Terms of Use

Part 1  ·  Document packages and templates

These Terms of Use (the "Terms") govern your use of the free document packages made available by CU Risk Advisors, a sole proprietorship of Jeff L. Bassill ("CU Risk Advisors," "we," or "us"). By downloading, opening, or using a Package you agree to them, on behalf of yourself and the institution you represent ("you" or the "Institution").

Please read Sections 6, 7, 8, and 9 carefully. They describe what CU Risk Advisors does not promise and cannot be held responsible for.

1. What These Terms Cover

1.1  "Package" means a set of downloadable Microsoft Word documents, Microsoft Excel workbooks, PDF materials, and accompanying guides that CU Risk Advisors distributes together as a free download, including business continuity, incident response, vendor management, risk assessment, policy, and training materials.

1.2  These Terms are the complete agreement between you and CU Risk Advisors regarding the Packages. There is no separate supplement, order, subscription, or signed agreement, and none is required.

1.3  A copy of these Terms is included in each Package. The version included with your download governs your use of that download.

2. What You May Do

CU Risk Advisors grants you a perpetual, worldwide, royalty-free, non-exclusive licence to use the Packages. You may:

• Use, edit, and adapt the Packages to create your own policies, plans, assessments, forms, inventories, and training materials.
• Adopt your customized documents as your institution's own, and reproduce and distribute them internally to employees, officers, directors, volunteers, and contracted staff.
• Provide your completed documents to examiners, regulators, external auditors, legal counsel, insurers, and other professional advisors, in the ordinary course of business or in an examination, audit, or enforcement proceeding.
• Store copies on your own systems and make backup copies.
• Reproduce the recurring-use forms from a blank master as often as needed, with no limit on the number of copies, exercises, incidents, vendors, assessments, reviews, training sessions, or years.
• Send completed or customized due diligence questionnaires and information requests derived from a Package to your own service providers, in connection with your oversight of those providers.
• Present and distribute your customized training materials to your own personnel, and retain the resulting rosters and acknowledgments.
• Remove or replace CU Risk Advisors branding in documents you have customized for your own adoption.
• Share a complete, unmodified Package, or a link to it, with a peer institution, a league, a chapter, or anyone else who would find it useful.
• Keep using everything indefinitely. There is no renewal, no reporting, and no termination for non-payment, because there is no payment.

3. What You May Not Do

You may not:

• Sell, licence, rent, or charge a fee for a Package or any lightly modified version of it, or offer it as a paid download.
• Repackage a Package, in whole or in part, into a commercial product, bundle, subscription, or resource library that you sell or licence.
• Present a Package, or a lightly modified version of it, as your own original work or as your own proprietary methodology.
• Represent that a Package, or any document you produce from one, has been reviewed, approved, endorsed, or certified by CU Risk Advisors, by any regulator, or by any examiner.
• Remove the attribution or these Terms from a Package you pass along unmodified under Section 2. Redistribution of the Package itself must be complete and unmodified. Documents you have customized for your own adoption are covered by Section 2 instead and carry no such requirement.

4. Attribution

4.1  No attribution is required on documents you customize and adopt as your own. Your board policy should read as your board's policy.

4.2  If you pass along a Package itself rather than your customized version of it, keep it complete and unmodified, with the Terms file included.

4.3  Attribution is always welcome and never required.

5. Voluntary Contributions

5.1  The Packages are free. A voluntary contribution is welcome if a Package saved your institution time, but it is not required and nothing is withheld if you do not make one.

5.2  A contribution is a gift, not a purchase. It does not create a customer relationship, does not entitle you to support, updates, warranties, or any additional rights, and is not refundable. The disclaimers and limitations in Sections 6 through 9 apply in full whether or not you contribute.

6. No Legal, Regulatory, or Compliance Advice

6.1  The Packages are templates, worksheets, and informational materials. They are not legal advice, regulatory advice, accounting advice, or a compliance opinion, and no attorney-client, consultant-client, advisory, or fiduciary relationship is created by your downloading or using them.

