Supervisors on Supervision

“Risk culture is what is influencing decisions that produce different risk-reward outcomes, under the same business model, under the same conditions.”

“I have the feeling that we supervisors don’t do very much of that kind of training [e.g., in culture risk governance], as a rule, because it is hard, and because we lack frameworks for that. 

Instead, we try to identify problematic constellations that lead to bad culture: dominant leadership figures without checks and balances; non-diverse boards, unchallenged decision making among senior leadership, and the like.”

“We’ve called for changes to governance, to bring about more stringent leadership, but the biggest things we’ve had to change at problematic firms have been about the culture. If you’re going to change an organization, you have to understand its culture and work out what kind of culture is consistent with your mandate.

Of course, regulation — and codification via governance codes — tends to show you ways to be formally compliant with what law, regulation, or supervisors expect. That’s the ‘hardware’ of governance: independent directors on the supervisory board; separate audit and risk committees; the right people chairing them; CEO/Chair roles handled appropriately; all that.

These things can be codified and are codified differently across jurisdictions and corporate forms. 

If you stop there, though, you don’t get to an assessment of the culture of the firm. There are different interpretations of formal ‘good governance’ around the world — the U.S. is more comfortable with a double-hatted Chair/CEO than Europe, for example. But under formal compliance, you can still have widely divergent corporate cultures and risk cultures. I’ve certainly seen that as a supervisor.”

“All our efforts at codification tend to show you ways to be formally compliant — that’s the ‘hardware’ aspect of governance. But underneath that formal compliance, you can still have widely divergent risk cultures — that’s the ‘software’ element. 

When you’re trying to get hold of a kind of slippery topic like culture and need a framework for doing that, it fits under governance and risk management. That’s the right way to insert culture into a supervisory program — it gives you the permission to delve into the topic. 

But you could also reverse it and say you’re really looking at culture, and one sub-aspect of culture is the formal governance of the firm. I include with governance the whole fit-and-proper framework. That’s where culture starts.”

“We supervise banks of all sizes, down to the smallest financial institutions — there are hundreds. So why is it that, of our hundreds of banks, over the last 18 months, say, only about four of them have kind of gone off the rails? What was it about those firms and not the others?”

“Supervisors operate with imperfect information and a time lag. Often you only see it after something happens.”

“I think [cross-border coordination] could be useful. A lot of it is about sharing best practice, particularly where, in the absence of an adequate framework, people have struggled.”

“Whether it’s a set of ‘standards’ that we need, I’m not sure. But sharing experience around these issues could lead you into the direction that says you need some aspect of an accountability regime for key position-holders.”

“In the absence of the kinds of things we’ve talked about that would make life easier [e.g., common frameworks and agreed illuminating metrics], as a supervisor, you still have the responsibility to turn the ship around. So our best judgment is something we have to rely on.”

“I’ve led private and public sector organizations of many sizes, up to global, and the biggest challenge is understanding the culture you have and how to develop it. 

For supervisors, the dimensions on which we must focus may differ from those of firms, but the logic is the same. If you’re going to change an organization, you must understand its culture. And you must define the culture you want, that culture must be consistent with your mandate and enable you to deliver better on the mandate. 

That may be easier for supervisors than for firms, because staff generally subscribe to the public interest mandate you don’t have to discuss purpose.”

“With a good culture, you can compromise on some formal aspects of governance and still have a good outcome — or temporarily deviate from norms and still be fine.

There are two points to note here. First, there’s a range of acceptable risk cultures. The upside (good/brilliant) shouldn’t concern us as supervisors; the downside does. Even a mediocre risk culture may be okay for some business models, but there’s a lower bound that depends on what business you run. Supervisors must ask: (1) when is an organization outside the acceptable range? and (2) what do you do about it?

I’ve seen companies genuinely striving to show correct governance yet losing sight of culture. That’s the problem with what I call the model-mindset: ‘If we can believe the model, then everything’s fine.’ That ignores the human element — the red in tooth and claw nature of some parts of banking — and can allow things to drift.

You won’t get far saying ‘G is for governance’ and ‘C is for culture’ and scoring both separately. The two must be related. Since we’re committed to evaluating the impact of governance, the best way to get supervision to look at culture is to extend the definition of governance so that it encompasses culture. 

