Introduction
I would like to begin by thanking the Global Association of Risk Professionals for the opportunity to speak at this Risk Convention.1 As a bank supervisor, I am obviously very interested in the topics of risk management and risk measurement. An important part of my job is to interact with the financial industry to better understand the issues you face and how we can work collaboratively toward our shared objective of promoting sustainable financial intermediation and a safe, sound, and stable banking and financial system.
As risk professionals, you are all steeped in the intricacies of risk management and risk measurement. Value-at-risk, the three-lines-of-defense model, and controls and testing frameworks are second nature. This is particularly true when we talk about the most familiar and well-studied financial risks such as credit, market, and liquidity risk, and even non-financial risks such as operational, compliance, and legal risk.
We all acknowledge the critical importance of these issues, but today I will talk about misconduct risk and the need to develop a healthy corporate culture to mitigate it. I’ll focus on the importance of addressing these issues from multiple perspectives including those of boards of directors, senior management, industry groups, and the official sector. This topic might be less familiar to some—the terms are newer and the assessment frameworks are less developed—but I believe it is critically important. Both the official sector and many of your firms have put considerable emphasis on improving corporate cultures and reducing misconduct risk, but we continue to see striking cases of misconduct both in the U.S. and abroad. Clearly, more needs to be done.
Many of the insights I will share today are drawn from interactions with industry participants and members of the official sector through outreach and industry conferences and workshops on the topic, including events hosted by the Federal Reserve Bank of New York.2 I am confident that continued commitment and collaboration will contribute to better outcomes in this vital area.
Before proceeding, I’ll emphasize that I am speaking for myself and not the Federal Reserve Bank of New York or the Federal Reserve System.
Influencing Culture from Multiple Perspectives
Prudent risk management is a fundamental aspect of the business of banking, which means it is a critical factor in the effective oversight of banks. Supervisors focus on financial resilience by requiring firms to maintain sufficient capital and liquidity and emphasize operational resilience by promoting effective corporate governance, risk management, and recovery planning.3 In my view, misconduct risk—defined as the potential for behaviors or business practices that are illegal, unethical, or contrary to a firm’s stated beliefs, values, policies, and procedures—is an integral part of an effective risk management framework. Bad conduct threatens a firm’s resiliency by diverting management attention, harming a firm’s reputation, depleting a firm’s capital, and affecting the composition of its workforce.4
To further develop this idea, the team working on this at the New York Fed introduced the concept of a firm’s “cultural capital,” which is a type of intangible asset that impacts what a firm produces and how it operates. It is analogous to physical capital, like equipment, buildings and property, or to human capital, like the accumulated knowledge and skills of workers, or to reputational capital, like the franchise value or brand recognition. This is an intangible asset, so we generally feel the impact rather than see the thing itself. Nonetheless, I believe a firm’s cultural capital can be measured, assessed, and ultimately impacted in ways that can improve outcomes and enhance a firm’s resiliency.
In a firm with a high level of cultural capital, for example, misconduct risk is low and observed structures, processes, formal incentives, and desired business outcomes are consistent with the firm’s stated values and risk appetite. Unspoken patterns of behavior reinforce this alignment. Problems are escalated to senior managers routinely, as employees feel empowered to raise their hands and believe that their efforts will result in meaningful responses. And senior leaders advance through the organization because, in addition to strong business performance, they set a credible tone from above by modeling behaviors consistent with the firm’s values.
By contrast, in firms with low levels of cultural capital, formal policies and procedures do not reflect “the way things are really done.” Misconduct results from the norms and pressures that drive individuals to make decisions that are not aligned with the values, business strategies, and risk appetite set by the board and senior leaders. Employees do not speak freely when they have concerns, and directors and senior managers do not find out about improper conduct until it is uncovered by the authorities. Rules may be followed to the letter, but not in spirit. All of this increases misconduct risk and potentially damages the firm and the industry over time.
To be clear, I am not saying this is easy. Culture is difficult to assess because it is not a single, point-in-time metric, but a multi-dimensional concept with different implications for different parts of an organization. This complexity suggests that no single metric, solution, approach, or template will work for every firm in every circumstance.5
Consider the different roles of key players in mitigating misconduct risk and building and sustaining a healthy culture. The board of directors, senior management, staff, investors, industry groups, and the official sector might all see and assess aspects of a firm’s culture differently. Today, I will focus on a few of these stakeholders.
