Culture: why does it matter?
Financial services regulators are in little doubt as to the effects of poor culture in firms.
Andrew Bulley - Partner - Centre for Regulatory Strategy - Deloitte
Stephen Gould - Director - Risk Advisory - Deloitte
Orla Hurst - Senior Manager - Centre for Regulatory Strategy - Deloitte
Published on 5 February 2019
As Jonathan Davidson, of the UK’s Financial Conduct Authority (FCA) has commented, “culture in financial services is widely accepted as a key root cause of the major conduct failings that have occurred within the industry in recent history, causing harm to both customers and the market”. Accordingly, regulators now attach significant importance to the issue of culture and expect boards and senior management to take responsibility for establishing the right culture within firms and exert strong proactive leadership in delivering it.
What is culture?
Culture is a subjective and intangible concept. Common definitions of culture generally revolve around the ideas, customs, attitudes, and behaviors of people or groups of people. We at Deloitte think that culture in financial services firms is best understood as the combination of forces, including particularly the shared values, experiences, attitudes, and biases that drive the behavior and mindset of employees, and influence their approach to all aspects of their organization’s business. For example, its governance, risk management, and control and operational systems. As Deloitte’s recent paper on culture observes, for supervisors, a firm’s culture permeates all aspects of its business, from its attitude to risk-taking to its treatment of its customers and the development, sales, and review of its products and services.
Why firms need to treat culture as a priority
Having concluded that culture was at the root of the financial and conduct failure cases they have had to deal with in recent decades, financial services regulators around the world are increasingly looking to assess, monitor, and influence the culture within firms. Whilst it has been a longstanding priority in the Netherlands and the UK, regulators in other jurisdictions, including the Monetary Authority of Singapore (MAS), BaFin and the Irish Central Bank, are intensifying their focus on culture, through targeted assessments, “business as usual” supervision, or specific regulatory initiatives. Firm culture is also a major focus in Australia with the ongoing Royal Commission into misconduct in banking and financial services.
Even where processes and controls may not be a concern in themselves, regulators take the view that serious or systemic cultural failings have the potential to defeat any control environment and so have to be tackled if bad supervisory outcomes are to be avoided. In parallel, and to help secure an enduring shift in firms’ culture, the regulatory appetite for greater accountability is growing. The most widely known regime is, perhaps, the UK’s Senior Managers and Certification Regime (SM&CR), which seeks to encourage a culture of personal responsibility at all levels of the firm and prescribes specific responsibilities to senior managers for adopting and leading the right culture within banks and insurance providers.
The SM&CR approach is being broadly replicated in other jurisdictions. Following a program of cultural assessments in Ireland’s banking sector, the Irish Central Bank has proposed the introduction of an Individual Accountability Framework (IAF) which promises to go “significantly beyond current requirements”. Further afield, in Australia and Hong Kong, regulators have also introduced accountability regimes. To prepare themselves for a shift towards greater accountability, firms should look to clarify and document the roles and responsibilities of senior managers and other key individuals and communicate their expectations as regards accountability and conduct at all levels of the firm.
As part of their overall assessment of firm culture, supervisors are also sharpening their scrutiny of firms’ approach to diversity and inclusion. They want to ensure that boards are not dominated by one or two individuals and that key decisions are subject to rigorous collective debate and challenge. To guard against “group think”, but also “tokenism”, firms will be expected to ensure that the board and the executive team, together with the succession “pipeline”, are composed of individuals with a range of meaningfully diverse backgrounds, experiences, and outlooks.
The wider benefits of improved culture
Promoting and instilling the right culture makes sound commercial as well as regulatory sense. Firms that target and achieve positive cultural outcomes are likely to be more trustworthy and thus more appealing to customers and employees alike. Conversely, a culture that fails to consider the impact of their actions on staff, customers, and the market, risks the firm’s long-term future as well as supervisory scrutiny and censure in the short term.
Deloitte’s Trust Index 2018 has found that in order to rebuild trust, firms need to demonstrate a number of key cultural and behavioral traits. These include a commitment to keeping promises and developing products and services that are closely aligned with customers’ interests.
Measuring and monitoring culture
Supervisors will ultimately look to boards and senior managers to exert strong leadership for establishing and overseeing the right culture. Accordingly, the question of how to measure and monitor culture is of high importance.
To help firms meet this challenge, Deloitte has developed Culture Conscious, a survey-driven tool that helps firms perform rapid and repeatable risk culture assessment [or cultural assessments as it related to risk management, conduct and compliance], including benchmarking. It is based on the industry-proven risk culture indicators in our proprietary RiskCulture Assessment Framework. Culture Conscious assesses riskculture through two complementary mechanisms: firstly, feedback can be gathered, for example from a firm’s employees, and aggregated to form a picture of riskculture across different populations within the firm, providing, amongst other things, a profile of positive and negative culture “hotspots”. Secondly, for the identified hotspots, further and targeted information can be gathered on the “drivers” and “root causes” of culture.
Deloitte’s Risk Culture Assessment Framework
Both of these mechanisms can be used to produce valuable Management Information (MI) that boards—and supervisors—can use to assess and monitor culture, using evidence gathered on behaviors, mindsets, and the effectiveness of management initiatives in areas such as succession, motivation, organization and governance, competence, communications, challenge and broader relationships.
Cultural assessments can also be benchmarked, helping boards to identify, and transition towards, their desired culture and to understand how they compare with both peers and firms in other sectors.
Given the clear regulatory direction of travel on culture, and the competitive advantages to be gained from getting organizational culture right, financial services boards will need to demonstrate that they are working concertedly to establish the right culture and disseminate it throughout the firm. In practice, achieving sustained changes in culture—along with corresponding changes in behavior and mindset—is complex, and takes time, effort, and persistence from senior leaders. Supervisors will not expect overnight results, but they will expect boards to be able to demonstrate, including through effective MI, that they have defined and communicated their firm’s target culture, linked to a clear sense of the firm’s purpose; are monitoring closely whether desired behaviors are in evidence throughout all levels of the organization; and are taking prompt remedial action to address any shortcomings.
Culture in financial services
Senior regulators globally have emphasised the necessity of establishing the right culture within financial services firms. But it is much less clear how front line supervisors assess the culture of a firm and reach decisions on whether any problems identified are sufficient to justify intervention.
Deloitte refers to one or more of Deloitte Touche Tohmatsu Limited, a UK private company limited by guarantee (“DTTL”), its network of member firms, and their related entities. DTTL and each of its member firms are legally separate and independent entities. DTTL (also referred to as “Deloitte Global”) does not provide services to clients. Please see www.deloitte.com/about to learn more about our global network of member firms.