The best run organisations, just like communities and families, are those which have an open culture where problems are identified and brought into the open quickly so they can be dealt with – a culture which is not about the fear of reprisals or seeking to apportion blame, but which seeks positively to make the best of an imperfect world.

“A poor compliance culture meaning that deficiencies were not identified, escalated and remedied in a timely and efficient manner.”

Culture is important in a formal legal sense and in a practical sense. In the legal sense a corporation’s culture provides a way of proving the intention of the company to breach the law for the purpose of establishing guilt for offences against Commonwealth legislation.Much time and effort goes into building protocols that evidence that appropriate steps are taken to mitigate the possible legal risks associated with most corporate activity.

The organisations culture is also taken into account by the legal process when consideration is being given to the amount of the monetary penalty in civil penalty cases.

In a practical sense, culture is the glue that sticks everything else together. We have our policy statements, our corporate protocols, compliance manuals and checklists and induction/general training programs. These things are the “compliance activities” or “procedural compliance”.

If ASIC is to come calling, most licensees have (or should have) lots of documents that together establish their compliance frameworks. Procedural compliance is important but on it’s own only a part of the solution. Indeed, in many organisations they slavishly focus on building nice new shiny policies and procedures that no-one follows as the substance of the ‘compliance’ is considered more important than the means or degree of execution.

However, if we come to the attention of a regulator or if a client sues us for poor advice, it is likely to be because of some action or inaction. We refer to this as behavioural compliance.

At the end of the day the procedures are just tools to help provide evidence that a protocol existed and was followed. The glue that binds the procedural compliance to the behavioural

compliance is the culture. If the culture is poor, the procedures are ineffective or, in the words of Corporal Benjamin-Roberts Smith: “Culture beats strategy every time”.

Now when your life depends on the behaviours of your colleagues it sharpens the process as there is more at risk.

So with the Commonwealth Financial Planning ‘culture’ splashed all over the media we have a tailor made case study of why procedural compliance cannot of itself protect an organisation from the myriad of risks that exist in modern financial services enterprises.

There is every reason to believe that Commonwealth Financial Planning had shiny policies and procedures addressing the majority of the activities of the financial planning enterprise and the various layers of staff. There is also the added incentive that ASIC was aware of a number of the shortcomings within CFP and had been closely involved in issuing an Enforceable Undertaking and banning a number of the CFP planners. To top it off the ‘problems’ had been visible for a period of at least 4 years – even the prior CEO Ralph Norris has publicly acknowledged that there had been issues in the CFP division under his watch which ended in 2011.

So logic dictates that the alarm bells should have been ringing – long and loudly -and the risks presented by the CFP business were a regular topic at the CBA Board – either directly or through feedback from the project team running the enforceable undertaking workout.Throw into the mix that ASIC and the public had started to become aware of the sensitivities and conflicts of a vertically integrated business model and you have to wonder was someone asleep at the wheel!.

In this day and age where social media controls the attention of so many – reputational risk is by far the greatest corporate risk any enterprise can face. Why CBA allowed the Financial Planning issues to develop into such a maelstrom I cannot fathom – however it does reinforce the theme of this article. The behavioural compliance culture that existed when the majority of problems occured was weak and there was insufficient compliance controls around the practices of the individual advisors. The cultural glue was weak at that point in time but whilst there was work done on the procedural compliance to rectify process matters the behavioural compliance did not receive the same degree of attention – with the end result being another round of failures occured. This latest round of failures has ended up splashed across the media with incalculable

Had CBA better understood the culture that pervaded the Financial Planning unit could they have avoided the current internal impacts and the media storm? – the answer would have to be absolutely although the behavioural compliance does fluctuate under different management regimes.

So the gap between expectations on the level of behavioural compliance and the reality on how behavioural compliance is actually being played out within an organisation is something that the Board should have a feel for.

As a means of assessing whether there is a gap between expectations of behavioural compliance and the reality of the scale of application of the required behavioural requirements Governance Worx has teamed up with The Indelible Link to develop a diagnostic tool. We are presently working on the prototype within a live corproate environment with the output being a presentation to the Board identifying the presence and scale of the actual behavioural compliance culture.

If you would like to know more about this diagnostic service and how it may help better inform your organisation on the level of Culture Risk please contact Philip Anthon Managing Director on 0429877470.