Contributions to the Supervisors on Supervision Stocktake
What does culture mean in the supervisory context?
“Lots of things are hard. But just because this is hard, difficult to engage with, and you can't just tick a box, that makes it all the more worth engaging with.”
“One of the best definitions of culture, though it's also used for character or ethics, is: what do you do when no one's looking? What is your ethical state, and how do you then begin to transmit that series of values throughout your organization?
This culture/ethics question often gets wrapped up in ‘reputational risk’. But it’s a very private decision taken inside organizations. The regulator isn't scrutinizing this right now, activist groups aren't scrutinizing this right now, the rest of the market is not looking at this right now. This is a decision I'm taking inside my own walls. You shouldn't be reliant upon your peers or regulators to set a norm. This needs to be a norm that is understood inside an institution.
It starts from how the senior leadership, the board, and the owners of an organization want to conduct themselves and what they ultimately believe is the right thing for their customers and clients.”
“A lot of a supervisor’s business is about stopping perfectly decent human beings who are going about their normal daily jobs from making really bad choices, rather than stopping criminal masterminds.
The vast majority of people I dealt with when I was at the FCA were often perfectly good, regular people in successful commercial business careers who made some really bad choices.
It's often when you are chasing just that extra bit of margin, or when you're under commercial pressure to meet your targets, that people do things that, if you had asked them in the cold light of day, they would simply say, ‘Oh no, of course I wouldn't do that. I'm an upstanding citizen.’ That is often the start of people getting into a downward spiral, whether it's trying to rig markets or gouge customers.
What is the relationship between culture and governance and how does ambiguity about that relationship contribute to uncertainty?
“I would always put culture at the top of that flow diagram. I would definitely put governance next after culture.
Culture isn't just a normal preventative thing; it's not a preventative control in the way you might introduce systems or processes. It's the stage before that.
You can say, ‘This is our culture, these are our ethics,’ but if the way you behave as a board and a leadership team constantly undermines that, or stands in paradox to it, then you have a problem. The old saying is, ‘Culture eats strategy for breakfast.’ If the actual culture is demonstrated by leadership chastising middle managers for not hitting weekly targets, then all your middle leaders will ever focus on is that.
There is also a question around thinking really carefully about your systems and your controls, not in the sense that each is designed to completely reinforce your culture, but ensuring at least, that they don't work against it.”
Should culture, and the conduct proclivities it may promote or discourage among employees, factor into supervisory engagements?
“If you look at where things go wrong, it's where there's an incentive to break from the norms of the pack for commercial advantage. One of the bigger deterrents to that is not necessarily what the rules say or what the regulator is going to do — although that is obviously very important — it's often, ‘Well, is anyone else in the market doing that at the moment?’”
What role does culture play in governance failures that ultimately require supervisory attention?
“Regulators can give you lots of governance and lots of rules, but no amount of governance or rules will ever deal with all the situations where you have to deploy judgment.
It is incredibly easy to encounter a problem or a new set of rules and for a firm to deploy another checklist, another manual, another process run by compliance rather than address the underlying cause. Particularly in financial services, you can get into a situation where everyone is just ticking the box.
Sometimes you can infer the culture just by looking at how processes work. I've seen a risk committee tracking probably 200 risks on a matrix for the bank, and all but three were green. That tells you this is a culture where you simply do not tell the board if you've got a problem until the last minute.”
What are the consequences for failing to consider the influence of culture in assessments of governance effectiveness?
“As we saw in the Credit Suisse case, a series of things you might think of as conduct-related ultimately undermined wider market trust and confidence. At the end, you had what, even a couple of weeks previously, had been a very well-capitalized bank hit by a collapsing confidence in the wider market.”
How can supervisory culture be made more proactive and effective in connection with evaluating culture-related risk matters?
“It endlessly frustrates me when people say something is really difficult, it can't be 100% consistent, you can't absolutely prove it with an equation, so we shouldn’t try to do it. If we are going to say that all regulation has to come down to a 100% quantitative metric, then we will measure a few things, but they may not be the right things.
The counter to the argument that we need to focus on this culture issue is, well, everyone should just give up. And I don't think everything we've learned so far about serious breakdowns in markets — whether they're conduct-related or tip over into a prudential problem — suggests that.”
