Mission impossible? Westpac panel highlights directors' dilemma

SMH 4/6/2020

In any corporate scandal, there are always two key questions to pose to determine the responsibility of the non-executive directors.

What should the board have known? What could the board have known?

The difference between those questions might appear subtle, but they go to the heart of the difference between community expectations of director responsibilities and the practical ability of boards to meet them.

The post-mortem commissioned by Westpac's former chairman Lindsay Maxsted at the onset of Westpac's collision with AUSTRAC over its compliance, or lack of it, with anti-money laundering laws provides insights into a real world boardroom.

The review by Colin Carter, Kerry Schott and Ziggy Switkowski into the Westpac board's handling of the anti-money laundering issues also provides an understanding of the complexities confronting directors faced with the evolving and more demanding expectations from communities with little understanding of the limitations of their role.

Anti-money laundering legislation is relatively new, flowing from the aftermath of 9/11 and the global attempt to prevent financing of terrorism.

As the advisory panel noted, global banks were affected most by the new rules, but the largely-domestic Australian banks -- may be comforted by AUSTRAC's focus at the time on tax evasion, welfare fraud, terrorism and organised crime -- perhaps didn't prioritise other money-laundering issues as much as their overseas peers.

Having said that, it should be noted that almost all the major banks around the world (including Commonwealth Bank here) have had issues and paid substantial fines for non-compliance with anti-money laundering laws. And given the nature of modern banks - completely technology-dependent, even though no large technology platform is perfect - perfect compliance might be impossible.

Westpac's issues with AUSTRAC relate to inadequate reporting of millions of international funds transfers; failing to carry out adequate risk assessments of is correspondent banks and, most damagingly, to the failure to conduct enhanced customer due diligence that led to the regulator's allegation that the bank had facilitated payments by 12 customers that might be linked to paedophilia.

The most telling conclusion of the review was that Westpac's management didn't know of the shortcomings in its processes and reporting of financial crime, and therefore the board didn't know of them.

"When a board is not getting correct information or matters are being omitted, its task is made impossible," the panel said.

Fit for purpose

"The simple fact is that management did not know and hence could not inform the board until they did know," it found. There was "absolutely no evidence" that management's errors were intentional or motivated to mislead the board. Nor was there any evidence that greed or financial incentives were a factor. The bank's "sins" were ones of omission, not commission, the review concluded.

Westpac appears to have had strong governance structures or, as the panel described them, the way it organised its governance responsibilities were "mainstream" and "fit for purpose".

In a comment that will have a lot of non-executive heads nodding, the panel said the main challenge for the board was not the governance structure but "the huge scope of a board's work relative to the board capacity that is available".

Westpac is a very large organisation, with more than 14 million customers and more than 36,000 employees.

Within the board's risk and compliance committee, financial crime was a relatively small item - until 2017, when the board became aware of the scale and systemic nature of the problem - within what the panel described as a very crowded agenda of 35 to 40 items and about 40 participants at each meeting.

There seems to have been an intensifying interest at board level in financial crime reporting risks from about 2015, when Brian Hartzer became chief executive, but it stepped up from 2017, when there was an institutional bank investigation of the financial crime risk in its operations that led to Westpac self-reporting the major breaches to AUSTRAC.

The review concluded that from 2017 the board's responses to financial crime reporting appeared to have been appropriate, albeit reaction times remained slow.

The panel wasn't asked to look at management shortcomings, although it did note problems with IT projects (at a time of rapid change in financial sector technology), turnover in the IT team, rapid changes in laws and regulation and changes in community expectations.

Pressured part-timers

Westpac had been a successful business, the panel said. Important processes, like oversight of financial risk, were mostly fit for purpose, well-documented and well-managed.

However, the purposes of institutions had been redefined and companies were now responsible to a broader set of stakeholders to maintain their social licences.

The "elephant in the room" issue, the review found, was that assessments of whether a board has done well or poorly are substantially determined by views about what boards can and cannot do. "And here we see society's steadily increasing expectations, which are not necessarily well-founded, on what boards are set up to achieve."

Directors aren't executives - they aren't management. They are part-timers. The panel said that if each of Westpac's nine non-executives spent a day or two a week on the job, they'd be the full-time equivalent of only three directors.

"The statement of the duties of a company director are large and growing, but with such limited capacity boards will always have to decide which issues are to have priority. They cannot do everything," it said.

That's a very pragmatic statement from three very experienced non-executive directors, albeit one that isn't likely to find popular support among those more interested in blame than understanding.

There's no doubt that, after CBA's $700 million fine and a likely Westpac fine that could be more than $1 billion, financial crimes reporting is and will remain an issue high on boardroom agendas.

Those agendas aren't, however, narrow.

Apart from their core responsibility -- overseeing the normal running of the bank's commercial operations, ensuring its financial stability, profitability and growth and the myriad of issues associated with its day-to-day activities - boards have an enormous amount of issues on their plate in the post-financial crisis and post-royal commission environment, and now at the epi-centre of the financial implications of the coronavirus. Issues that place enormous stress on the capability of their people and their IT platforms.

The panel queried the extent to which boards could be expected to pick up major mistakes deep inside their company. They might equally have asked the same question of the capacity of senior managers to know and understand what is happening deep within the bowels of very large and complex organisations.

It is clear from the panel's comments that the three board veterans believe it is impossible for non-executives to meet the expectations of those who don't understand the limitations of their role.

That's a worthy contribution to the discussions about directors' duties but, unfortunately, one unlikely to be accepted by many of those without boardroom experience.

(i)The article focusses on non-executive directors. Explain the differences between non-executive and executive directors.

(ii)What challenges do non-executive directors face in complying with their duties under the Corporations Act?