What can we learn about culture from the CBA report?
What the APRA Prudential Inquiry into the Commonwealth Bank of Australia shows us all too clearly is that it is not good enough to take a limited view on risk management.
If you have not yet read the report, I commend it to you – as a case study, it is a primer in corporate governance especially as relates to culture and accountability. Many company boards will do self-assessments against this report. We have begun receiving enquiries about how to assist and we expect to develop a variety of professional development offerings that will lean on the learnings.
The Hayne Royal Commission, the APRA Inquiry and the ASX Principles Review's proposed recognition of the fundamental importance of a company's social licence to operate all provide us with opportunities to review and assess the current state of governance practice. It also gives us an opportunity to reflect on and to consider what current events can teach us.
Often the answer seems to be that we have not been paying close enough attention to the right things - namely those elements of our corporate culture measured not, in the first instance, by financial gain or loss, but in the gain or loss of the trust of our customers and stakeholders, who grant us a licence to operate.
An ethical framework must sit at the heart of our governance structures to guide, rather than direct, our decision-makers while maintaining organisational integrity. The framework will serve as a common and authoritative point of reference for all in the organisation, and give shape to organisational culture. This framework will guide directors, executives and employees alike through the "Can we? Should we?" decisions they face every day.
Corporate culture is complicated and getting it right cannot be left simply to personal leadership. It is not a set and forget process but requires constant attention.
Governance Institute is committed to helping our members and their organisations with this on-going task of monitoring and managing culture. To that end, last year Governance Institute, in conjunction with the Ethics Centre, Institute for Internal Auditors – Australia and Chartered Accountants Australia New Zealand, released Managing Culture – A good practice guide, which offers organisations a road map for implementing strategies to assess and embed their corporate culture.
What the APRA Inquiry into CBA tells us is that a reactive, insular and complacent culture, too reliant on a presumption of the 'good intent' of trusted colleagues and leaders, can leave an organisation stumbling into reputational disaster after disaster, even while the risk managers are giving the all clear, because, financially things are sound.
The Inquiry shows CBA had a tin ear when it came to customer voices and non-financial risks and misjudged their impact. Conduct risk appetite is as pure a reflection of corporate culture as you can get. Misjudging the line can result in irreparable reputational damage. Trust is currency - we can build up a reserve, we can spend a bit here and there, but we can also run the account down to empty. Governance Institute's annual Ethics Index surveys have shown that financial services is one of the least trusted sectors in Australia. We eagerly anticipate the results of the 2018 survey.
How can we test our corporate culture? For customer-facing businesses, listening to the customer voice is crucial. Trends in customer complaints are like the gasps of canaries in the coalmine - ignore them at your peril. For other types of businesses, keeping an open ear to employee feedback is important. The APRA Inquiry surveyed 10,000 CBA employees and found amongst the impressive quantity of responses an awareness of the nature of the problems within the bank. In the CBA employee survey the degree of confidence about whether they would be protected if they needed to "blow the whistle" declined relative to the seniority of the staff responding – the more junior the staff, the less certain they were of their protection.
As a case study for corporate Australia, the CBA Report is an invaluable source. However, as one of the recommendations makes clear, there is no substitute for staff well-trained in governance and risk management. And while the report doesn’t explicitly mention company secretaries, I think it does raise a question we may need to spend some time pondering: what role should company secretaries, and governance professionals more generally, play in drawing attention to non-financial risks and cultural red-flags?
I’d love to hear your thoughts on these matters – tell me what you think?