Boards of Directors
In 2017, the New York Fed hosted a culture measurement workshop that included a panel of board members from various financial firms. There was consensus among the panelists that board members play a critical role in a firm’s governance structure and culture. Moreover, corporate boards independently assess whether management is setting the right tone and hold management accountable for any gaps between a firm’s values and its actual business practices. Proposed guidance from the Federal Reserve suggests that the responsibilities of an effective board of directors include setting strategy and risk tolerance, supporting independent risk management, managing information flows, ensuring appropriate expertise, and holding senior management accountable for effective execution.6
Behavioral indicators can help boards understand their firms’ cultures and identify potential trouble spots within the organization. Corporate boards use various methods to obtain information and assess culture, such as meeting with many levels of employees, receiving third-party assessments, and conducting 360 reviews of the CEO and top leaders. Organizations like the U.K. Banking Standards Board (BSB) can provide outside benchmarking data against which to measure the culture within one’s own firm. 7 Corporate boards for financial firms may also import practices and lessons from other industries. Finally, the board members that participated in the New York Fed’s workshop agreed that a board’s own culture matters; it needs independent voices, diverse perspectives, and opportunity for debate.
Senior Management
The Federal Reserve published a proposal on corporate governance that states that senior management is responsible for the execution of strategy and day-to-day operations consistent with the firm’s stated risk appetite, ensuring safety and soundness, overseeing business lines and risk management, and ensuring compliance with internal policy, procedures, regulations and laws.8 Development of a firm’s cultural capital links directly to these core responsibilities and is evidenced by behavior throughout the firm.
To address these concerns and build cultural capital, some firms have established culture and conduct committees or groups that meet regularly to review cultural indicators and assessment efforts. Providing these groups with sufficient stature, developing the proper infrastructure to support them, and defining clear roles and responsibilities are essential for success. It is critical that there is alignment between the board, senior management, and middle and lower management on issues of conduct and culture, as employees take cues from their direct managers even more than the tone from the top.
The performance management framework established by senior management sets powerful incentives to influence conduct and culture within a firm.9 Financial incentives, however, are not the only drivers of culture and conduct. Employees alter their behavior based on a variety of formal and informal, intrinsic and extrinsic motivations. Intrinsic motivations could include growth opportunities, independence, power, and social factors, while extrinsic motivations could include pay, benefits, profit sharing, or other forms of awards.10 With this range of motivating factors and the impact they have on the culture in mind, a number of firms have integrated “how” factors into an employee’s performance evaluations by assessing the methods used to achieve a performance goal alongside the “what” components such as contributing to their group’s financial performance.
Industry Benchmarking
Another perspective is from the industry as a whole. I think we can gain important insights by looking across the financial industry, identifying best practices, and understanding what approaches are most effective in positively influencing conduct and culture. Conferences and workshops like those hosted regularly by the New York Fed and others can help. In addition, standardized metrics and indicators can provide insights when assessing changes over time and across firms.
The BSB, for example, provides one lens on assessing culture change for a broad cross-section of financial services firms operating in the U.K.11 Each firm participating in the survey has the ability to see its outcomes relative to others and the industry average. This type of industry-wide assessment gives firms insight into areas they can individually focus on, as well as areas they may want to address as an industry.
The U.K. is not alone in this approach. In December 2017, the chief executives of the five main retail banks in Ireland informed the Department of Finance of their intention to establish an Irish Banking Standards Board.12
In the U.S., the idea of industry benchmarking has been raised and discussed in the past, but no industry action has emerged to move this idea forward. At the New York Fed’s workshop on culture measurement and assessment, several participants recommended either joining the BSB’s benchmarking survey or creating a similar U.S. organization.13 Some noted that it would be helpful to include non-banks in the effort, and to collaborate with other corporations that have experience building strong cultures. Participants also discussed the importance of sharing “lessons learned” and developing best practices as an industry. In my view, these types of industry-led initiatives can offer useful insights as firms compare and contrast their efforts and outcomes with peers.
Official Sector
A final perspective is that of the official sector. In my view, there is a clear role that follows the traditional focus on prudent risk management and the goal of building resilience. This reflects both the direct impact to firms mentioned above and the potential for industry-wide spillover if conduct and performance issues at one firm cause customers, counterparties, and investors to lose trust in the industry as a whole. This type of spillover suggests a role for the official sector to coordinate efforts and push the industry forward.
To be clear, it is not the role of the official sector to set the internal culture of a firm—that responsibility lies squarely with the board of directors and senior management. Rather, the job of the official sector is to promote standards and practices that will mitigate misconduct risk and promote efficient and sustained financial intermediation and financial stability.
