A Starling Insights Deeper Dive Report

Supervisors on Supervision

Public Exposure Draft

Bryan Stirewalt

past-CEO

Dubai Financial Services Authority

Picture of Bryan Stirewalt
View Full Report

Contributions to the Supervisors on Supervision Stocktake

Should culture, and the conduct proclivities it may promote or discourage among employees, factor into supervisory engagements?

1.2.1d Some supervisors have suggested that organizational culture has the potential to generate systemic risks, rather than merely idiosyncratic risks isolated to a given firm.

“The one quote that always comes to mind is from Chuck Prince at Citi, who said, ‘As long as the music is playing, you’ve got to get up and dance.’ So, if bad culture becomes the accepted norm for the industry, then it's a systemic risk.”

If culture is important to supervision, then what factors make it challenging to assess?

1.2.2a Participants have pointed out that culture risk is typically only explored post-hoc, during root cause analysis, rather than proactively, before adverse outcomes arise.

“Assessments of management should serve as a leading indicator of expected results, not a trailing indicator of obvious problems. 

We do expect to act to pre-empt and anticipate poor conduct, and society has a right to expect this.”

1.2.2c Other participants describe how organizational complexity can make it difficult to assess culture risk and to evaluate success in connection with culture change initiatives.

“It goes beyond what you see at the board level. It’s about how the organization runs at the end of the day. Everyone gives you lip service — they laugh at your jokes. But when they go back to their desk, they talk about how stupid your joke was. That's the operational culture. Then there's the deep culture: the group that goes golfing together, the group that goes on vacation together. If you're not attuned to those subcultures, you may find that what you think is happening in the organization is not what's actually happening.”

How does the lack of a common supervisory approach to culture and conduct risk across jurisdictions pose a concern?

1.3.1a Some participants note that, because many financial institutions operate in multiple jurisdictions, a lack of coordination on culture and conduct risk creates challenges for effective supervision.

“The international regulatory community has yet to establish precisely how we are to create and embed supervisory cultures that are appropriately intrusive, skeptical, proactive, comprehensive, adaptive, and conclusive.”

If culture is a factor in governance outcomes, should supervisors take stock of their own cultures to improve supervisory outcomes?

1.4.2a Some participants also observed that because culture affects outcomes across all sorts of organizations, that it is also relevant to questions of supervisory effectiveness.

“It is important that leadership of the supervisory agency promote and continuously assess the culture of the supervisory organization itself.”

1.4.2c Participants observed that demonstrating attentiveness to supervisory culture is critical to gaining buy-in from the firms they supervise.

“I believe you [make progress] when you start talking about how to change supervision, not just how to change a bank's culture. We need to change the way we do things as regulators. This cannot be an exercise in how to change bank culture without thinking about ourselves as supervisors.”

What role does culture play in governance failures that ultimately require supervisory attention?

2.1.1c Some participants emphasize that culture and governance are fundamental to performance outcomes such that reliance on formal controls and processes without addressing culture undermines risk management.

“When you ask boards of directors a hypothetical question: ‘What happens when you have a trader who blows through all of your limits and loses $2 billion?’ They say, ‘Well, you fire him, you throw him out, you call the police.’ Okay. ‘Same trader blows through your limits and makes $2 billion?’ The answers you get are, ‘Ah, well, we should warn him. We should write a stern letter. We will withhold 10% of his bonus.’

The issue is not whether they made or lost money; the issue is that they blew through the limits. They have no respect for your middle and back office, and that's a management problem. 

If you don't know the subcultures of the organization, people might start to fudge, to cheat, to hide. If you don't have an open culture where people feel comfortable talking about something going wrong, you'll find that people simply lie. Once they've started fudging the numbers, when things turn bad, they'll turn bad in an angry way — they’ll drop significantly past where you thought they would be.”

2.1.1d Participants observe that culture can undermine incentive programs, employee engagement efforts, and other common management measures aimed at shaping behavior in desired directions, making it even more so a challenge for large, complex organizations.

“Every financial institution you walk into has the vision and mission on the wall: ‘We treat everyone fairly, we support our community, let's all row together.’ That's fine for the lobby, but the board sometimes doesn't go beyond that. There are levels of culture in an organization that the board may not actually know about. 

For example, what have been the most significant disagreements you have had at the board? If every decision has been unanimous, the chair has probably either beaten them down or hired all their mates. The same goes for the guts of the institution.”

What are the consequences for failing to consider the influence of culture in assessments of governance effectiveness?

2.1.2a Many Participants point to the banking sector turmoil of 2023, and various earlier misconduct scandals and prudential risk management lapses, as evidence that adequate culture risk supervision is lacking.

“The supervisory culture and supervisory practices that surrounded Silicon Valley Bank failed completely in identifying, escalating, and rectifying poor culture, governance, and risk practices in the bank. That was a supervisory culture problem just as much as it was a bank culture problem.”

How is supervision made more challenging by a reliance on judgment?

2.2.2c Participants discussed how a lack of trust between supervisory bodies and the firms they oversee can be detrimental

“There's often no interaction between the regulator and the industry outside of the inspection, when you've both got your armor on and are ready to do battle. That is a problem.”

