Australian institutions ‘unwilling or unable’ to address risk failings face supervisory action: APRA

The warning to Australian financial institutions came after the APRA published an information paper last month that provides a snapshot of current practice in risk culture in a range of banking, insurance and superannuation businesses. The APRA said risk culture is the “influence of organisational culture” on how risks are managed in an organisation. The regulator said risk culture is defined as how staff identify, understand, discuss and act on the risks that an organisation confronts and takes. “All organisations have a risk culture, regardless of whether it is actively considered or managed,” said the APRA. The supervisory body added that there has clearly been a stronger focus on risk culture in recent years among APRA-regulated institutions. But it added that “continued effort and ongoing attention” is required by institutions to better understand and manage their risk cultures. The APRA began its information gathering exercise about industry practices on risk culture in late 2015.hideThe paper, released last month, concludes that approaches to understand and manage risk culture are at a relatively early stage of development; and many Australian institutions are grappling with how best to clearly articulate what type of risk culture they aspire to, identify any specific weaknesses in their current risk culture and effectively address those weaknesses. The APRA said its Prudential Standard CPS 220 Risk Management, which came into effect on 1 January 2015, underpinned much of its work. CPS 220 requires each board of an authorised deposit-taking institution (ADI) or insurer, to form a view of the risk culture in their institution, identify any desirable changes to that risk culture and ensure the institution takes steps to address those changes, explained the APRA. APRA chairman Wayne Byres said that, although the findings released last month show there has been a “welcome focus” on the improvement of risk culture in recent years, it is critical that industry sustains its focus on strengthening risk culture. “It’s the responsibility of each institution’s leadership – led by their CEO and supported by their board of directors – to ensure they have a sound risk culture that supports its ability to operate in accordance with its strategy and risk appetite. This is not an easy task but nonetheless, it is critically important for an institution’s long-run health,” Mr Byres said. He added: “The APRA cannot regulate sound risk culture into existence. However, the APRA will apply greater supervisory intensity to institutions that are either unwilling or unable to address behaviours that are inconsistent with prudent risk management practices.” The regulator promised that it will also continue to work to identify practices that are associated with sound, and less sound, risk cultures, and share these observations with regulated institutions and other stakeholders. “As part of its increased focus in this area, the APRA will also commence a review of remuneration policies and practices among its regulated institutions and examine how these interact with risk culture,” it stated. Risk managers often complain that they are isolated within the organisations that they work for and that line and senior management fail to take ownership of the risks within their business. The very existence of the risk management job function all too often seems to provide business managers with a get-out clause, which enables them to pursue revenue targets and leave the risk management of those activities they have pursued up to the risk manager. This clearly should not be the case. Risk managers are the facilitators of risk management – individuals whose role is to advise and assist fellow managers to identify, quantify, manage and transfer the business risks that they face – and not the owners of these risks. The APRA clearly understands this fact as it asked the question: Who is responsible for the risk culture of an organisation? The answer it provided was: “It is ultimately the responsibility of each APRA-regulated institution’s CEO and senior executives to establish a sound risk culture, supported and overseen by [its] board of directors.” Other findings from APRA’s information-gathering exercise on risk culture are: Most APRA-regulated institutions’ efforts have focused on understanding and assessing the current state of risk culture Less progress has been made to define a target state of risk culture Approaches to understand and manage risk culture vary by institutional size, business mix and complexity Larger institutions noted that their size and complexity introduced additional challenges, particularly regarding the greater prevalence of sub-cultures; their efforts were therefore often segmented, typically by geography or business unit All institutions were in agreement on the central role of leadership in shaping and driving both organisational and risk culture. So the big question for Australian financial instutions is: what action will the APRA take against its regulated institutions that it decides portray poor risk cultures? “APRA’s existing requirements on risk management (Prudential Standard CPS 220 Risk Management) require boards of ADIs and insurers to form a view of the risk culture in the institution, identify any desirable changes to risk culture and ensure the institution takes steps to address those changes. The APRA will apply greater supervisory intensity to institutions that are either unwilling or unable to address behaviours that are inconsistent with prudent risk management practices,” it stated. Remuneration of staff and directors at financial institutions is also a key factor in the development of an effective risk management culture, stated APRA. It said that frameworks and the “outcomes” they produce, are important barometers and influencers of risk culture. The APRA said it intends to review current industry remuneration policies and practices to gauge how well existing requirements in its Prudential Standard CPS 510 Governance are being implemented, and how they are interacting with the risk cultures of regulated institutions. “This will include reviewing the remuneration arrangements and outcomes for some senior executives, risk and control staff, and material risk takers at a sample of institutions,” promised the APRA. Meanwhile, the Australian Securities and Investments Commission (ASIC) has warned that it will keep a close eye on signs of “excessive risk culture” in the financial sector. The Australian government has committed to provide some $121.3m during the next four years to help improve surveillance capabilities, according to the regulator’s recently published annual report. “Our work in [this financial year] will continue to focus on culture as a key driver of gatekeeper conduct,” said ASIC chairman Greg Medcraft. “A positive culture – at both firm and industry level – is central to investor trust and confidence. The additional funding support over the next four years…will enable us to expand our abilities as a law-enforcement agency to better detect, understand and respond to misconduct,” he continued. “It will also allow us to take on more proactive surveillances at both the individual firm and industry level – within the financial advice, superannuation and managed funds, credit and insurance sectors,” added Mr Medcraft. ASIC revealed that it will set aside about $57m to improve and intensify its enforcement and monitoring activities on financial advice, life insurance, breach reporting and responsible lending. The regulator reportedly completed more than 150 “high intensity” surveillances of the insurance, consumer banking and consumer credit sectors last financial year. Some 75 cases featured failures to comply with conduct obligations. “It is critical that lenders and insurers do not put consumers into unsuitable products that could put them at risk of experiencing substantial financial hardship and undermine investor and consumer trust and confidence in the financial system,” stated ASIC.

Australian institutions ‘unwilling or unable’ to address risk failings face supervisory action: APRA

Want to read this article?

Read Next

Swedish risk managers told to focus on flexibility rather than resilience

European Parliament votes for ‘hard-fought compromise’ on CSDDD

Rates fall in most regions during Q1 but rise in Europe and US: Marsh

Chubb says Q1 saw ‘best rates’ as it books $2bn profit

Property risk and flood mapping platform expands to Europe

Swedish risk managers told to focus on flexibility rather than resilience

European Parliament votes for ‘hard-fought compromise’ on CSDDD

Rates fall in most regions during Q1 but rise in Europe and US: Marsh

Chubb says Q1 saw ‘best rates’ as it books $2bn profit

Property risk and flood mapping platform expands to Europe

Want to read this article?

Read Next

Swedish risk managers told to focus on flexibility rather than resilience

European Parliament votes for ‘hard-fought compromise’ on CSDDD

Rates fall in most regions during Q1 but rise in Europe and US: Marsh

Chubb says Q1 saw ‘best rates’ as it books $2bn profit

Property risk and flood mapping platform expands to Europe

Related Articles