Global supervisors have taken a number of approaches when it comes to understanding, influencing, and assessing culture at firms. In the whitepaper I mentioned earlier, my New York Fed colleagues and I included a section describing a selection of approaches that the official sector has employed. The Financial Stability Board Working Group on Governance Frameworks (FSB WGGF) has published a range of tools for supervisors to use in assessing firms’ management of cultural drivers of misconduct, as well as a summary of supervisory approaches and practices in supervising for culture.14 This variation reflects differences in mandates, tools, and authority. Looking across jurisdictions, we see supervisory efforts such as specialized units of behavioral experts, risk culture assessment frameworks, and supervisory guidance that directs supervised institutions to develop and promote a sound corporate culture.
This variation in approach is a valuable feature of the official sector focus on conduct and culture reform. As the official sector innovates, experiments, and introduces new approaches, we’ll develop a better understanding of how to best promote a healthy culture and mitigate misconduct risk.
Measurement and Assessment
I’ll now turn to the question of measurement and assessment. As all risk managers know, you can’t manage what you can’t measure. This is equally true in the area of misconduct risk. At the same time, while hard data is important, I don’t believe it is sufficient to convey all of the complexities of a firm’s culture or all of the ways it can impact business outcomes.
In recent years, we have seen firms develop dashboards that seek to bring together various metrics from across their organization. This is an important and necessary step. Data sources that we’ve seen include internal quantitative information such as compliance and policy violations, completed trainings, audit results, and risk metrics like limit breaches, policy violations and external metrics like customer complaints, stakeholder perceptions, and client surveys. There also are qualitative data based on employee surveys. Some firms have begun to do more frequent pulse surveys with small cohorts of staff. Other firms have found that long-term trends are more insightful than short term changes.
These types of data, while necessary, are not sufficient to make progress. Supplementing hard data with interviews, focus groups, dialogue, and external benchmarking can greatly enhance an organization’s ability to manage and strengthen its culture. Measurement and metrics are best used as a starting point to spur further analysis and probing as boards and senior management seek to identify trouble spots and build strong cultures.
As we continue to see the impact of technology and big data in other parts of financial services, one interesting question is how innovation and enhanced technology will support the measurement and management of culture. The potential of big data analytics to revolutionize approaches in many areas of business has been talked about for years, and is now beginning to become a reality. For example, we might see firms routinely leverage broader data to make stronger predictions about potential misconduct risk, which could be useful to help focus scarce compliance resources.
Some may view the official sector as an impediment to the adoption of new technologies, but I don’t think that needs to be the case. In the context of compliance risk management in the U.S., the five federal banking agencies recently encouraged financial firms to explore innovative approaches to meet their compliance obligations related to money laundering and further strengthen the industry against illicit activity.15
Similarly, in the U.K., Rob Gruppetta, head of the Financial Crime Department at the Financial Conduct Authority, has spoken about the “balancing act” the FCA faces as a regulator trying to encourage progress and innovation while also mitigating danger and imprudent risk-taking. He points out that data from new technologies has also allowed the FCA to be more consistent, effective, and risk-based in its supervisory approach toward conduct risk.16 This leads to a question about how firms can use similar tools and techniques to mitigate misconduct risk and promote healthy cultures.
As with any innovation and application of new technology, critical questions are emerging. For example, reliance on complex algorithms or machine learning tools raises issues around “explainability” and a clear audit trail. Lawyers will inevitably opine on a variety of issues, including data protection and privacy. Beyond strictly legal issues, firms will have to wrestle with questions about fundamental fairness and the consequences that techniques perceived as unduly intrusive and untrusting may have on employee morale and industry retention. As new technologies spread and their use grows in areas related to compliance and internal assessments, we will need to confront these issues.
Conclusions
To conclude, the culture of a financial firm, and of the industry as a whole, is a complex phenomenon that is not easy to measure or manage. Collectively, however, we must not ignore this issue.
Looking ahead, members of the financial industry with different roles and perspectives can each take practical steps to move this dialogue forward. Financial firms should continue to develop and implement programs to build cultural capital, with directors, senior management, and staff each having distinct responsibilities and perspectives. Supervisors around the globe should remain committed to staying up-to-date on industry advances while continuing to develop and implement innovative supervisory approaches. We should continue to collaborate with the industry, the academic community, and other parts of the official sector. We should continue to monitor progress on industry benchmarking as more jurisdictions take up these efforts. And, perhaps most importantly, we should continue to engage in discussions like this one, so we work together to identify lessons learned and best practices as we pursue our common goals of a safe, sound, and stable banking system.
I think we should be optimistic that with the right tools and technology, the right level of commitment, and the right people at the table, we can build cultural capital and mitigate misconduct risk. We all have a role to play in mobilizing our organizations to advance this critical work.
Thank you for your attention.