2.3.1b Participants describe various structural challenges related to enforcement and culture risk.

“I think the ‘M’ in CAMELS is something that needs to have better emphasis, not de-emphasis. The ‘M’ should be a leading indicator, not a trailing one. Unfortunately, in the supervisory process, it is trailing. If earnings are bad, management must be bad. If earnings are good, management must be good. 

It shouldn't be that way. The same management who had good earnings is usually the same management that had the bad earnings. The problem is that supervisors have a hard time saying that management's not doing the right thing when all the numbers say that things are good. My answer [to banks that object to culture questions because of their strong financial performance is that] we want you to keep those numbers. We want to help you keep those numbers consistent. When you have bad governance, bad policy, or bad culture, those numbers can go out of control quicker than you can correct them.

That is what we're trying to achieve, and we're trying to achieve it together. If you start this culture debate with, ‘How am I going to enforce this?’ you’re going to have issues. Culture is hard enough to define, even more difficult to supervise, and nearly impossible to enforce in a traditional manner.”

Why have supervisors found it challenging to identify and assess culture-related risks prior to a risk event?

2.3.2d Many participants discussed how relying on post-hoc assessment of culture has can lead to adverse governance outcomes.

“Often management is downgraded to ‘poor’ by bank examiners only after the symptoms of bad management have manifested in weak financial results.”

2.3.2d Many participants discussed how relying on post-hoc assessment of culture has can lead to adverse governance outcomes.

“It is nearly impossible to say, ‘The earnings are questionable, but I'm going to rate management as good because they've got a plan.’ 

Management is always treated as a trailing indicator, never a leading indicator. You could have poor management with good numbers, and you could have great management with bad numbers. But the numbers always guide the management rating, and it should not be that way. Management should guide the numbers. 

‘If the numbers are good, we're good’ is a great way of doing things until, all of a sudden, it’s not.”

What emerging techniques and tools offer promise to improve culture measurement and risk assessments?

3.2.2c Participants point to the value that would be achieved were we able to conduct reliable horizontal peer reviews and benchmarking exercises in the realm of culture risk supervision.

“In my experience, the best way to start understanding culture issues across an industry is through a thematic or horizontal review. 

Don't make culture issues part of the individual inspection. Make them part of horizontal reviews where you grab a piece of culture — let's say, adherence to loan policy — across the entire industry. Then you can follow up on that when you go to the individual inspection.
As a supervisor, I can't give you, the company, much in the way of direct benefits from participating in horizontal reviews. But I can give you leeway if your organization wants an acquisition, wants to grow in different areas, or wants international expansion, because you've got good governance. 

A bank supervisor is not going to say who is good, but in these horizontal reviews, you also don't say who's bad. When you highlight a practice that identifies good culture, a bank knows, ‘That’s me.’ We're not telling you who the others are, but on this list of 30 banks, you're number six. Now you can do what you want with that information. Now you can create a race to the top. 

You could also lengthen the supervisory cycle. If somebody's got a good culture, we only look at them every two years instead of every year, or we do a reduced scope. If I trust your culture, I don’t come back for two years, or I only do a limited update next year.”

What have we learned from past approaches to culture risk governance and supervision?

3.3.2b Many participants reflected on how a focus on Tone-From-The-Top, while necessary, has had limited success.

“Virtually every publication on culture asserts that the ‘tone from the top’ is critical in any organization… However, more important than what is being ‘said’ at the top is what is being ‘heard’ and experienced in the middle. Front-line supervisors are the ones who translate the tone from the top and communicate supervisory culture outward to the regulated community. 

And this is precisely where the message gets obfuscated. 

If the experienced culture of the organization is not consistent with the tone from the top, action is needed… It may well involve altering message delivery so it is properly heard, understood, and acted upon.”

3.3.2e Other participants caution against using capital or liquidity controls as a means to compensate for lack of sound culture risk governance.

“It is far too easy for many to conclude that additional capital and liquidity are the answer to culture issues. But increased capital should not permit for a tradeoff that allows bad culture to prosper.

Credit Suisse had one of the highest capital standards in the world. It didn't help. That's a culture issue. No amount of capital or liquidity saves a bank — even a G-SIB — from weak management and poor corporate culture.”

What steps should supervisory bodies consider to help drive their own culture change?

4.2.1a Participants noted the importance of supervisory cultures supportive of innovation and a readiness to adapt to change.

“Staff must also feel supported in decisions they take — a particularly important point when confronting recalcitrant boards and management teams.”

4.2.1b Other participants noted that training and upskilling is required to incorporate behavioral science and culture assessments into supervision.

“Culture needs to be part of the inspection process and the training and development process for supervisors from day one, because it's not. Nor is management. That's left to the person in charge of the inspection to make a judgment at the end of the day based on their gut feeling. There needs to be much more uniformity than just somebody with 10 years of experience knowing better than somebody with three.”

What would a global initiative to transform culture risk governance and supervision in the financial sector look like?

4.4.1a Participants noted that global standard-setters have yet to prioritize culture risk governance and supervision, and urge that greater attention to such would be helpful.

“This is an issue for international standard setters to take up…. Bringing supervisors together… to explore how best to replicate good practices around the world would be a welcome endeavor.”