union. Where necessary, the board may consider obtaining professional advice and training to enhance its understanding of IRR oversight.

B. Management Responsibilities

Management is responsible for the daily management of activities and operations. In order to implement the board's IRR policy, management should:

• Develop and maintain adequate IRR measurement systems;

• Evaluate and understand IRR risk exposures;

• Establish an appropriate system of internal controls (e.g. separation between the risk taker and IRR measurement staff);

• Allocate sufficient resources for an effective IRR program. For example, a complex credit union with an elevated IRR risk profile will likely necessitate a greater allocation of resources to identify and focus on IRR exposures;

• Develop and support competent staff with technical expertise commensurate with the IRR program;

• Identify the procedures and assumptions involved in implementing the IRR measurement systems; and

• Establish clear lines of authority and responsibility for managing IRR; and

• Provide a sufficient set of reports to ensure compliance with board approved policies.

Where delegation of management authority by the board occurs, this may be to designated committees such as an asset liability committee or other equivalent. In credit unions with limited staff, these responsibilities may reside with the board or management. Significant changes in assumptions, measurement methods, tests performed, or other aspects involved in the IRR process should be documented and brought to the attention of those responsible.

IV. IRR Measurement and Monitoring A. Risk Measurement Systems

Generally, credit unions should have IRR measurement systems that capture and measure all material and identified sources of IRR. An IRR measurement system quantifies the risk contained in the credit union's balance sheet and integrates the important sources of IRR faced by a credit union in order to facilitate management of its risk exposures. The selection and assessment of appropriate IRR measurement systems is the responsibility of credit union boards and management.

Management should:

• Rely on assumptions that are reasonable and supportable;

• Document any changes to assumptions based on observed information;

• Monitor positions with uncertain maturities, rates and cash flows, such as nonmaturity shares, fixed rate mortgages where prepayments may vary, adjustable rate mortgages, and instruments with embedded options, such as calls; and

• Require any interest rate risk calculation techniques, measures and tests to be sufficiently rigorous to capture risk.

B. Risk Measurement Methods

The following discussion is intended only as a general guide and should not be used by credit unions as an endorsement of a particular method. An IRR measurement system may rely on a variety of different methods. Common examples of methods available to credit unions are GAP analysis, income simulation, asset valuation, and net economic value. Any measurement method(s) used by a credit union to analyze IRR exposure should correspond with the complexity of the credit union's balance sheet so as to identify any material sources of IRR.

GAP Analysis

GAP analysis is a simple IRR measurement method that reports the mismatch between rate sensitive assets and rate sensitive liabilities over a given time period. GAP can only suffice for simple balance sheets that primarily consist of short-term bullet type investments and non mortgage-related assets. GAP analysis can be static, behavioral, or based on duration.

Income Simulation

Income simulation is an IRR measurement method used to estimate earnings exposure to changes in interest rates. An income simulation analysis projects interest cash flows of all assets, liabilities, and off-balance sheet instruments in a credit union's portfolio to estimate future net interest income over a chosen timeframe. Generally, income simulations focus on short-term time horizons (e.g. one to three years). Forecasting income is assumption sensitive and more uncertain the longer the forecast period. Simulations typically include evaluations under a base-case scenario, and instantaneous parallel rate shocks, and may include alternate interest-rate scenarios. The alternate rate scenarios may involve ramped changes in rates, twisting of the yield curve, and/or stressed rate environments devised by the user or provided by the vendor.

NCUA Asset Valuation Tables

For credit unions lacking advanced IRR methods that seek simple valuation measures, the NCUA Asset Valuation Tables are available and prepared quarterly by the NCUA. These are available on the NCUA Web site through www.ncua.gov.

These measures provide an indication of a credit union's potential interest rate risk, based on the risk associated with the asset categories of greatest concern—(e.g., mortgage loans and investment securities).

The tables provide a simple measure of the potential devaluation of a credit union's mortgage loans and investment securities that occur during ±300 basis point parallel rate shocks, and report the resulting impact on net worth.

Net Economic Value (NEV)

NEV measures the effect of interest rates on the market value of net worth by calculating the present value of assets minus the present value of liabilities. This calculation measures the long-term IRR in a credit union's balance sheet at a fixed point in time. By capturing the impact of interest rate changes on the value of all future cash flows, NEV provides a comprehensive measurement of IRR. Generally, NEV computations demonstrate the economic value of net worth under current interest rates and shocked interest rate scenarios.

