What happened?
Commonwealth Bank of Australia (CBA), the country’s largest bank, faced a succession of problems involving financial advice, lending, insurance and anti-money-laundering controls, damaging its reputation and public standing.
In August 2017, the Australian Prudential Regulation Authority (APRA) established a Prudential Inquiry not simply to revisit the individual incidents, but to examine the governance, culture and accountability practices that had allowed problems to emerge and persist.
The final report, dated April 2018, concluded that CBA’s continued financial success had dulled the institution’s senses, particularly in the management of non-financial risks. This article focuses on the concrete operating details beneath that conclusion: audit reports, complaint handling, regulatory responses and internal approaches to accountability.
Eleven passages that stood out
Page numbers refer to the printed pages of APRA’s final report.
Where complaint information stopped becoming useful
From Reports separates collection, systemic-issue analysis and reporting to management. The 3.4% figure is not a complaint-resolution rate. The 2015 review share and the 2017 staffing figure also describe different points in time.
Scroll the table horizontally if needed.
| Stage and time | What the report records | Note and printed pages |
|---|---|---|
| Use of data: July 2015 Board paper | 3.4% of all complaints were reviewed for systemic issues; complaint data were not generally linked with other data sources. | Note 07 · p.45 |
| Analytical staffing: July 2017 Executive Committee paper | One full-time equivalent was dedicated to identifying systemic issues from complaints. | Note 08 · p.45 |
| Changed responsibility: by the report date | The Customer Advocate had taken over the role and had a 5.5-FTE team for it. | Note 08 · p.45 |
| Executive Committee reporting: at the inquiry | Two emerging issues were selected per month without a robust selection process; severe individual complaints lacked proactive escalation. | Note 06 · p.44 |
| Board reporting: materials reviewed by the inquiry | Satisfaction rankings were reported, but complaint analysis and discussion of systemic risks were absent. | Note 05 · p.43–44 |
The Audit Committee described its own approach as a “light hand on the tiller” and did not routinely receive Red audit reports
The Board Audit Committee (BAC) did not, in the Panel’s assessment, show sufficient rigour and urgency in holding management to account over serious audit issues.
The BAC described its earlier approach as a “light hand on the tiller.”
Members were not routinely given full Red audit reports and rarely asked for them, relying instead on internal audit summaries. In 2017 the process changed, and directors began receiving full Red and significant Amber audit reports.
AML/CTF produced Red audit reports in 2013, 2015 and 2016, with earlier problems still unresolved
Anti-money-laundering and counter-terrorism financing controls generated three Red audit reports: in 2013, 2015 and 2016.
The 2015 report said an issue raised in 2013 had not progressed because ownership of the Group’s AML/CTF processes was unclear.
By the third Red report in 2016, significant issues from the 2013 and 2015 audits were still open, being re-remediated, or had yet to be addressed.
Twelve per cent of closed audit issues still carried unmitigated risk; four of five AML issues had also been closed too early
Internal audit reviewed issues that business units had marked closed.
In the first half of 2016, 12% of those audit issues had been closed without the risks being wholly mitigated.
A December 2014 review of AML-control remediation found that four of five issues had been closed without fully addressing the risks.
The same page also reports that 39% of certain open Very High or High audit issues had remained open for more than two years.
New projects could replace failed attempts to fix the same problem, creating a “false impression of constant progress”
The Panel heard a perception within CBA that its ability to execute risk projects was poor.
Efforts to resolve issues could fail and then be absorbed into new attempts to fix the same underlying problems.
The Panel said this cycle of creating projects could produce a “false impression of constant progress.”
The Board received customer-satisfaction rankings, but not metrics or analysis on customer complaints
The Inquiry found that Board materials did not include metrics or analysis on customer complaints, or discussion of systemic risks those complaints might reveal.
At the same time, CBA placed weight on its customer-satisfaction ranking among Australia’s major banks and reported that ranking to the Board.
The report said Board reporting emphasised CBA’s position relative to peers while not emphasising serious customer complaints.
Only two complaint-derived “top issues” went to the Executive Committee each month, without a robust selection process
The Executive Committee received some reporting on emerging issues identified from customer complaints.
However, only two issues were selected each month.
The report says there was no robust process for determining which two issues were selected.
There was also no process for proactively escalating risks arising from severe individual complaints to the Executive Committee.
Only 3.4% of customer complaints were reviewed to look for systemic problems
CBA possessed a large volume of customer-complaint data, but the report found that it was not fully used to identify systemic problems.
A July 2015 Board paper stated that only 3.4% of all complaints were reviewed for systemic issues.
Internal audit warned that reviewing only that slice of complaints could cause CBA to miss significant systemic insights.
Complaint data were also not generally linked with other data sources for systemic-issue analysis.
In 2017, identifying systemic issues from complaints was still assigned only one full-time equivalent employee
A July 2017 Executive Committee paper said only one full-time equivalent employee was dedicated to identifying systemic issues emerging from customer complaints.
It also described root-cause analysis capability more broadly as immature, pointing to unclear governance, manual processes and weak staff incentives to resolve root causes.
Responsibility was later transferred to the Customer Advocate, which had a 5.5-FTE team by the time of the report.
When challenged by regulators, CBA sometimes first asked why it was legally required to act
APRA, ASIC, AUSTRAC and other agencies described CBA as defensive and at times perfunctory in its response to regulatory concerns.
The Panel heard that CBA’s “default response” when challenged could be legalistic and defensive.
There were occasions when CBA insisted on hearing why it was legally required to take action before doing so.
The Panel said this adversarial approach appeared to place strict legal interpretation above risk or customer outcomes.
A root-cause analysis said the process was too complex for anyone to be accountable. A senior committee rejected that explanation
A root-cause analysis for one project concluded that no single person or team could be held accountable because of end-to-end complexity and legacy processes.
The Group Risk and Remuneration Review Committee (RRRC) rejected that reasoning.
The RRRC decided that “complexity” could no longer be accepted as an explanation for a lack of accountability.
Otherwise, it reasoned, the many complex processes involving multiple hand-offs across the Group could leave no one accountable for risk matters.
Nearly 80% of senior leaders referred to “good intent”; one focus-group participant said the intention was right 99.95% of the time
CBA had worked to become a values-led institution, but the Panel concluded that over-reliance on “good intent” had created risk-management blind spots.
Nearly 80% of senior leaders referred to operating with good intent during Executive Committee interviews. A representative focus-group participant said the intention was right “99.95 per cent of the time.”
Other participants described mistakes as acceptable where there was no bad intent and suggested that people would not be punished if everyone had good intent.
The Panel said that framing risk management around intent could overshadow capability, consequences, and weaknesses in processes and systems.
What the report says about the background
The Inquiry did not attribute CBA’s problems to one rogue employee or one failed control. It identified an interaction among Board oversight, ownership of non-financial risks, issue identification and escalation, complex decision-making, operational-risk and compliance functions, remuneration and organisational culture.
A central theme was that sustained financial success weakened vigilance. The Panel contrasted the “chronic ease” it saw at CBA with the “chronic unease” associated with stronger safety cultures in other industries.
The report also records that CBA had already begun multiple remediation measures before and during the Inquiry, including changes to Audit Committee practices, complaint analysis, resourcing and risk management. This article distinguishes those later improvements from the earlier practices being criticised.
Corrections to this article
PDF links opened one page before the intended printed page. Printed p.45 is physical PDF page 46; the mapping has been corrected throughout the article. The numerical claims are unchanged.