(a) A corporate credit union must develop and follow an enterprise risk management policy.

(b) The board of directors of a corporate credit union must establish an enterprise risk management committee (ERMC) responsible for reviewing the enterprise-wide risk management practices of the corporate credit union. The ERMC must report at least quarterly to the board of directors.

(c) The ERMC must include at least one risk management expert who may report either directly to the board of directors or to the ERMC. The risk management expert's experience must be commensurate with the size of the corporate credit union and the complexity of its operations.