The Australian Prudential Regulation Authority (APRA) has released the Progress Report by the Panel appointed by APRA to conduct a Prudential Inquiry into the Commonwealth Bank of Australia (CBA).  The Progress Report provides an update on the status of the inquiry and outlines the methodology that the Panel has adopted to address the Terms of Reference but does not include preliminary findings or recommendations due to the complexity of the complexity of governance, culture and accountability issues in such a large institution.  Instead, recommendations will be included in the final report which will be provided to APRA by 30 April.  The panel also notes that the  'CBA is undertaking a number of significant remediation initiatives in the risk management and compliance areas, which the Final Report will take into account'.

Methodology

The Panel states that the methodology it has adopted is structured around three core themes, aligned with the Terms of Reference for the inquiry.  They are:

1. Governance: The decision making process at the CBA, including how financial objectives, values and strategic priorities impact on the decision-making process, and how decisions, once made, are implemented.

2. Culture: The behavioural norms for individuals and groups within the CBA that determine the collective ability of individuals and groups to identify, understand, openly discuss, escalate and act on the organisation's current and future challenges and risks.

3. Accountability: The way in which CBA staff, both individually and collectively, fulfil their responsibilities and the consequences of not fulfilling these responsibilities.

Within each of these three core themes, the Panel explains, there are a number of more detailed focus areas or 'work streams' inquiring into whether 'CBA's organisational structure and governance, its risk management and compliance framework, its remuneration and accountability frameworks, its financial objectives, and its framework for identification, escalation and addressing matters of concern, are conflicting with sound risk management and compliance outcomes'.

Progress: activities undertaken by the Inquiry

The Panel, supported by a project team of APRA staff and by Oliver Wyman (a global management consultancy), is undertaking an assessment of CBA's current practices and any initiatives CBA may already have underway, using a combination of evidence based analysis and case study analysis.

Activities undertaken by the inquiry include:

• Staff interviews: The panel writes that it intends to conduct 80 fact finding and 'structured interviews' with current and former CBA staff including board directors; the CEO, CFO and CRO and other relevant CBA Group Executives; senior management, including Executive General Managers and General Managers; and former CBA Board directors and executive staff.  The Panel states that around 60 interviews have been completed to date, and the remainder are scheduled for the coming weeks. 

• Staff focus groups: Eleven focus groups with CBA staff at management level (held on a confidential basis) have been held.  The panel states that they have been designed means of identifying behavioural norms that either support or detract from the effective management of risk.

• Staff survey: An online staff survey has been made available to close to ten thousand Australian-based and some overseas staff across a range of levels.  The panel states that the survey contains a range of questions designed to understand CBA's culture and its approach to risk management.  

• Meetings with other regulators: The panel states that it has met with the Australian Securities and Investments Commission (ASIC), and has plans to meet with other relevant agencies, to gain further insights into CBA's framework and practices, as well as additional background on particular incidents where necessary.

• Document review: Over 10,000 CBA documents, including framework documents such as policies and procedures, Board and Board committee papers, executive committee papers, project documentation, are being reviewed as part of the Inquiry.

Next steps: The report states that the inquiry is still at the 'fact finding' stage and that there is 'further work to be done'.   This includes: completing staff interviews, completing and analysing the results of the online staff survey and completing the review of the documents provided.  Benchmarking of CBA's frameworks and practices against global industry norms and practices will also be carried out. 

Areas of focus: The Panel notes that it is 'directing its attention' to 'particular issues that have emerged from the work to date'. These are:

1. 'Board (including Board Audit and Risk Committees) and senior executive responsiveness to emerging risk issues and diligence in overseeing the resolution of these issues;

2. the influence on CBA's culture of the Board and senior executives;

3. the complexity of policies and decision-making processes within CBA;

4. the prioritisation and execution of investment in risk systems;

5. capabilities and accountabilities for risk management in the organisation, particularly for operational, compliance and reputational risk;

6. the stature, maturity and resourcing of the compliance function; and

7. the responsiveness of remuneration to risk outcomes, adverse or positive'.

APRA Chairman Wayne Byres welcomed the update provided by the panel on the extensive investigations currently underway: 'As the Panel has noted, issues of governance, culture and accountability in large organisations are complex to assess. APRA is pleased the Panel is taking a thorough and considered approach to the important task it has been given'.

CBA statement: In a short statement, the CBA states that it is cooperating fully with the inquiry and welcomes the opportunity for the panel to review the work the bank has undertaken and to advise on what more can be done.  CBA Chair Catherine Livingstone is quoted as stating: 'We have previously stated our full support for the Prudential inquiry and we recognise there is work still to be done to strengthen community trust in us.  We've acknowledged there are aspects of our culture where we could improve and we have been focussed on upgrading our performance in the areas of governance, operating procedures and regulatory compliance.  We note the Panel's acknowledgement of initiatives already underway in risk management and compliance, and this work is ongoing.'

Media reports

• Not enough investment in risk and compliance a concern?  The AFR reports Elizabeth Sheedy (Macquarie University) has expressed concern that the Panel flagged the bank's investment in risk systems and the resourcing of compliance: 'Those are just classic signs they are not making risk and compliance a real priority' she is quoted as stating.  Ms Sheedy reportedly went on to express the view that cultural change at large institutions is often unsuccessful and that the CBA is 'not yet at the point' where cultural change is likely to succeed.  Ms Sheedy reportedly said that success in cultural change is more likely when there is a big change in the external environment or when a near-death style experience has brought the organisation 'to the brink'.  The AFR adds that the complexity of the bank's policies and processes, highlighted in the progress report, has previously been acknowledged by the CBA to be an issue. 

• Was the recent appointment of an internal candidate as CEO the right decision?  The AFR comments that the issues identified in the progress report, indicate that the final report may be critical of CBA executives and of the board.  Given this, the article queries whether the appointment by the Chair and CEO of an internal candidate was the correct one and adds that Mr Comyn's first appointment as CEO will be particularly challenging: 'the potential for his creditability to be chipped away by the APRA report, by the AUSTRAC case and by the royal commission in his first year in the job is very real – as if becoming a CEO for the first time wasn't hard enough' The AFR writes.

• Will the CBA have to reduce its profitability?  The Australian writes that despite the fact that the progress report made no 'findings', banking analysts are concerned that the final report may 'force CBA to reduce profitability, particularly if internal returns on equity targets are found to conflict with proper regulatory compliance and risk management'.  The article quotes UBS analysist John Mott as saying that the CBA currently has internal return targets of 16-17%, despite official interest rates being at a record low 2%.  If the final report were to find that these internal targets are in conflict with CBA's risk obligations, the CBA may 'need to adjust its targets' downward.

Background

• APRA established the Prudential Inquiry in August 2017 to examine the frameworks and practices in relation to the governance, culture and accountability within the CBA group, 'in light of a number of incidents which damaged the reputation and public standing of CBA'.

• The Panel was appointed in September and the Inquiry began work in October.  The Panel comprises Dr John Laker AO, Professor Graeme Samuel AC and Jillian Broadbent AO. 

• The Terms of Reference for the inquiry (included in the progress report issued on 1 February) state that the 'purpose of the Prudential Inquiry is to examine the frameworks and practices in relation to governance, culture and accountability within the CBA group', to assess whether they are sufficient, and to the extent that are not, to recommend how any shortcomings or deficiencies that are not already being addressed by CBA, should be rectified. 

• The Terms of Reference provide that the Inquiry should 'not make specific determinations regarding matters currently the subject of legal proceedings, other regulatory reviews or investigations by regulators other than APRA, or customers' individual cases'.  The final report is due to be delivered by 30 April.