Why have supervisors found it challenging to identify and assess culture-related risks prior to a risk event?
“For natural reasons, firms and policy makers often prefer hard and fast rules — for the regulated this offers the sense that ‘I complied with the rule, so I must be safe,’ while, for regulators, rules provide clear evidence that they are trying to manage a situation. But they need to be subordinate to the overall purpose the rules intend to serve. There is no point having 100% compliance if the outcome is not good or effective.”
What tools, metrics, and data collection capabilities are currently available to support culture risk governance and supervision? What is working and what does this hold for the future?
“If you are looking for metrics, you also need to think about going broader than the regulator to-bank conversation.
When you talk to analysts, many are saying, ‘Look, we're just discounting this set of earnings because we believe there'll be some form of redress in the future or another regulatory problem.’ So, they're not going to give these institutions full credit. How do you turn that line of sight and immediacy into a question about, ‘Why are we trading at such a discount, and what are the things we need to do about it?’”
What emerging techniques and tools offer promise to improve culture measurement and risk assessments?
“Very much in the Financial Services Culture Board's methodology was this idea that you reinforce good culture by making peer comparisons, and that's a perfectly valid methodology. In terms of human behavior, it's about establishing cultural norms, particularly when you are around the City or any financial community.”
What have we learned from past approaches to culture risk governance and supervision?
“Occasionally, both as a consultant and historically as a regulator, you'll get people who come along and say, ‘Please give me a tick list for what's a good culture.’ Well, that's almost an immediate fail, if you think it's a tick list.
If you remove discretion and judgment from your senior and middle leaders, it almost becomes a scenario in which they believe they can do anything they want as long as they feel they have ticked the right box. And that's an incredibly dangerous place to be.
This, I think, is one of the most scary things: ‘We've ticked all the right boxes, and these other 15 people have ticked all the right boxes, so this decision must therefore automatically be right. Don't rock the boat.’
Things like the Consumer Duty [in the United Kingdom] actually reinforce that idea of an expectation of judgment being applied. It is the role of senior leadership not just to follow the rules, but actually to apply judgment around those commercial situations where you think about the spirit as well as the letter of what's trying to be achieved.
It is the role of senior leadership not just to follow the rules, but actually to apply judgment around those commercial situations where you think about the spirit as well as the letter of what's trying to be achieved.”
“Some regulators around the world see everything through a prudential lens, where a capital scaler can deal with pretty much most things we might think of as culture or conduct. In other words, your behaviors will improve as long as we make it sufficiently commercially painful in terms of capital requirements.”
“Some regulators around the world see everything through a prudential lens, where a capital scaler can deal with pretty much most things we might think of as culture or conduct. In other words, your behaviors will improve as long as we make it sufficiently commercially painful in terms of capital requirements.”
How can supervisory bodies move to embed culture risk into supervision and governance frameworks?
“The reality is, maintaining an ethical culture is really, really hard. One, we're often talking about very large organizations. By the time you've got 10,000, 50,000, or 100,000 employees, getting your middle and even senior leaders to act consistently is incredibly difficult.
The incentives and structures are nearly always stacked against someone with sufficient seniority coming in and saying, ‘Hang on a minute, have we quite got this right?’ And particularly in a large organization, is that information even going to reach them?
There are lots of temptations along the way to make exceptions, especially when commercial targets are under pressure. ‘Let's not worry about that too much because the situation we find ourselves in at the moment overrides where we are.’
For all the good intent there might be, there are lots of little reasons to say, ‘I just want to make this an exception.’ If you look at where things go wrong, it's often where there's an incentive to break from the good norms of the pack for commercial advantage.”
What steps should regulators consider to enable more effective culture risk supervision?
“As a prudential regulator, probably one of your best early warnings of potential prudential problems is to look at the culture question.
Regulatory regimes that put too much confidence in capital buffers can be missing a wider picture. That's where the cultural piece absolutely comes into it. You do need a mixture of metrics here. Some are very easy to define, measure, and use as a communication tool. A central bank can say, ‘I've given you a bigger capital buffer because I'm not confident.’
Within a Twin Peaks model, you can think of culture as going across the pair of peaks.
As a prudential regulator, you should think very carefully about cultural issues. Often, you are looking at the same underlying issues the conduct regulators are looking at even if the presenting problems are different.”