A regional credit union operating across 4 branches in central Alberta has served its membership for over 35 years, offering personal banking, agricultural lending, and small business financing to approximately 28,000 members. The board of directors consists of 9 elected members drawn from the membership, most of whom bring professional backgrounds in agriculture, accounting, or local business ownership but none of whom possess formal expertise in information technology, cybersecurity, or environmental regulation.
Over the past 18 months, the credit union has undertaken a significant digital transformation initiative, migrating its core banking platform to a cloud-based system and launching a mobile application that now handles approximately 40 percent of routine member transactions. The board approved the $2.3 million capital expenditure for this project based on management presentations emphasizing operational efficiency and competitive necessity, but the directors received limited information about the cybersecurity implications of the new architecture or the credit union's incident response capabilities. A recent internal audit identified 3 areas of concern regarding data protection protocols, though the board has not yet received a formal briefing on the findings.
Simultaneously, the credit union's agricultural lending portfolio faces emerging pressures related to climate variability. Drought conditions over the past 2 growing seasons have increased delinquency rates among farm borrowers, and several of the credit union's largest commercial real estate loans involve properties in flood-prone areas that have experienced 2 significant water events in the past 5 years. The board has discussed these exposures informally but has never articulated a formal risk appetite statement or established quantitative thresholds for concentration risk in climate-vulnerable sectors.
The credit union does not maintain a dedicated risk committee. Risk oversight has historically been folded into the audit committee's mandate, though that committee's terms of reference focus primarily on financial reporting and regulatory compliance. The chief executive officer has proposed creating a separate risk committee, but several directors have questioned whether the administrative burden would be justified for an organization of this size. The board chair has asked management to prepare materials for a governance retreat where the directors will consider how to structure their oversight responsibilities going forward.
Complicating the timing, a neighbouring credit union recently experienced a ransomware attack that disrupted member services for 11 days and generated significant media coverage. The provincial regulator has signalled increased scrutiny of technology governance across the sector, and the board anticipates questions about its own preparedness during the next supervisory examination.