Westpac’s culture, governance and accountability (GCA) remediation plan has found that key aspects of the bank’s non-financial risk culture were “immature and reactive” while its business was “overly complex”, leading to confusion about accountability.
“Our reassessment confirms that our management of non-financial risk is currently not at the standard we set for ourselves,” said CEO Peter King. “It is clear we have more to do to address these shortcomings, including improving our risk management capability and risk culture which is not where we want it to be.”
The reassessment delves deeper than an independent review of Westpac released in June, which found Westpac’s problems were “sins of omission, not commission”. But where that review found the board could not be held accountable for overseeing the deeper parts of the organisation where the breaches occurred – that the board relies on information flows, and that the content of those flows was poor – Westpac’s reassessment shows that the board could, and should, be doing more.
“Given the complexity of non-financial risk issues, Westpac needs to refocus oversight of non-financial risk at board and group executive level,” the reassessment reads. “Given the number of non-financial risk management issues experienced in recent years, further improvements in culture, governance and accountability frameworks and practices are required and must be critical priorities for the group executive.”
The review also found that the bank was still often “too satisfied with a sense of success” and that the “voice of risk” was too faint.
“Some leaders react to incidents with a focus on who is to blame rather than what to learn,” the reassessment reads. “This is partly connected to people’s response to BEAR requirements. However, it is important that this trait does not develop further at Westpac.”
Mr King has launched a multi-year Customer Outcomes and Risk Excellence (CORE) program, focused on making the board and group executive more involved in setting direction and tone, establishing clear risk boundaries for decision-making, and creating “accountable and empowered people”.
“It is clear we have more to do to address these shortcomings, including improving our risk management capability and risk culture which is not where we want it to be,” Mr King said. “The program is a company priority and as CEO I’m accountable for its delivery.”
