Culture and conduct

John Price explains why a key aspect of good governance is getting the culture of an organisation right.

The Australian Securities and Investments Commission (ASIC) is concerned about culture because it can be a key driver of conduct within the financial system. Given that there is often a strong connection between poor culture and poor conduct, we consider poor culture to be a key risk area with respect to our role as a conduct regulator.

What do we mean by culture? We recognise this is a very broad and somewhat intangible concept, but generally it is a shared set of values or assumptions which reflects the underlying mindset of an entity.  It guides how an entity and its staff think and behave, and shapes attitudes and behaviours.

As a company can only act through its people, culture is one key way in which people can be influenced to act appropriately. A key aspect of good governance is getting the culture of a company right.

The bottom line

Culture can make a difference from a commercial perspective. Research has shown that businesses with a strong culture tend to have sustained high performance over the longer term.  In addition, those businesses that have a strong customer focus tend to compete more effectively, have higher customer satisfaction and better customer retention.

Conversely, poor culture may adversely impact an entity by incurring significant financial costs. These costs may arise as a result of fines, being required to pay remediation or compensation costs, or from damage to an entity’s brand or reputation which can take longer to restore. For example, according to the London School of Economics and Political Science, the cost of poor conduct for the 10 most-affected global brands was approximately $US250 billion between 2008 and 2012. KPMG have also reported that since 2011, the largest banks in Britain have paid almost 60 per cent of their profits in fines and repayments to customers.

Positive culture drivers

So what are some of the things that ASIC looks for in relation to corporate culture? Three things stand out:

Communication – We expect that acceptable (and unacceptable) conduct and behaviours will be clearly articulated.

Challenge – That entities will examine and challenge their existing practices and that employees are encouraged to escalate potential practices or behaviours of concern.

Complacency – That boards avoid complacency and actively manage conduct risk by building ongoing processes that are continually reviewed, enforced and validated.

Building on this framework we consider the first driver of positive culture is setting the right tone at the top. The board and senior management are responsible for creating a culture where everyone has ownership and responsibility for doing the right thing and a focus on achieving good outcomes.

The board should set the values and principles of an entity’s culture, which should be reflected in its business strategy, business model and risk appetite. These must then be consistently demonstrated by the board and senior management, and cascaded throughout an organisation.

It is imperative that oversight and controls exist to monitor an entity’s culture.  This involves promoting, monitoring and assessing the impact of culture on conduct and making changes where necessary.

It includes ensuring that there is adequate governance in place to mitigate the risk that staff will benefit from problematic behaviour. A company’s culture should allow for current practices to be tested by all staff, and any poor conduct or practices to be escalated to senior management. Importantly, the board and senior management must be responsive to the matters raised, and transparent in how they are addressed.

ASIC’s focus

Corporate culture is a particular focus for ASIC presently, and we are intending to incorporate concerns around culture into our existing risk-based surveillance reviews. This is particularly the case for companies operating in financial services and credit industries. We also intend to use the findings of surveillances to better understand how culture is driving conduct in the entities we regulate. Where we see bad conduct, we are ready, willing and able to enforce the law.