6.2  CU Risk Advisors makes no guarantee of regulatory acceptance, examiner approval, or legal sufficiency, and none is expressed or implied. Regulatory expectations differ by charter, regulator, examiner, asset size, geography, and complexity, change over time, and may be supplemented or modified by state law.

6.3  You are solely responsible for reviewing, adapting, completing, approving, testing, and maintaining any document, assessment, plan, notice, or calculation you derive from or produce with a Package, and for confirming that it reflects your institution's actual operations, contracts, systems, vendors, personnel, risk profile, and applicable law and regulation, including current NCUA, FFIEC, and Federal Reserve expectations.

6.4  Sample content describes a hypothetical institution. Ratings, control descriptions, thresholds, vendor names, recovery methods, and remediation steps that appear in a Package are illustrative. They are not findings about your institution and they are not recommendations for it. Adopting an unmodified template is unlikely to withstand examination and may be worse than having nothing, because it documents a program you do not actually run.

6.5  CU Risk Advisors strongly recommends review by qualified legal counsel or a compliance professional before you rely on any completed document in an examination, audit, board action, or member-facing context.

7. No Support, No Updates, No Review

7.1  The Packages are provided with no support of any kind. That includes no consulting, no customization, no configuration, no review or approval of your completed documents, no regulatory interpretation, and no analysis of your specific situation.

7.2  CU Risk Advisors has no obligation to update, correct, or maintain any Package. Regulations, supervisory guidance, and examiner expectations change. Content reflects a point in time and may be out of date when you download it. Check the version and date on each file and verify current requirements yourself.

7.3  Corrections, broken files, and typo reports are welcome at info@mycurisk.com. No response is promised, no timeframe applies, and sending or receiving a message does not create a support, consulting, or advisory relationship. Questions about your own situation belong with your counsel or compliance professional, not with us.

8. Disclaimer of Warranties

THE PACKAGES ARE PROVIDED "AS IS" AND "AS AVAILABLE," WITHOUT WARRANTY OF ANY KIND, WHETHER EXPRESS, IMPLIED, OR STATUTORY. CU RISK ADVISORS SPECIFICALLY DISCLAIMS ALL IMPLIED WARRANTIES OF MERCHANTABILITY, FITNESS FOR A PARTICULAR PURPOSE, ACCURACY, COMPLETENESS, TITLE, AND NON-INFRINGEMENT, AND ANY WARRANTY THAT THE PACKAGES WILL BE ERROR-FREE, COMPLETE, CURRENT, REGULATORY-COMPLIANT, OR SUITABLE FOR YOUR PARTICULAR CIRCUMSTANCES.

9. Limitation of Liability

TO THE MAXIMUM EXTENT PERMITTED BY LAW, CU RISK ADVISORS' TOTAL AGGREGATE LIABILITY ARISING OUT OF OR RELATING TO THE PACKAGES OR THESE TERMS, UNDER ANY THEORY OF LIABILITY, SHALL NOT EXCEED ONE HUNDRED U.S. DOLLARS ($100).

IN NO EVENT SHALL CU RISK ADVISORS BE LIABLE FOR ANY INDIRECT, INCIDENTAL, SPECIAL, CONSEQUENTIAL, EXEMPLARY, OR PUNITIVE DAMAGES, OR FOR LOST PROFITS, LOST DATA, BUSINESS INTERRUPTION, REGULATORY FINES OR PENALTIES, EXAMINATION FINDINGS, DOCUMENTS OF RESOLUTION, ENFORCEMENT ACTIONS, REMEDIATION COSTS, MEMBER OR CUSTOMER CLAIMS, OR REPUTATIONAL HARM, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGES.

Some jurisdictions do not allow certain of these limitations. In those jurisdictions our liability is limited to the greatest extent permitted by law. The limitations in this Section and in Section 8 are an essential basis on which the Packages are made available at no charge.

