Business Daily Media

CBA's board needs to take ultimate responsibility for the bank's failings

  • Written by Pat McConnell, Visiting Fellow, Macquarie University Applied Finance Centre, Macquarie University

Something appears to be very wrong with risk management at the Commonwealth Bank (CBA), that cuts right across the bank. There have been risk management problems in the retail (money laundering[1]), institutional banking (foreign exchange and bank bill swap rate benchmark manipulation[2]) and wealth management (Comminsure scandal[3]) arms of the bank.

This tsunami of scandals helped to trigger the Financial Services Royal Commission[4] which will examine banking misconduct.

And the responsibility, the accountability for risk management stops, and starts, with the bank’s board.

Read more: There's no evidence behind the strategies banks are using to police behaviour and pay[5]

In presenting its 2018 half yearly profits, the CBA board announced[6] that the bank had set aside provisions of A$375 million in anticipation of a penalty resulting from failures to properly implement anti-money laundering controls.

In the media conference[7] following the appointment of Matt Comyn as the new CEO of CBA, the chair of the banks’ board Catherine Livingstone, admitted, while it was:

…entirely appropriate to share a collective accountability for the issues that we have had… [that] the processes around operational risk management and compliance risk management…is where we have not performed as we should have.

In his first media conference as CEO, Mr Comyn, not surprisingly, concurred with his new boss.

And it became unanimous, when a few days later the progress report[8] of the Australian Prudential Regulation Authority’s Prudential Inquiry Panel into the culture at CBA, reported that investigations were being focused on “capabilities and accountabilities for risk management in the organisation, particularly for operational, compliance and reputational risk”.

CBA’s latest annual report[9] describes in some detail the risk management framework that is supposed to direct risk management across the bank. The framework, which incorporates the requirements of APRA’s prudential standard for risk management[10], comprises three main components: a risk appetite statement (which describes the types and maximum levels of risk that the board is willing to accept), a three year rolling group business plan and a risk management strategy.

The bank’s risk appetite is formulated by the Board Risk Committee, approved by the board, and dictates the levels of risk-taking in each business line.

In practise the bank actually follows what is called a Three Lines of Defence model. The so-called first line of defence is business management, which is responsible for the effective implementation of the board-approved risk management framework.

The second line is a separate group of staff with specific risk management skills to develop and monitor the risk management process. The third and last line is an independent group that acts as an internal audit function.

CBA's board needs to take ultimate responsibility for the bank's failings The Commonwealth Bank’s board is responsible for the bank’s risk management and oversight. AAP

CBA is a large and complex organisation, and naturally there is a large, complex risk bureaucracy. This is detailed in the bank’s latest risk report[11].

However, APRA is clear that the board should take ultimate responsibility.

The lines of defence are clearly broken. If there had been one single, or maybe two, risk management failures at CBA, you could put it down to complexity, teething problems or just bad luck. But over the last decade, there has been a catalogue of bad risk decisions affecting the bank’s customers, shareholders and the Australian financial system.

After the first few times, surely the effectiveness of the risk framework and the three lines of defence should have been questioned and remedial action taken? But apparently it was not, and there is now frantic action by the people responsible – the CBA board - to do something (anything) about it.

In the media conference, Catherine Livingstone and the new CEO repeatedly talked about “collective accountability” and tried to diffuse the severity of the situation by talking about “organisation wide” and “culture” issues, as if even the staff in the bank’s branches were somehow to blame.

In fact, in the case of money laundering through ATMs that has drawn the ire of AUSTRAC, it was the first line business staff in the branches who raised the alarm. Their warnings were not taken seriously. To claim that the lower-level staff are somehow “collectively accountable” is bordering on the bizarre.

Read more: Australia's financial regulators need policing[12]

The accountability for the risk management failures is indeed spread far and wide but by far and away it is the joint responsibility of the board and executive committee. The knee-jerk reaction[13] to cut a few bonuses is insufficient.

Someone in the board of the bank has to resign or be fired. Where failures are detected, bonuses already paid out, for example to recently retired[14] board members, should be retrieved.

And going forward, the three lines of defence must become a real protection for customers rather than a convenient pretence, and APRA must ensure, for customers’ sakes, that the three lines are operating effectively in all large financial institutions.

References

  1. ^ money laundering (www.sbs.com.au)
  2. ^ bank bill swap rate benchmark manipulation (www.afr.com)
  3. ^ Comminsure scandal (www.insurancebusinessmag.com)
  4. ^ Financial Services Royal Commission (financialservices.royalcommission.gov.au)
  5. ^ There's no evidence behind the strategies banks are using to police behaviour and pay (theconversation.com)
  6. ^ announced (www.commbank.com.au)
  7. ^ media conference (www.commbank.com.au)
  8. ^ progress report (www.apra.gov.au)
  9. ^ annual report (www.commbank.com.au)
  10. ^ APRA’s prudential standard for risk management (www.apra.gov.au)
  11. ^ risk report (www.commbank.com.au)
  12. ^ Australia's financial regulators need policing (theconversation.com)
  13. ^ knee-jerk reaction (www.afr.com)
  14. ^ recently retired (www.commbank.com.au)

Authors: Pat McConnell, Visiting Fellow, Macquarie University Applied Finance Centre, Macquarie University

Read more http://theconversation.com/cbas-board-needs-to-take-ultimate-responsibility-for-the-banks-failings-91485

2025: E-Commerce's Reinvention Begins Now

This has been a year of disruption for the retail sector, but if 2024 was about survival, 2025 is about reinvention. With consumers evolving faster ...

4 Key Ways to Protect Your Small Business During Your 2025 Launch

With a focus on key protective measures, these tips equip you with the necessary insights to ensure a successful and secure start. Whether you're ...

Digital Matter Launches New Tracking Solution

New Remote Monitoring Solution:  Accuracy, Performance and Longevity   Digital Matter, a leader in low-power GPS and IoT hardware development, ha...

Unveiling Amazon Nova: The New Generation of Foundation Models

Amazon’s latest state-of-the-art foundation models offer intelligence and industry-leading price performance Amazon Nova models enhance the exten...

Belvedere continues Christmas tradition of donating toys to children in need

Christmas is a time for giving, and LewisLand Group is helping brighten the season for sick children through its donation of $10,000 worth of toys...

Retail Reinvented: How Technology and Consumer Confidence Will Shape 2025

As we approach 2025, Australia's retail sector stands at a pivotal juncture, influenced by evolving consumer behaviours, technological advancement...

Sell by LayBy