Boards cannot operate properly without having the right information. And boards do not operate effectively if they do not challenge management.
Two instances examined in evidence can be used to explain and justify those propositions. Both show the importance of a board getting the right information and using it effectively.
3.1.1CBA and AML/CTF
CBA’s internal audit department identified issues with CBA’s compliance with AML/CTF laws in 2013, 2015 and 2016.[1] In each of those years, internal audits gave the issues a ‘red’ rating – the most serious rating available.[2]
In 2016, although the ‘red’ rating was reported to the board’s audit committee, the audit report on which that rating was based was not provided to the committee.[3] Ms Livingstone said that during her time on the audit committee, she could not recall anybody asking for a copy of that audit report, or any other audit report.[4]
The minutes of the meeting at which the ‘red’ rating was reported to the audit committee did not record the committee members challenging management’s assurances that the matter was being dealt with.[5] Ms Livingstone said that at the board meeting in October 2016, she had challenged management about the AML/CTF issues.[6] The minutes of the meeting make no reference to an exchange of that kind.[7] Ms Livingstone said that at the meeting, she did not receive satisfactory answers to her questions, stating:[8]
My judgment as a director at that time was further questioning of that detail would serve little purpose at that time, because it would simply elicit further unsatisfactory answers. What was clear to me was that neither management nor internal audit could articulate the problem that they were trying to solve, let alone identify the root cause of that problem. And, unfortunately, that judgment was borne out by subsequent events.
I cannot say whether other directors held a similar view.
What is clear is that when the audit committee was informed in December 2016 of the third ‘red’ rated audit report for AML/CTF issues, it did not do enough. The committee did not ask to see a copy of the audit report. It did not challenge, or at least adequately challenge, management about why three audit reports for the same issue over four years had all been rated ‘red’, or about management’s assurances that the matter was being dealt with. When asked what the committee did to hold management to account for the failings and require management to fix those failings, Ms Livingstone said:[9]
the discussion … would have been … how long is it going to take and what’s happening, but I think, as is clear from what has happened, those matters were being addressed over time. It was taking too long. And there were always responses, ‘Yes, we’re doing this, yes, we’re spending that money’. So these responses were taken as assurance that the issue was being addressed, but I absolutely accept that … that was an inadequate conclusion on the part of the audit committee and the board.
Ms Livingstone accepted that she and her colleagues on the audit committee did not give sufficient attention to the significant non-financial risks associated with CBA’s failings in relation to AML/CTF. And she accepted that she did not do enough to hold management to account to ensure that the AML/CTF problems were fixed in a timely manner.[10]
3.1.2NAB and adviser service fees
The second example concerned NAB, and its conduct in relation to the charging of adviser service fees to members of superannuation funds.
The relevant subsidiaries of NAB began charging superannuation fund members adviser service fees in 2008 or 2009.[11] In about the middle of 2014, NAB’s subsidiaries began to identify issues with the charging of those fees.[12] Although one of NAB’s subsidiaries reported a significant breach in relation to those issues to ASIC and APRA in December 2014,[13] the issues were not brought to the attention of NAB’s board until August 2015.[14]
When the issues were reported to the board, the information that was provided about them was inadequate. Not enough was done to make it clear that the issues were not new, but were being reported to the board for the first time.[15] Not enough was done to convey to the board the seriousness of the issues, and the fact that ASIC was already engaged in relation to those issues.[16] And not enough was done to make clear to the board the potential consequences of the issues for the business.[17]
Negotiations between NAB and ASIC in relation to the adviser service fees issues dragged on for years. NAB made many proposals to ASIC about how it would investigate the issues and compensate members, and ASIC rejected those proposals – describing them more than once as not being ‘customer centric’.[18] While these negotiations dragged on, NAB was not remediating its customers.
NAB’s board did not do enough to impress upon management the importance of getting the issue resolved, and making an appropriate proposal to ASIC. This was most evident when, in April 2018 – more than three years after issues about adviser service fees were first reported to ASIC – NAB made a proposal to ASIC, a proposal that NAB CEO Mr Andrew Thorburn accepted, with the benefit of hindsight, should not have been made.[19] The proposal prompted a blunt response from ASIC in May 2018:[20]
The proposed resolution set out in your letter fails to adequately reflect any insight into the seriousness of the suspected misconduct, which took place over an extended period of time and affects a substantial number of customers.
