Control as culture: Credit unions should treat risk discipline as a profit lever

Member-first models don't make credit unions immune to modern financial pressures. Across the UK and Ireland, the story is less about sentiment and more about execution: stronger operating discipline - especially around risk and control - is increasingly what separates steady performance from avoidable surprises.

The latest Bank of England annual statistics show UK credit unions generated £418.18 million of income in 2024, while spending £326.34 million to earn it - a cost base that works out to about 78 pence per pound of income. Profits rose, but so did strain: net liabilities of loans in arrears climbed to £191.71 million, and nearly half of that was more than a year overdue.

Ireland's picture is improving - but still constrained by the maths of the model. The Central Bank of Ireland's latest sector review (year ended 30 September 2024) shows the average cost-income ratio fell to 74%, as income growth outpaced costs, while arrears remained contained at 2.44% of loans (over 9 weeks past due). That's progress - and it also raises the bar: with a large share of earnings still absorbed by running costs, the institutions that keep tightening operating discipline will be the ones best placed to keep investing in members.

These aren't just financial metrics. They're a window into the operating model - how consistently work is executed, evidenced and improved.

The real constraint is capacity, not ambition

Credit unions are being pulled in several directions at once. Members expect better digital service and sharper value. Regulators want clearer accountability and stronger evidence. Boards want confidence the organisation can absorb shocks without losing momentum. At the same time, higher interest rates have made savers more responsive to price - moving deposits when better returns appear elsewhere.

That shift matters because credit unions can't rely on scale alone to simplify complexity. Even with improving efficiency in parts of the sector, a cost base that absorbs most income leaves little tolerance for duplication. Every control that exists in theory but not in practice, every handoff without a clear owner, and every remediation done late rather than early quietly reduces strategic capacity.

So the next gains are unlikely to come from thicker policy binders or another round of blunt cost trimming. They'll come from something less visible but more durable: a culture of control - the kind that turns governance from a reporting exercise into a management advantage.

Compliance is documentation. Control is execution.

Traditional compliance programmes often reward completion: deadlines met, returns filed, policies updated, minutes recorded. That work is necessary - but it can drift away from the questions boards actually care about:

• Where can the institution be hit - financially or operationally - over the next 6 to 18 months?
• Which controls prevent that harm, who owns them, and what evidence shows they're working?

A control culture answers those questions by default, because it is built around three consistent habits:

• Visibility: the risks that move outcomes - arrears, liquidity, operational disruption, conduct and third-party exposures - are tracked in a form leaders can interrogate, not just review once a quarter.
• Ownership: accountability is explicit. Not "the business," not "risk," but named leaders responsible for performance and proof.
• Action: mitigations are linked to measurable results: fewer repeat findings, faster resolution, reduced volatility, and less rework.

None of this is new. The gap is that in many organisations, risk still sits beside the business rather than inside the way the business runs.

Control should speed decisions up - not slow them down

Control is often caricatured as a set of gates: a process that delays action until someone signs off. The best control environments do the opposite. They increase tempo because leadership isn't operating on assumptions.

When risks are monitored routinely and controls have owners, boards don't need to wait for the next committee cycle to discover that arrears are deteriorating, liquidity limits are tightening, or operational weaknesses are accumulating quietly. They can intervene earlier - when problems are smaller, options are broader, and fixes cost less.

That is how control becomes a financial lever. It reduces the cost of surprises, and it improves the quality of trade-offs - particularly in institutions where capacity is precious.

Tools matter - but only after behaviour changes

Good technology doesn't "solve" risk; it makes strong risk management easier to run. Done right, it reduces friction, improves visibility, and keeps assurance current - all at the pace the business operates.

What matters is the capability: a single, live view of key risks, the controls meant to manage them, and the evidence that proves they're working. When that information is connected - rather than spread across spreadsheets, inboxes and quarterly packs - leaders can spot emerging issues earlier, prioritise action, and report with confidence.

The payoff is practical: less manual collation, fewer last-minute scrambles for audit or board papers, and assurance that stays current as the business changes.

Collaboration is not a slogan. It's a capacity strategy.

Credit union leaders talk often - and rightly so - about collaboration across the movement: shared learning, shared services, shared solutions. But collaboration rarely thrives when every organisation is stuck in reactive mode, spending scarce hours pulling evidence together, chasing updates, or repeating work already done elsewhere.

A culture of control creates the precondition for collaboration: spare capacity. When ownership is clear and evidence is captured as work happens (not rebuilt later), teams spend less time preparing for governance and more time improving it. That is what makes modernisation sustainable - especially when efficiency gains need to be protected, not just achieved.

The leadership dividend

A mature control culture pays out in ways that are unglamorous, but highly valuable:

• Boards gain confidence because oversight is grounded in current, consistent information.
• Executives act earlier because signals are clearer and less contested.
• Teams waste less time duplicating work across risk, compliance, audit and operations.
• Members benefit indirectly through a steadier institution that can invest in service and innovation, not perpetual remediation.

Credit unions don't need to become banks. But they do need to become more systematic about how they run. In a sector where margins are earned through trust and consistency - and where arrears, liquidity and rate competition can shift quickly - control isn't a brake on performance. It's the operating system that makes performance repeatable.

Turn control into capacity with RunSafe

Drova's RunSafe platform brings risks, controls, owners and evidence into one system, with AI Risk Mates to cut the admin. The result is up-to-date assurance, stronger board reporting, and less end-of-quarter scramble.

For credit unions, that means clearer accountability, faster visibility, and less duplicated work across risk, compliance and operations.