The UK’s Prudential Regulation Authority (PRA) and Financial Conduct Authority (FCA) have recently published their (long-awaited) report into the failure of HBOS Group (HBOS).¹ The review concluded that ‘ultimate responsibility for the failure of HBOS rests with the board and senior management’. In particular, it says they ‘failed to set an appropriate strategy for the firm’s business and failed to challenge a flawed business model which placed inappropriate reliance on continuous growth without due regard to risks involved’.

HBOS was the result of a merger (in the BBC’s words) of ‘a traditional building society and a prudent Scottish banking institution’ in 2001, which was valued at £30 billion but ‘collapsed just seven years later – with all of that value completely wiped out’.² As a result, during the GFC in 2008, HBOS became part of the Lloyds Banking Group and was given a ‘£20.5 billion injection' from UK taxpayers to prevent it from crashing.

Because of the timing of, and the circumstances surrounding, HBOS’s demise it was in many ways a failure of its time. There has already been a great deal of reflection on the causes of the GFC, and the reasons why some banks were hit harder than others. Many important reforms have already been implemented, both through increased regulation and through changes in industry practice flowing from ‘soft law’ as well as investor (and broader public) pressure. While the report, as it says, ‘describes a period which is by now well-known and on which much commentary has already been written’, there are still lessons to be learnt from it, particularly in relation to culture and governance, topics which remain high on regulators' agendas both here and overseas. It is worth noting in this regard that Andrew Bailey, Deputy Governor of the Bank of England and CEO of the FCA, commented that the ‘story of the failure of HBOS is important both to provide a record of an event which required a major contribution by the public purse, and because it is a story of the failure of a bank that did not undertake complicated activity or so-called racy investment banking’. HBOS was, he said, ‘at root a simple bank that nonetheless managed to create a big problem’. 

Failings in management, governance and culture

The report found that failings in the management, governance and culture of the firm had a direct impact on the poor quality and heavily concentrated nature of HBOS’s lending, and that these failings were the underlying cause of the firm’s financial vulnerabilities. Some of the key findings include that:

• although the composition, size and structure of the HBOS board were typical for a large UK bank at the time, it failed to provide effective challenge to the firm’s executive management;
• as a group, the non-executive directors (NEDs) on the board lacked sufficient experience and knowledge of banking – of the twelve NEDs who served on the board during the relevant period, only one had a background in banking and he was appointed in May 2007 – which hindered their ability to provide effective challenge to executive management and was compounded by a similar lack of banking experience within the executive management team;
• as a result, risk was given insufficient time, attention, focus and priority by the board, and the review found a lack of contemporaneous evidence of debate and challenge at board meetings around key areas of risk faced by the HBOS group;
• a recurrent theme in board evaluations was a desire that the chairman should promote more open discussion in board meetings, and although directors told the review that many points were raised in bilateral discussions outside board meetings, ‘these can be no substitute for an effective board process which enables NEDs as a group to challenge management’;
• there did not appear to be a systematic process whereby NEDs were updated on banking, regulatory or governance matters on an ongoing basis;
• there was no evidence that certain annual board evaluations reported on in HBOS's annual reports were carried out in accordance with guidance at the time;
• the board (including the two CEOs and the chairman) failed to instil an appropriate culture of risk within the organisation;
• one of the key factors in the demise of HBOS was the failure to establish an appropriate strategy for the group, set in the context of clearly identified risks and measures to quantify and control risk, noting that the board played a limited role in the development of the group business strategy;
• a ‘crucial weakness’ of HBOS’s strategic approach was that it was developed and pursued in the absence of a clearly defined risk appetite statement for the group as a whole and the ability to aggregate risks at group level, as a result key risks were not adequately addressed by the strategies of each of the operating divisions;
• further, HBOS used the annual divisional business planning process as the main mechanism for reviewing the group’s strategy, (ie a ‘bottom up’ approach) which meant that discussions about the firm’s strategy and risk appetite tended to focus on performance targets;
• the internal controls within HBOS's operating divisions, in particular its Corporate and International Divisions, were ineffective and did not keep pace with the rapid growth that these divisions experienced (eg there was no process for defining risk appetite, beyond high-level industry sector limits, and risk management was regarded as a constraint on the business rather than integral to it);
• within the International Division, the risks attached to rapid growth were consistently highlighted, but generally do not appear to have led to any significant restraint in the division’s plans;
• the ineffectiveness of HBOS’s risk management framework was a consequence of a culture within the firm that prioritised growth aspirations over the consideration of risk, noting that ‘HBOS’s weak risk culture was evident at all levels of the firm, with the Board-approved emphasis on growth setting the tone for the rest of the organisation’; and
• the early success of HBOS in the benign economic conditions prior to the crisis also led to complacency during the crisis.

Recommendations for boards and directors

The report includes a number of recommendations for bank boards in relation to management, governance and culture. The report notes that they ‘have been kept concise by not including points where in our view major changes resulting from the lessons of the financial crisis have been implemented, and ‘[i]nstead, the recommendations cover areas where work is under way but further steps are being taken to complete implementation’. They include:

• every member of a bank’s board of directors must take responsibility as part of a collective for ensuring that its business model is sustainable and that the principle of safety and soundness is embedded in the organisation’s culture;
• a bank’s board of directors should include non-executives with a diversity of experience, from inside and outside the banking sector, and must, between them, have the capacity and motivation to explore and challenge key business issues rigorously with the executives;
• while the Senior Managers Regime will clarify accountabilities within a bank, it is vital that persons approved under this regime take ownership of their regulatory responsibilities and for executives to establish within their business areas a culture that supports adherence to both the spirit and letter of relevant requirements. They should proactively seek to identify threats to the firm’s safety and soundness, and notify regulatory authorities where issues arise – not simply assume that risk management systems are adequate if regulators do not intervene.

