Enterprise Risk Management Program

Impact. FHFA is requiring GSEs to build comprehensive Enterprise Risk Management frameworks with board-level governance, risk appetite statements, and integrated monitoring systems across all business lines. This guidance demands structural changes to risk governance, new reporting protocols, and enhanced coordination between risk management, compliance, and operational functions.

Risk. Examination focus will center on board oversight effectiveness and the integration quality between ERM components and existing business processes. The multi-departmental coordination required creates execution risk, particularly around establishing consistent risk tolerance limits and ensuring seamless data flow between previously siloed risk monitoring systems.

Recommended Action. Risk management should immediately assess current ERM capabilities against FHFA's framework requirements and identify the most significant governance gaps. Prepare a board presentation outlining implementation priorities, resource needs, and timeline for establishing the required risk appetite statements and organizational structure.

Watch. Monitor for FHFA examination guidance or supervisory letters that provide more specific implementation expectations or deadlines. Track peer institution approaches to ERM implementation for emerging best practices, particularly around stress testing integration and cross-functional risk reporting protocols.