A Starling Insights Deeper Dive Report

Supervisors on Supervision

Public Exposure Draft

Joe Longo

Chair

Australian Securities and Investments Commission

Picture of Joe Longo
View Full Report

Contributions to the Supervisors on Supervision Stocktake

What does culture mean in the supervisory context?

1.1.1a There is recognition among stocktake participants that culture lacks a commonly agreed-upon definition, which makes it difficult to discuss, examine, or assess.

“I think culture has become a critical concept in modern corporate governance parlance. Good culture promotes good, objective decision-making, and I think culture plays a critical role in having a sophisticated analysis and conversation about what's going on in an institution. 

There's no one culture that's going to deliver what people think they want. As a generalization, we sort of know when the culture is bad, or at least we think we know because bad things happen, right? Companies collapse, they produce toxic products, they mislead their customers. 

And so we say ‘Aha! There's a cultural problem there because they haven't been able to do A, B, and C.’ And then there are other organizations where things seem to be going well, and sometimes we say about those organizations, ‘Oh, that's a good culture’. 

But in my mind, culture is really a compendious type of expression where we dump all sorts of issues and problems under that umbrella. We say, ‘Well, if X has gone wrong, oh, that's the culture. It's a really bad culture.’ We've got to be careful how we use the concept because it does exhaust its usefulness after a while.”

1.1.1c Others define the scope of supervisory interest in culture much more broadly.

“Although I find the concept of culture really helpful, I sometimes wonder whether we put too much weight on it as a bit of a silver bullet when it isn't.

The way we talk about culture, it has a lot of work to do; it carries a lot of conceptual weight across a whole range of topics. So I think it's really important when we think about culture to contextualize it.

It just seems to me that if we think more in terms of what makes an organization successful, then the metrics start to change. A successful organization has a whole range of attributes, and we compendiously refer to them as ‘good culture’."

1.1.1d Others observe that conflating values and culture may be problematic, as it may conflate supervision with the making of moral judgments.

“Well-run organizations, run by people that have high integrity, who are honest, diligent, open minded — and other words like that. We'll call them ‘good values.’ Now, is that culture, or is that good values? 

The way I like to think about it is: what sort of organization do you want to be? What sort of values? And then that'll lead to your own culture.”

How do inconsistent definitions and the lack of a common framework by which to discuss culture impact the practice of supervision, particularly as regards material but qualitative risks?

1.1.2a Many participants note a relationship between culture and governance, but that a lack of shared grammar, frameworks, tools, and training contributes to inconsistent expectations.

“Culture is the cumulative effect of a whole range of things. I find myself, when I talk generally, saying things like, ‘I like a culture of challenge. I like a culture of curiosity.’ But you see my ambivalence with the use of the word. It's very ubiquitous — it's all over the place.

It's a really critical concept to explain when things go wrong and to illuminate how to make them better. Maybe someone clever can inject some science into that and say, ‘Well, here are the 10 key features of culture and how you measure it’. We all instinctively believe that it's a critical concept, but injecting science into it is a bit challenging.”

Should culture, and the conduct proclivities it may promote or discourage among employees, factor into supervisory engagements?

1.2.1d Some supervisors have suggested that organizational culture has the potential to generate systemic risks, rather than merely idiosyncratic risks isolated to a given firm.

“Coming out of the Global Financial Crisis, you could fairly use ‘cultural problems’ there too. So I think culture is the cumulative effect of a whole range of things.”

If culture is important to supervision, then what factors make it challenging to assess?

1.2.2a Participants have pointed out that culture risk is typically only explored post-hoc, during root cause analysis, rather than proactively, before adverse outcomes arise.

“There must be gallons of digital ink spilled on trying to give structure to what we mean by culture. It's definitely a useful tool for regulators, I think, because it helps explain why things go wrong. And it's also a nice vehicle for how to make things go better, because we start describing the culture we'd like to have. 

But then there's a causation question: if we had the culture that we think we want, would that lead to good things?
As we know, there are skeptics. I remember when culture first became a hot topic, some individuals from more of an old-school way of thinking said, ‘What the hell are you talking about? I make brilliant widgets. Culture is irrelevant. The fact is, I make brilliant widgets.’"

How does the lack of a common supervisory approach to culture and conduct risk across jurisdictions pose a concern?

1.3.1a Some participants note that, because many financial institutions operate in multiple jurisdictions, a lack of coordination on culture and conduct risk creates challenges for effective supervision.