But you could also invert it and say: you’re really looking at culture, with formal governance as a sub aspect, because culture may be more important than organizational boxes and charts.”

“Poor governance doesn’t directly cause bad outcomes; people operating within that governance framework do. You see organizations obeying the letter but not the spirit of rules. Culture is what says: ‘we adhere to the spirit, not just the letter.’

We’ve seen banks fail where the ‘hardware’ of governance and risk management was in place — limit frameworks, etc. — and functioned, producing the right alerts which were then overridden. That can happen if the client relationship or the revenue potential is prioritized over the downside risk. 

Especially when it comes to balancing risk and reward, governance is filled with real people taking real decisions. What frame of reference do they use? How do they exercise power? The sum of those interactions and interpretations — that’s culture.

Maybe you can codify elements of ‘good culture’ to some degree, as separate or semi separate from formal governance?”

“In practice, culture is how governance is made real. 

Firms exhibiting poor culture aren’t necessarily the ones with formal governance deficits. Supervisors like a formal framework that you can check or audit against — ‘to what extent are you compliant?’ — but the ‘software’ aspect of culture doesn’t lend itself to that kind of supervision or auditability. That’s what makes it tricky. 

Culture has historic aspects, moves slowly, and is driven by leadership which brings you close to governance. I consider fit and proper assessments as part of effective governance, for example. That’s heavily regulated, telling you what kinds of people are appropriate for positions or combinations of people appropriate for a corporate body. And that’s where culture starts.”

“As supervisors, we’re interested when culture becomes risky. Private sector firms have a profit motive and entrepreneurial culture — that’s not usually our concern. The question is: when you have too much of an entrepreneurial culture, how does that affect risk outcomes? So we talk about risk culture and subsume what’s interesting to us under it. 

I’d define risk culture as those aspects of an organization that influence the decisions which transform the same inputs — same business model, same conditions — into different risk or risk reward outcomes. You can have the same inputs and people, but behavior changes with the environment: what’s expected and accepted differs.”

“In supervisory authorities the culture problem is often risk aversion, not excess risk appetite. I’ve never met a supervisor ‘taking too much risk.’

A key cultural attribute I’ve sought to encourage is boldness. Many career supervisors want to be bold but aren’t always led in a manner that allows them to be bold. Giving people permission to be bold, and then demonstrating through a few decisions that boldness makes us more effective, created a step-change for our organization. Our decision processes and legal basis for action were the same, but the biggest change came through shifts in our culture. 

Some changes can be made quickly because they’re synchronous with how people think and the mandate: e.g., getting supervisors to be bolder can be done quickly. Asking supervisors with a tendency toward form over substance to become faster and more pragmatic is slower.”

“One helpful angle would be measurable indicators of culture, beyond the ‘psychologist’s view’ of things. Most supervisors have enough case studies to know culture plays an important role in negative outcomes that didn’t need to happen. I think the supervisory community could do a great job brainstorming on indicators that surface culture problems. There are ways to get a handle on culture with indicators you can syndicate.”

“Culture runs down the organization, not just at the top. As a supervisor, you want leadership to influence all the way to the grassroots. Good people in good governance that never reaches the bottom won’t help you.”

“One major lever is incentive systems. Incentives drive culture. You must understand what people are rewarded for. There is of course the element of supervision regarding compensation, which is perhaps more of a European thing.”

“Anything involving people is emotional — much harder than numbers or models. These are the most difficult supervisory decisions because you don’t have codified triggers — no ‘capital ratio below X, stop the dividend.’ But in the absence of codification that would make life easier, you still have a responsibility to turn the ship. 

Supervisors must be prepared to demand personnel changes in senior positions. But you need the legal basis to permit that. You need the ability to intervene in the appointment or removal of key people — with safeguards against arbitrariness, of course. That’s probably the only way to effect rapid culture patches. Then you want to see a management team with a clear mandate for change.”

“A public-private initiative could be useful, particularly if it is about sharing best practice — what’s proven to work, and where people struggled in the absence of a framework. 

It may lead to a call for accountability regimes for key position holders, enabling evidence based judgment calls and rapid changes. Because if you’ve got a bad apple at the top, just telling those people to write a new policy won’t help. 

This is about the human factor and human interactions. It’s open-heart surgery on corporate governance — and that can be very difficult and emotional.”