Other Issues

In addition, the report found that ‘flaws in the FSA’s [the Financial Services Authority, the FCA's predecessor] supervisory approach meant it did not appreciate the full extent of the risks HBOS was running and was not in a position to intervene before it was too late’. It includes some recommendations for regulators, which focus on: the ‘will to act’, supervision of international groups and conflicts of interest. As part of the review, Andrew Green QC was asked to provide an independent assessment of whether the decisions taken in relation to enforcement action by the FSA were reasonable. His report, which was published at the same time as the FCA/PRA Report, recommends that the PRA and FCA should now consider whether any former senior managers of HBOS should be the subject of an enforcement investigation with a view to prohibition proceedings. The PRA and FCA have said they will decide as early as possibly next year. As many commentators point out, there is considerable public unrest over the fact that to date only one HBOS executive has been ‘reprimanded’ for his involvement in the bank’s failure.

Another issue that has generated interest is the length of time it has taken to produce the report. The FT notes that one reason for this is that there have been at least two rounds of a process known as ‘Maxwellisation’, under which anyone facing criticism in an official report is sent details in advance and is allowed to reply before publication. For this report, says The FT, 35 people made 1,425 representations. It adds that there have also been problems of ‘consent’, which The FT describes as a related process where the regulator must receive approval from an entity before citing any statistics attributed to it.

Reaction to the report

There has been a great deal of comment on the report from both industry and the media. The UK’s Institute of Directors (IOD) said that report ‘shows the importance of having experienced and strong company directors round the board table’. The IOD’s Senior Corporate Governance Adviser, Oliver Parry said that the report is ‘a timely reminder that when directors fail, companies fail. HBOS may have been swept up in a global financial crash, but the regulators are clear that a lack of expert oversight from the HBOS board made it "inherently vulnerable"’. He added that tougher banking regulation now in place ‘should not lull us into a false sense of security. Banks live and die by the strengths of the directors sat around the board table, particularly the ability of non-executives to challenge management decisions'. However, Mr Parry also noted that ‘we must be careful not to confuse the roles of executive and non-executive directors. The HBOS failure makes it more clear than ever that proper independent oversight from experienced and hard-headed non-executive directors can help to prevent future crises. Making non-execs personally accountable, as the current Senior Managers Regime does, could deter the very best from taking on the role in the first instance’, which ‘would be a dangerous mistake'.

In The FT, columnist Andrew Hill opined that HBOS’ strategy was ‘in essence a nice wrapper round a bundle of plans drawn up by different divisions’, and that the board directors’ job was largely to rubber stamp ‘growth’ on the outside.3 He notes that one former head of HBOS’s retail bank told the inquiry that group strategy-setting ‘was an exercise in arithmetic… more than anything else’. Hill asserts that although ‘such insights come too late for HBOS shareholders, they should ring a clanging bell with plenty of boards and chief executives’, because a ‘dog’s dinner’ approach to strategy is also prevalent elsewhere. He notes that the report makes it clear that the bank had a bottom-up approach, where group strategy was a mere distillation of divisional plans, which led to many problems. He advises other companies to ‘heed this indictment because, when top-down management is out of favour, the temptation to start at the bottom and work backwards to a strategy can be strong’. Although it can make sense for employees at all levels to be involved in thinking about strategy, he argues, the people in charge should not abdicate their duty.

Meanwhile, a number of commentators have asserted that the report’s findings highlight the importance of implementing effective whistleblower policies. The WSJ for example reported that the Institute for Business Ethics asserted that the report shows that the board and senior management need to ensure there is a system in place to receive, acknowledge and address concerns of employees or other potential whistleblowers.4 Philippa Foster Back, the Institute’s director, reportedly said that boards ‘need to listen to, act upon, and report back on relevant concerns raised by their employees’. The article reports that according to the Institute, the problem isn’t confined to banking, as it found in its latest survey that 45% of UK employees still don’t raise concerns about behaviour in their organisation, and of those who do speak up, only 39% said that they were satisfied with the outcome (a decline from 70% in 2012). According to The WSJ the survey report said that if companies do not offer support to their employees to speak up and raise concerns the alternative is that ‘they will raise their concerns externally, either with a regulator or even the media’.

Conclusion

Australian boards may, with good reason, feel far removed from the events affecting HBOS in 2008. In addition, the number of compounding failings at HBOS mean that the events and outcome are unlikely to be directly relevant to the boards of any large Australian company. However, as governance, culture and risk are all essential, but difficult, areas to get right boards would do well to read the detailed account of HBOS's failings set out in Section 3 of the report.

¹ See Financial Conduct Authority press release 19/11/15 and Financial Conduct Authority and Prudential Regulation Authority report The Failure of HBOS plc (November 2015).

² BBC news 19/11/15.

³ The Financial Times 23/11/15.

⁴ The Wall Street Journal 20/11/15.