By Fahmi Hosain: Much of the initial reaction to Commissioner Kenneth Hayne's final report has been that it is lighter than expected.
Banking royal commission: Hayne will make culture check as common as the audit
Much of the initial reaction to Commissioner Kenneth Hayne's final report has been that it is lighter than expected. Given the fundamental questions the Commissioner asked in his interim report, many expected his recommendations would dramatically reshape the way financial services were conducted. However, the lack of answers shows there is no silver bullet to the issues uncovered. And a deeper reading shows that fundamental change is coming, particularly on culture.
A subtle but significant implication of the final report is there will be government backing for the industry to take culture seriously and for APRA to push hard in this space. These efforts started in earnest in Australia in 2014 when APRA consulted on its Prudential Standard CPS 220 Risk Management, which introduced the obligation for boards to form a view on the risk culture of their institutions. The Commissioner's report refers to the history of this standard, which was initially met with opposition by directors. While there has been some traction by industry proactively working towards better understanding their risk cultures, it has not been enough.
The final report recommends that financial institutions assess their culture on a regular basis, identify and deal with any problems, and determine whether any changes have been effective. This is a major strengthening of the current obligation and is likely to result in revisions to CPS 220. This could see the establishment of cycles of culture assessments at an organisation on an ongoing basis. For large institutions, the assessment cycle may resemble an internal audit plan whereby full coverage is achieved over three years. In time, culture assessments will become as essential as internal audits.
Accountability for leaders is front and centre, as it relates to culture.
Commissioner Hayne points to the work ANZ has been undertaking to assess culture. The approach is a sound one. It is likely that the coverage of these styles of assessment will be extended to also look at the impact of group dynamics on risk management and misconduct, particularly at the board and senior executive levels. Some institutions have already started down this path, following the CBA Inquiry report. Yet it is not common practice. However, as Commissioner Hayne makes clear, responsibility for culture starts with the board and senior executives: "responsibility for misconduct ... lies with the entities concerned and with those who manage and control them: their boards and senior management."
Change is not just about assessment, but about practical outcomes and action, and shifts in behavioural norms. To sustain these programs, there is an inevitable conflict that must be resolved between established in-house culture assessors and the need for assessments on people who are in fact, their bosses' boss. In order to execute holistic culture assessments, both in-house experts and external experts will be needed.
The coupling of culture and governance
It is also possible that a reshaping of governance structures will emerge. As boards and senior executives get greater insight into culture and behaviours, there is likely to be a push for clarity on how culture and conduct is overseen at the highest levels. Overseas experience shows varied practice in this regard, including specific board committees dedicated to culture and conduct.
An underlying theme of the interim report was the inter-related nature of remuneration, risk management, governance and culture. It is telling that the recommendation to assess culture does not sit alone, with Commissioner Hayne noting "in looking at culture and governance, every entity must consider how it manages regulatory, compliance and conduct risks. And it must give close attention to the connections between compensation, incentive and remuneration practices and regulatory, compliance and conduct risks."
The coupling of culture and governance is a clear signal that the way institutions understand their effectiveness will need to evolve. Issues arise not just because of individual factors, but often because of the interaction between components of governance structures and how they intersect with day-to-day practices. As a result, the scope of board performance reviews may extend beyond performance and capability, to also look at effectiveness, outcomes and group dynamics.
The final report also makes clear that APRA needs to strengthen its approach to supervising culture. Financial institutions can expect a step-change in APRA's engagement on this topic with the recommendation that APRA assess the cultural drivers of misconduct. APRA will be much more intrusive on cultural matters. Practical clues of what this means lie in its risk-culture pilot review program. Taking a risk-based approach, this could include observations of board and executive committee meetings, analysis of group dynamics at the board and executive committee level and heavy scrutiny of the performance reviews of leaders. Discussions between APRA and regulated institutions will evolve to include the behavioural norms of senior leaders. This will be an uncomfortable shift for the industry but one that is necessary to enable APRA to effectively assess the culture of its regulated institutions.
Fahmi Hosain is managing director & co-founder, Rhizome Advisory Group, and former head of governance, culture & remuneration at APRA.
Read the article as it appeared in the AFR here.