APRA (Australian Prudential Regulation Authority) has just released the report of its inquiry into the Commonwealth, finding that a failure of culture is behind a series of scandals which have eroded trust in Australia's biggest bank. The regulator calls the bank’s culture “insular” and an environment where learning from experiences and mistakes was ignored.
The bank’s board of directors also had “inadequate” oversight of emerging non-financial risks and its senior executives had a lack of ownership of key risks.
The bank has been caught in a series of scandals including providing poor financial advice to customers. These are being investigated by the financial services royal commission.
The Commonwealth also faces court action over breaches to anti-money laundering regulations identified by AUSTRAC, Australia’s financial intelligence and regulatory agency.
Today, the Commonwealth Bank's shares traded higher. A short time ago, they were up 1.6% to CBA $73.01.
The inquiry by APRA has lessons for all the big banks.
"Community trust in banks has been badly eroded, globally and in Australia," says the APRA report.
"Globally, the financial crisis exposed a series of corporate scandals in banks. Governance weaknesses, serious professional misbehaviour, ethical lapses and compliance failures have resulted in substantial financial losses and record fines and penalties.
"Banks in Australia were resilient through the crisis but their conduct is far from unblemished.
"Failings in the provision of financial advice, dubious lending practices, mis-selling of financial products, shortcomings in the setting of benchmark interest rates and compliance breaches have undermined community trust, drip by corrosive drip.
The report poses the question: How can this happen in a bank of CBA’s stature and sophistication?
"There is no simple answer, no silver bullet remedy," says APRA. "A complex interplay of organisational and cultural factors has been at work."
However, common themes emerged from the six-month investigation.
While the Commonwealth Bank has excelled in posting increasing profits and returning dividends to shareholders, two critical voices became harder to hear: that of the customer, and talk of risk.
The fading of the voice of non financial risks came from a heavy emphasis at the bank of the risk function on financials. And the viewpoint of customers did not always ring loudly in decision-making and product design.
Cultural factors lie at the heart of the problems.
APRA says four broad cultural traits stand out.
A widespread sense of complacency from the top down. There was a collective belief at the bank that it was well run and inherently conservative on risk. "This bred over-confidence, a lack of appreciation for non-financial risks, and a focus on process rather than outcomes," says the report. "CBA was desensitised to failings with customers."
"A slow, legalistic and reactive, at times dismissive, culture also characterised many of CBA’s dealings with regulators. Taken together, complacency and reactivity led to a sense of chronic ease in CBA, rather than the chronic unease that has proven effective in driving safety cultures in other industries."
"It did not reflect on and learn from experiences and mistakes (its own and others), including at Board and senior leadership levels," says the report. "CBA became insular. Lessons from previous incidents have not been readily captured or shared across CBA. A lack of intellectual curiosity and critical thinking about the ‘bigger picture’ and the full depth of risk issues inevitably limited CBA’s ability to learn, anticipate and adapt. CBA turned a tin ear to external voices and community expectations about fair treatment."
The collegial and collaborative working environment, which places high levels of trust in peers, teams and leaders, also worked against the organisation. "Pursuit of consensus has lessened constructive criticism and has led to slower decision-making, lengthier and more complex processes, and a slippage of focus on outcomes," says the report.
"It has also impeded accountability and the individual ownership of risk issues. Trust has not been continually validated through strong metrics, healthy challenge and oversight. Good intent has been too readily used to excuse poor risk outcomes."