One NEV method is to discount cash flows by a single interest rate path. Credit unions with a significant exposure to assets or liabilities with embedded options should consider alternative measurement methods such as discounting along a yield curve (e.g. the U.S. Treasury curve, LIBOR curve) or using multiple interest rate paths. Credit unions should apply and document appropriate methods, based on available data (e.g. utilizing observed market values), when valuing individual or groups of assets and liabilities.

C. Components of IRR Measurement Methods

In the initial setup of IRR measurement, critical decisions are made regarding numerous variables in the method. These variables include but are not limited to the following.

Chart of Accounts

Credit unions using an IRR measurement method should define a sufficient number of accounts to capture key IRR characteristics inherent within their product lines. For example, credit unions with significant holdings of adjustable-rate mortgages should differentiate balances by periodic and lifetime caps and floors, the reset frequency, and the rate index used for rate resets. Similarly, credit unions with significant holdings of fixed-rate mortgages should differentiate at least by original term, e.g., 30 or 15-year, and coupon level to reflect differences in prepayment behaviors.

Aggregation of Data Input

As the credit union's complexity, risk exposure, and size increases, the degree of detail should be based on data that is increasingly disaggregated. Because imprecision in the measurement process can materially misstate risk levels, management should evaluate the potential loss of precision from any aggregation and simplification used in its measurement of IRR.

Account Attributes

Account attributes define a product, including: Principal type, rate type, rate index, repricing interval, new volume maturity distribution, accounting accrual basis, prepayment driver, and discount rate.

Assumptions

IRR measurement methods rely on assumptions made by management in order to identify IRR. The simplest example is of future interest rate scenarios. The management of IRR will require other assumptions such as: Projected balance sheet volumes; prepayment rates for loans and investment securities; repricing sensitivity, and decay rates of nonmaturity shares. Examples of these assumptions follow.

Example 1.Credit unions should consider evaluating the balance sheet under flat (i.e. static) and/or planned growth scenarios to capture IRR exposures. Under a flat scenario, runoff amounts are reinvested in their respective asset or liability account. Conducting planned growth scenarios allows management to assess the IRR impact of the projected change in volume and/or composition of the balance sheet. Example 2.Loans and mortgage related securities contain prepayment options that enable the borrower to prepay the obligation prior to maturity. This prepayment option makes it difficult to project the value and earnings stream from these assets because the future outstanding principal balance at any given time is unknown. A number of factors affect prepayments, including the refinancing incentive, seasonality (the particular time of year), seasoning (the age of the loan), member mobility, curtailments (additional principal payments), and burnout (borrowers who don't respond to changes in the level of rates, and pay as scheduled). Prepayment speeds may be estimated or derived from numerous national or vendor data sources. Example 3.In the process of IRR measurement, the credit union must estimate how each account will reprice in response to market rate fluctuations. For example, when rates rise 300 basis points, the credit union may raise its asset or liability rates in a like amount or not, and may choose to lag the timing of its pricing change. Example 4.Nonmaturity shares include those accounts with no defined maturity such as share drafts, regular shares, and money market accounts. Measuring the IRR associated with these accounts is difficult because the risk measurement calculations require the user to define the principal cash flows and maturity. Credit unions may assume that there is no value when measuring the associated IRR and carry these values at book value or par. Many credit unions adopt this approach because it keeps the measurement method simple.

Alternatively, a credit union may attribute value to these shares (i.e. premium) on the basis that these shares tend to be lower cost funds that are core balances by virtue of being relatively insensitive to interest rates. This method generally results in nonmaturity shares priced/valued in a way that will produce an increased net economic value. Therefore, the underlying assumptions of the shares require scrutiny.

Credit unions that forecast share behavior and incorporate those assumptions into their risk identification and measurement process should perform sensitivity analysis.

V. Internal Controls

Internal controls are an essential part of a safe and sound IRR program. If possible, separation of those responsible for the risk taking and risk measuring functions should occur at the credit union.

Staff responsible for maintaining controls should periodically assess the overall IRR program as well as compliance with policy. Internal audit staff would normally assume this role; however, if there is no internal auditor, management, or a supervisory committee that is independent of the IRR process, may perform this role. Where appropriate, management may also supplement the internal audit with outside expertise to assess the IRR program. This review should include policy compliance, timeliness, and accuracy of reports given to management and the board.

Audit findings should be reported to the board or supervisory committee with recommended corrective actions and timeframes. The individuals responsible for maintaining internal controls should periodically examine adherence to the policy related to the IRR program.