“I think we need to be a bit realistic about how we use the concept of culture and try to put some structure around it. And to the extent there's some international consensus around how we do that, then I think that would be useful.

 Increasingly, the world's getting smaller, and issues around financial stability and how we think about these problems have a global context. So if we're taking that seriously, then we can't all be singing from different hymnals because it's just going to create confusion and lead to bad policy. 

So I think the idea of having some document — a charter or protocol or whatever you want to call it — that encourages people to talk about the concept similarly, I think that would be helpful.”

If culture is a factor in governance outcomes, should supervisors take stock of their own cultures to improve supervisory outcomes?

1.4.2a Some participants also observed that because culture affects outcomes across all sorts of organizations, that it is also relevant to questions of supervisory effectiveness.

“We've done a lot of work on addressing cultural issues. Did that make us an ineffective regulator? Maybe in some respects, it did. If you haven't got the staff giving us feedback on the various elements of good culture, then you are not going to be a modern, confident, ambitious regulator. You are going to be an inwardly focused entity — the last sort of entity you'd entrust with enforcing the law.”

Why have supervisors found it challenging to identify and assess culture-related risks prior to a risk event?

2.3.2a Participants discuss different approaches and frameworks for supervising culture driven risks and highlight relevant tradeoffs.

“Frankly, I think we fudge this all the time, and we get away with it because usually we talk about culture when there's lots of evidence of problems. So you fix the things you can measure, and then the assumption is that's happened because the culture has shifted to the so-called ‘culture of compliance’. 

The harder question asked here is, ‘Well, does that mean I now have good culture? Are you now happy?’ 

I know people do board assessments for a living. You look at the way the board operates and you say, ‘Okay, you're getting good results, but are you running the board with the kind of governance I was describing earlier — in an open-minded manner, curious, with high integrity?’ And that's an assessment you can outsource, or it's an assessment the regulator itself can do. 

It may not be as scientific, but I think there's room for better science to make whatever we do or decide more transparent and replicable. People need to understand why you're doing things, why you're reaching conclusions. That's good regulation; it's fair.”

What steps can supervisors take to ensure that the exercise of their judgment regarding matters of culture risk governance isn’t arbitrary, and that it improves over time?

2.4.1a Participants described the importance of having mechanisms to preserve judgment, whereby earlier anticipatory assessments are tested against what actually unfolded thereafter.

“Sometimes what's obvious to me isn't obvious to everybody else. You have to say why. And that is a mixture of a legal and a cultural issue, isn't it? If you've taken regulatory action, or not taken it, I think one of the things regulators struggle with — I know we do occasionally — is to be able to explain to the market and the community why we didn't take action, as opposed to why we did.”

What are the structural challenges to integrating culture supervision into standard oversight practices?

3.1.2a Some participants describe challenges when there is a lack of a legal framework or regulatory mandate.

“In our Criminal Code, we talk about the concept of ‘fault elements.’ If intention, knowledge, or recklessness is a fault element, that fault element must be attributed to a body corporate that expressly, tacitly, or impliedly authorized the offense. 

But the key point I want to make regards the means by which such an authorization or permission may be established. One of them is proving that a corporate culture existed within the body corporate that directed, encouraged, tolerated, or led to non-compliance. Or, proving that the body-corporate failed to create and maintain a corporate culture that required compliance with the relevant provision. 

The Commonwealth Parliament of Australia was persuaded to pass legislation that says, if you want to prove the corporation did something wrong, one of the ways of doing that is proving one of these corporate cultures existed. 

And culture is defined in that legislation. “Corporate culture means an attitude, policy, rule, course of conduct, or practice existing within the body corporate generally or in the part of the body corporate in which the relevant activity takes place.”

However, without too fine a point on it, it's pretty much a dead letter. It's never been used. Prosecutors just haven't run any cases. This legislation took effect in 2001. It's now 2025, and there's been not one case. I just think it's curious. I was in private practice in the late nineties, and I spoke against this law on the basis that I didn't think it was prosecutable. I just didn't think it would work. And it hasn't.”

How can supervisory bodies move to embed culture risk into supervision and governance frameworks?

3.4.1a Participants describe current efforts to incorporate culture risk into supervision and highlight the questions that such efforts raise.

“I think the significance of culture is that it's become a very useful compendious concept to help us understand what's going on in organizations and how to improve them. Historically, what's probably happened is that we underestimated the importance of culture. And what we've learned is that it's actually really important. What we're grappling with now is how to integrate that into our whole approach to supervision.”