10. Ownership and Your Records

10.1  CU Risk Advisors retains all right, title, and interest in the Packages, including copyright in the underlying templates, structure, organization, text, scenario frameworks, scoring methodologies, and documentation. The licence in Section 2 does not transfer ownership.

10.2  You own the content you add and the completed documents you create.

10.3  If you send us suggestions, corrections, or requests, we may use them without restriction or obligation to you. We will not identify your institution in connection with feedback without your permission.

11. No Vendor Relationship

11.1  Downloading a free Package does not make CU Risk Advisors a vendor, service provider, or third party of your institution for purposes of your third-party risk management program, and does not require you to perform vendor due diligence on us.

11.2  The Packages are self-contained files. They do not connect to us, transmit data to us, phone home, or report usage. We do not receive your completed documents and have no access to them or to any member or customer information you place in them.

11.3  We do not complete vendor due diligence questionnaires, security assessments, or vendor onboarding paperwork for free Package downloads, because there is no relationship to assess.

12. Termination

12.1  The licence in Section 2 terminates only if you materially breach Section 3. If that happens, stop using and distributing the Packages.

12.2  Section 10.2 governs your completed records in every case. They remain yours, permanently, whatever happens to this licence.

13. Changes to These Terms

We may revise these Terms prospectively by publishing a new version here and including it in later downloads. A revision does not affect a Package you have already downloaded. Your use of that download continues to be governed by the version included with it.

14. Governing Law and Venue

These Terms are governed by the laws of the State of California, without regard to its conflict-of-laws principles. The exclusive venue for any dispute arising out of or relating to the Packages or these Terms shall be the state or federal courts located in Fresno County, California, and each party consents to personal jurisdiction there.

15. General

15.1  If any provision is held unenforceable, the remaining provisions remain in full force. Our failure to enforce a provision is not a waiver of it.

15.2  Any additional or different terms in a purchase order, vendor agreement, vendor questionnaire response, or similar document issued by you are of no effect unless we have signed them.

15.3  Headings, tables, and shaded summaries are provided for convenience and do not alter the operative text.

16. Contact

Purpose	Contact
Corrections, broken files, and typo reports	info@mycurisk.com
Voluntary contributions and invoice requests	info@mycurisk.com
Mailing address	CU Risk Advisors, 4763 W Spruce Ave STE 109, Fresno, CA 93722
EIN, for accounts payable setup on a contribution	42-3285212

Part 2  ·  ExpressHold software

ExpressHold is licensed under the Apache License, Version 2.0, verbatim and unmodified. Part 1 does not apply to it. Apache 2.0 governs it completely, and nothing on this page adds to, narrows, or conditions that grant.

In practical terms: use it, configure it, modify it, deploy it across your institution, host it on your own network, build on it, and distribute it, including commercially. It is provided as-is, with no warranty and no support. The full licence text, the NOTICE file, and the trademark policy are included in both downloads.

Part 3  ·  Superseded documents

Three documents previously published on this page are retired and no longer govern anything:

Document	Status
Master Terms of Sale v1.0	Superseded September 14, 2026
Document Products Supplement v1.0	Superseded September 14, 2026
Software Products Supplement v1.1	Retired September 14, 2026

They were written for a paid model. That model was offered but never taken up: no package was ever sold under them and no institution was ever invoiced. There is no prior purchase for them to govern and no customer whose rights they preserve.

The Software Products Supplement is retired rather than replaced. It described ExpressHold as proprietary software with per-institution and per-environment restrictions, limits on copying, modification, and reverse engineering, and a certification of destruction on termination. Apache 2.0 grants exactly those rights, so the two cannot both stand. The licence governs.

If you filed a copy of any of the three in a vendor or compliance file, this notice is your record that it has been replaced. Nothing in the current terms is more restrictive than what it replaced.