Primary responsibility for the issues identified lies with boards and senior management
Primary responsibility for the issues identified over the course of the Commission hearings is attributed in the Final Report squarely to boards and senior management: 'There can be no doubt that the primary responsibility for misconduct in the financial services industry lies with the entities concerned and those who managed and controlled those entities: their boards and senior management. Nothing that is said in this Report can be understood as diminishing that responsibility' Commissioner Hayne writes.
The governance, culture and remuneration practices within organisations, the board's role in overseeing these, and the need for change is a therefore a key theme of the report. The central message is that every board needs to change the way in which it approaches these issues, if a repeat of what has happened in the past is to be avoided and that the necessary changes will require ongoing board leadership and commitment if they are to succeed.
New expectation that boards engage in ongoing review of their culture and governance processes
The report recommends (5.6) that that every financial services entity should 'as often as reasonably possible' take steps to assess the culture and governance practices within their organisation, identify and address any issues identified and then evaluate the changes made. The Commissioner's expectation is that this will be an ongoing exercise requiring 'entities to take all that is set out in this Report, including all the other recommendations that are made, and apply, re-apply, and keep re-applying what is said to their culture and their governance.'
It will also, he suggests, require 'more than an exercise in 'box ticking'. Though the Commissioner observes that 'culture cannot be prescribed or legislated' he states that it 'can be assessed' adding that the task of assessment should be performed by 'entities themselves'.
The report also envisages an enhanced supervisory role for APRA in this context (5.7) with a particular focus on how changes are implemented, and in terms of remuneration how entities 'promote and encourage sound management…of not only financial risk but also misconduct, compliance and other non‑financial risks (5.2 and 5.3).
Where should boards start this process? Lessons from the Prudential Inquiry into the CBA
The Commissioner does not outline how boards should undertake their ongoing reviews. He does suggest however, that the Prudential Inquiry into CBA will have relevance for 'every entity' in this context. More particularly, he suggests every board should consider:
- how risk is identified;
- whether there is adequate of oversight and challenge by the board (and its gatekeeper committees) of non-financial risks;
- whether there is clarity around who is accountable for risk/how they are accountable;
- whether there is sufficient focus given to compliance and whether remuneration practices at all levels of the organisation incentivise the right behaviours.
How to succeed in driving change? Tone from the top (and also from the bottom)
Though boards are expected to lead and to champion strong governance practice, and ethical culture, the Commissioner expects a focus on embedding an ethical framework into everyday business at all levels of the organisation. The '"tone" of the entity is, and must be, set at the top. But that tone must also be echoed from the bottom and reinforced at every level of the entity’s management and supervision; it must always "sound from above"' he observes.
This has a number of practical implications, not only for boards but also for 'middle managers' and employees who may need to change their work practices and behaviours in line with changed expectations.
In our experience there is a potential business upside in implementing cultural/governance reviews of the kind mandated by APRA following the CBA prudential inquiry, in particular in terms of risk management processes and practices, improved information flows and reporting around non-financial risk, improved internal communication flows to boards and increased executive and organisational engagement. There is also upside in being well prepared to engage more closely, and likely having to provide more information to APRA, on these issues.