VI. Decision-Making Informed by IRR Measurement Systems

Management should utilize the results of the credit union's IRR measurement systems in making operational decisions such as changing balance sheet structure, funding, pricing strategies, and business planning. This is particularly the case when measures show a high level of IRR or when measurement results approach board-approved limits.

NCUA recognizes each credit union has its own individual risk profile and tolerance levels. However, when measures of fair value indicate net worth is low, declining, or even negative, or income simulations indicate reduced earnings, management should be prepared to identify steps, if necessary, to bring risk within acceptable levels. In any case, management should understand and use their IRR measurement results, whether generated internally or externally, in the normal course of business. Management should also use the results proactively as a tool to adjust asset liability management for changes in interest rate environments.

VII. Guidelines for Adequacy of IRR Policy and Effectiveness of Program

The following guidelines will assist credit unions in determining the adequacy of their IRR policy and the effectiveness of their program to manage IRR.

NCUA acknowledges both the range of IRR exposures at credit unions, and the diverse means that they may use to accomplish an effective program to manage this risk. NCUA therefore does not stipulate specific quantitative standards or limits for the management of IRR applicable to all credit unions, and does not rely solely on the results of quantitative approaches to evaluate the effectiveness of IRR programs. Assumptions, measures and methods used by a credit union in light of its size, complexity and risk exposure determine the specific appropriate standard. However, NCUA strongly affirms the need for adequate practices for a program to effectively manage IRR. For example, policy limits on IRR exposure are not adequate if they allow a credit union to operate with an exposure that is unsafe or unsound, which means that the credit union may suffer material losses under plausible adverse circumstances as a result of this exposure. Credit unions that do not have a written IRR policy or that do not have an effective IRR program are out of compliance with § 741.3 of NCUA's regulations.

VIII. Additional Guidance for Large Credit Unions With Complex or High Risk Balance Sheets

FICUs with assets of $500 million or greater must obtain an annual audit of their financial statements performed in accordance with generally accepted accounting standards. 12 CFR 715.5, 715.6, 741.202. For purposes of data collection, NCUA also uses $500 million and above as its largest credit union asset range. In order to gather information and to monitor IRR exposure at larger credit unions as it relates to the share insurance fund, NCUA will use this as the criterion for definition of large credit unions for purposes of this section of the guidance. Given the increased exposure to the share insurance fund, NCUA encourages the responsible officials at large credit unions that are complex or high risk to fully understand all aspects of interest rate risk, including but not limited to the credit union's IRR assessment and potential directional changes in IRR exposures. For example, the credit union should consider the following:

• A policy which provides for the use of outside parties to validate the tests and limits commensurate with the risk exposure and complexity of the credit union;

• IRR measurement systems that report compliance with policy limits as shown both by risks to earnings and net economic value of equity under a variety of defined and reasonable interest rate scenarios;

• The effect of changes in assumptions on IRR exposure results (e.g. the impact of slower or faster prepayments on earnings and economic value); and,

• Enhanced levels of separation between risk taking and risk assessment (e.g. assignment of resources to separate the investments function from IRR measurement, and IRR monitoring and oversight).

IX. Definitions

Basis risk: The risk to earnings and/or value due to a financial institution's holdings of multiple instruments, based on different indices that are imperfectly correlated.

Interest rate risk: The risk that changes in market rates will adversely affect a credit union's net economic value and/or earnings. Interest rate risk generally arises from a mismatch between the timing of cash flows from fixed rate instruments, and interest rate resets of variable rate instruments, on either side of the balance sheet. Thus, as interest rates change, earnings or net economic value may decline.

Option risk: The risk to earnings and/or value due to the effect on financial instruments of options associated with these instruments. Options are embedded when they are contractual within, or directly associated with, the instrument. An example of a contractual embedded option is a call option on an agency bond. An example of a behavioral embedded option is the right of a residential mortgage holder to vary prepayments on the mortgage through time, either by making additional premium payments, or by paying off the mortgage prior to maturity.

Repricing risk: The repricing of assets or liabilities following market changes can occur in different amounts and/or at different times. This risk can cause returns to vary.

Spread risk: The risk to earnings and/or value resulting from variations through time of the spread between assets or liabilities to an underlying index such as the Treasury curve.

Yield curve risk: The risk to earnings and/or value due to changes in the level or slope of underlying yield curves. Financial instruments can be sensitive to different points on the curve. This can cause returns to vary as yield curves change.

[77 FR 5162, Feb. 2, 2012, as amended at 77 FR 57990, Sept. 19, 2012. Redesignated at 83 FR 7964, Feb. 23, 2018]