Regulators vow to be more cultured

Such regulatory efforts are obviously well-intentioned. In practice they will be complicated. The Australian Bankers Association and some others have already protested against the short time frame for consultation, the potential for unintended consequences and the lack of a review process which would allow penalised officers to defend their case.

Nor have companies sat back and waited for regulators to act. For example, here at ANZ the internal audit function is some years into a rigorous cultural assessment approach. Key to that approach is the presumption culture can be indeed be managed, for example via clear articulation of values and codes of conduct.

"We need a much deeper understanding [of culture] – especially if shareholders are going to reward it and regulators punish individuals if it goes wrong.”  - Andrew Cornell

Because of the growing prominence of cultural issues in the corporate world, we do need a much deeper understanding – especially if customers and hence shareholders are going to reward it and regulators punish individuals if it goes wrong.

Looking

The obvious challenge with culture is its intangibility. One of the better descriptions of culture I’ve read is “that which happens when no one is looking”. It is a way of thinking and behaving, something innate in an organisation but role modelled by leaders.

The Australian Prudential Regulation Authority clearly has an appreciation of the human dimension of culture: it has long valued behavioural psychology and shown a willingness to bring in the shrinks.

Last week APRA said it had hired experts in organisational psychology to be “embedded” in institutions to analyse their risk culture. ANZ’s approach is very similar.

Like APRA proposes, ANZ has been using surveys – to all staff in an area and focus groups and one-on-one interviews - to gauge how culture is working in practice. Participants in the focus groups and one-on-one interviews are randomly selected to ensure a wide range of input.

The work has been in train for a couple of years now but over the last 12 months it has expanded and even more assessments will be undertaken in 2018.

There are different models of cultural assessment – and there is no right and wrong way – but here at ANZ the work is being undertaken by Internal Audit. That’s because internal audit is considered “independent” in the sense it reports to the board, so staff are more open with their views.

Internal audit also has an enterprise wide perspective and so can obtain more consistent and continuous assessments.

It’s important to note though that assessments are just that: culture can’t be set by the invigilators. At ANZ Internal Audit provides the assessment – actually setting the culture is the role of management and the board. It is the board and management who turn assessments and recommendations into actions.

Kevin Corbally, ANZ’s Group General Manager Internal Audit, says the opportunity which comes out of such work is in identifying where more can be done to inform staff, understand concerns and providing the rigour and insight behind the board and management actions.

Fahmi Hosain, APRA’s head of governance, culture and remuneration, told a recent Actuaries Institute seminar, “Responding to Risk”, the supervisor will also draw on a wide range of sources, from the opinions of junior staff to first-hand observations of board meetings to provide the fodder for experts in behavioural analysis.

“One of the things that is often talked about when it comes to culture is it’s soft and fluffy. You can't measure it. It's hard to really understand. That's not our view,” he said.

“Our view is you can actually assess it. You can measure it. You can think about it in a quantifiable sense. It is data (but) it's a different type of data.”

Hosain’s key point is culture is not about process and written rules, it is about behavioural norms, and that’s what APRA is trying to better understand – and devoting considerable resources to.

This is not the first time APRA has dabbled in behavioural psychology. Under former chairman John Laker the supervisor drew on work being done in Europe to better understand board and senior executive behaviour – linked to improving understanding of who a “fit and proper person” was.

"One of our European counterparts has hired a small team of psychologists to assist in assessments of board dynamics and risk culture and the team, we are told, is earning its keep," Laker told me at the time.

Clear

Culture is clearly important. Strategies to measure it are becoming more sophisticated. Regulators and governments are moving to enact powers to penalise cultural lapses.

The challenging link remains properly understanding what components of culture can be isolated as actual behaviours - which can be penalised if breached – or enhanced by management.

APRA’s Hosain noted as much.

“What we're looking at here is both formal and informal drivers of the norms,” he said. “Traditionally what you would expect to see from most regulators here and overseas is a real focus on formal drivers.”

He said most practice guides are ‘chock full’ of strongly worded requirements and recommendations around formal drivers – such things as policies, procedures, governance frameworks architecture.

“They are absolutely important and vital for really sound risk management,” Hosain said. “But they're not the only things and we've learnt this through research through understanding actual outcomes of say the GFC - actually informal drivers are just as important.”

The Enron board was famously stacked full of eminence, including Nobel Prize winners, but as the ironically titled chronicle of its demise made clear, having the “smartest guys in the room” doesn’t create a positive culture or protect from failure.

Soft science

For APRA then, and for a growing number of regulators and supervisors, both within and without financial services, the ‘soft’ science of behaviour is being hard-wired into practice. The similar approach at ANZ and other companies reinforces this approach.

But that still leaves the conundrum of enforcement: ordinary malfeasance, corruption say, embezzlement, breach of contract, these transgressions are relatively clear. Evidence is gathered, damage measured, broken laws adumbrated, penalties applied.

However, for a penalty to be applied, a prescriptive law needs to exist so it can be demonstrated it has been transgressed. How then do we define ‘behavioural norms’ for example with sufficient precision for unacceptable, abnormal behaviour to be penalised?

The challenge remains, how do you best regulate culture? Again, this doesn’t mean companies are gesturing in the dark. Values, a clear purpose, codes of conduct – these very clearly delineate behavioural norms. It is deeper understanding of culture in application where new insights are emerging.

For APRA, this is very much a work in progress. When John Laker spoke of the psychology of boards, he noted that while some European regulators were sitting in on board meetings, APRA wouldn’t.

Now Hosain says APRA may well do – and on remuneration and risk meetings as well.

For the moment – as with the discretionary capital additions APRA applies to individual banks to reflect risk - the results will be reported to the companies involved but not made public.

No scarlet letters for the banks yet.

Andrew Cornell is bluenotes manging editor