…
For a significant period of time, NAB has suggested various remediation methodologies that ASIC has consistently rejected as unacceptable, and the latest proposal retreats even further from what we would expect NAB to consider to be in the interests of its customers.
Dr Henry said that when he read what ASIC wrote, he was ‘appalled’.[21] But, despite that reaction, it still took NAB until September 2018 to agree a position with ASIC about the remediation of some of its customers. Even as late as November 2018 (when NAB’s Chair and CEO were to give evidence to the Commission) NAB had not agreed with ASIC what NAB would do in relation to the customers of its aligned licensees.[22]
It is plainly not the role of the board to review every piece of correspondence that goes out the door. But it is the role of the board to be aware of significant matters arising within the business, and to set the strategic direction of the business in relation to those matters. When management is acting in a way that is delaying the remediation of customers, and damaging the bank’s relationship with regulators, it is appropriate for the board to intervene and say, ‘Enough is enough. Fix this, and fix it now’.
Dr Henry would go no further than saying that he wished NAB’s board had stepped in sooner.[23] In my view, it is clear that NAB’s board should have acted sooner to impress on management the importance of resolving this issue quickly, and resolving it in a way that was in the interests of NAB’s customers.
3.1.3What the examples show
Boards must have the right information in order to discharge their functions. In particular, boards must have the right information in order to challenge management on important issues including issues about breaches of law and standards of conduct, and issues that may give rise to poor outcomes for customers. Without the right information a board cannot discharge its functions effectively.
When I refer to boards having the right information, I am not referring to boards having more information. As I noted earlier, it is the quality, not the quantity, of information that must increase. Often, improving the quality of information given to boards will require giving directors less material and more information.
I do not pretend to be able to offer any single answer to how boards can ensure that they receive the right information. But boards and management must keep considering how to present information about the right issues, in the right way.
Boards must also use the information that they have to hold management to account. Boards cannot, and must not, involve themselves in the day-to-day management of the corporation. Nothing in this Report should be taken to suggest that they should. The task of the board is overall superintendence of the company, not its day-to-day management. But an integral part of that task is being able and willing to challenge management on key issues, and doing that whenever necessary.
The two examples I have given are both instances where the board did not have the information necessary to challenge management effectively; did not seek out that information; and did not do enough to challenge management about serious issues that had the ability to affect the interests of the banks’ customers, the banks’ relationships with regulators, and the reputation of the bank more broadly.
[1] Transcript, Catherine Livingstone, 20 November 2018, 6697.
[2] Transcript, Catherine Livingstone, 20 November 2018, 6697.
[3] Transcript, Catherine Livingstone, 20 November 2018, 6702.
[4] Transcript, Catherine Livingstone, 20 November 2018, 6702.
[5] Transcript, Catherine Livingstone, 20 November 2018, 6707–8.
[6] Transcript, Catherine Livingstone, 21 November 2018, 6727–8.
[7] Transcript, Catherine Livingstone, 21 November 2018, 6730.
[8] Transcript, Catherine Livingstone, 21 November 2018, 6727–8.
[9] Transcript, Catherine Livingstone, 20 November 2018, 6708.
[10] Transcript, Catherine Livingstone, 20 November 2018, 6709.
[11] Transcript, Kenneth Henry, 27 November 2018, 7121.
[12] Transcript, Kenneth Henry, 27 November 2018, 7121.
[13] Transcript, Kenneth Henry, 27 November 2018, 7121.
[14] Transcript, Kenneth Henry, 27 November 2018, 7127.
[15] Transcript, Kenneth Henry, 27 November 2018, 7128.
[16] Transcript, Kenneth Henry, 27 November 2018, 7129.
[17] Transcript, Kenneth Henry, 27 November 2018, 7131–2.
[18] See Transcript, Kenneth Henry, 27 November 2018, 7160.
[19] Transcript, Andrew Thorburn, 26 November 2018, 7078.
[20] Exhibit 5.77, 9 May 2018, Letter from ASIC to Cook and Smith, 1–2.
[21] Transcript, Kenneth Henry, 27 November 2018, 7162.
[22] Transcript, Kenneth Henry, 27 November 2018, 7165.
[23] Transcript, Kenneth Henry, 27 November 2018, 7166.