The Final Report from the Royal Commission features 76 recommendations stemming from four key observations:
- the connection between conduct and reward;
- the asymmetry of power and information between financial services entities and their customers;
- the effect of conflicts between duty and interest; and
- holding entities to account.
The central task of the Royal Commission was not only to inquire into whether the behaviour of any financial services entities might have amounted to misconduct, but crucially, whether any conduct or business activities fell below community standards and expectations.
The Royal Commission found that across the financial services sector there were numerous lapses in judgement and behaviour which ultimately stemmed from poor culture, leadership and governance. Culture in particular is one of the hardest aspects of an organisation to audit; and it is so often the root cause of corporate scandals. However, as highlighted by the G30’s report on banking conduct, getting culture and conduct right is not a just supervisory requirement, but is key to banking and economic sustainability.
In light of the important role organisational culture played in fuelling the failures that were revealed during the hearings, financial services organisations are likely as a result of Recommendation 5.6 to be required to, as often reasonably possible, assess their own entity’s culture. It is therefore timely that financial services organisations and other regulated entities consider how to not only meet the requirements prescribed by this Royal Commission but also to identify and address ethical and cultural issues before they land the organisation in trouble with regulatory authorities or the community.
Organisational culture: what is it?
Organisational culture, as described by McKinsey, starts with what people do and how they do it. It represents the attitudes and beliefs of employees and the way the ‘tone from the top’ is established and directly and indirectly communicated to employees.
In the case of the Royal Commission, the culture that led to many of the failings recounted in the hearings put the interests of the organisation or the employee ahead of those of the customer. While culture is intangible, in high performing organisations it is often part of their success. A supportive and open culture, where management encourages transparency and can listen to bad news from staff without judgement, gives employees confidence to speak up when something is wrong, and empowers them to behave ethically.
Assessing organisational culture
An assessment of organisational culture can provide significant insight into the organisation’s DNA and pinpoint practices that are inconsistent with the organisation’s values. While your Board is ultimately responsible for the promotion and oversight of corporate culture, internal audit can act as its eyes and ears, and is uniquely placed to advise on whether the culture is sound, and offer recommendations where required. Nevertheless, assessing organisational culture is challenging as it is inherently intangible. Hard data is also likely to be limited, meaning conclusions may be subjective and open to challenge by the Board and management.
However, there are some aspects of an organisation’s culture that are easier to observe and therefore assess, such as the behaviours engendered by the organisation’s Key Performance Indicators (KPIs) and employee incentives. The Final Report of the Royal Commission found that employees were rewarded for meeting sales targets, regardless of the fact that the products they sold were not in the customer’s best interest. Other tangible factors include the way organisations identify, manage and resolve customer complaints, compliance breaches and operational issues. These can provide both insight into the preparedness of employees to ‘speak-up’ and how robust its culture of continuous improvement is. Equally, how the ‘tone from the top’ within the organisation is established, be that via direct communications to managers and employees or the expectations set within key policies, also says a lot about the organisation’s leadership and strategic direction. As well as this, assessing the corporate values and how these are instilled and upheld within the organisation provides valuable insight for the internal auditor.
The single engagement
Some organisations choose to a single focused engagement to understand their culture, which can be used prospectively as a benchmark to assess progress. This can be helpful where an organisation is initially seeking to understand their culture. This style of audit uses a combination of interviews with selected groups of employees and an employee survey to identify both positive and negative employee behaviours.
Success drivers: Determining an adequate number of employees to interview and the organisation’s preparedness to reflect on feedback to identify opportunities for improvement. Clarity about the culture the Board and executive are seeking to establish.
Benefit: Gives deep insight into organisational culture in a relative short period of time.
Outcome: The organisation needs to be sufficiently experienced to consider the findings and where necessary divert resources and management’s time to any major behavioural issues identified.
Incorporating an assessment into your internal audit program
For other organisations, incorporating an assessment of their culture into each audit can be more effective. The internal audit team will observe and assess organisational culture and collect individual pieces of evidence through each engagement.
Success driver: commitment to a series of engagements over time.
Benefit: a comparative analysis identifies behaviours that are isolated to particular business units and those that cut across the organisation.
Outcome: the results can be used to adjust the audit program in light of significant findings and presented holistically to the Audit Committee and management for their consideration and input.
While many of the recommendations in the Final Report are specific to the financial services sector, the issues of systemic customer complaints and poor corporate practices are all too familiar to companies in other industry sectors such as energy, telecommunications and aged care. It is likely that the recommendations will be analysed by government to address similar issues in these sectors. As such, having a good understanding of the issues within the Final Report, particularly around culture, is likely to be valuable for all businesses and organisations.
Beginning to assess the culture in your organisation will not only get you ahead of any regulatory requirements that may be introduced in future, but provide greater insight into the cultural challenges within your organisation before they cause any negative impact on your customers, brand and business.
 Final Report Royal Commission into Misconduct in the Banking, Superannuation and Financial Services Industry -Volume 1, p1
 G30, Banking Conduct and Culture: A Permanent Mindset Change, November 2018, Foreword, v.
 Dewar, C. & Doucette, R. (McKinsey), R, ‘Culture: 4 keys to why it matters’, March 2018,