Public Lectures:
Towards an Effective GRC in Organisations by Joy Geary
GRC as a framework arose within financial institutions because in the past some of the people who worked in these businesses held the laws and regulations that applied to their activities in contempt. There are many definitions of the purpose of corporate governance within the world of GRC and the one that seems to be best on point relates to the moral and natural purpose of corporate governance. This consists of assuring, on behalf of those affected, a worthy pattern of good while avoiding an undesirable pattern of bad. The ideal purpose would assure a perfect pattern of good with no bad.
At the nub of corporate governance and GRC seems to be the human propensity for “doing bad”. This is particularly true when the profits available are generous and no penalties or consequences seem to flow from their taking. There seems to be contempt within many institutions over their obligations to comply with laws and regulations seemingly due to the massive disconnect between the potential rewards and penalties for misconduct in the financial services sector. It seems a law of natural science that when the laws and regulations interfere with the main game of profit making and taking, there is always a propensity for misconduct to take place.
This propensity in the financial sector for “doing bad” is without contention. There have been many examples in the past decade alone — most recently, the LIBOR rigging and Barclays’ AML penalties ($455m). If we look further back in history the OFAC penalties sustained by Arab Bank ($24m), ABN AMRO ($80m), Bank of New York ($38m), Lloyds Bank ($350m), Credit Suisse ($536m), ING ($619m), JP Morgan Chase ($88m) and Wachovia ($160m) are a result of what litigators euphemistically refer to as “bad facts”.
Policy makers have given GRC the function of policing the behaviour of those who control or carry out the business activities of the financial institutions. Policing requires power and the ability to impose consequences. If the local police force had no ability to arrest offenders they detect committing crimes, or they suspect of crimes, then our society would be a radically different place. Society would be, in effect, lawless because there is no policing power. Policing requires power and consequence. We could ask ourselves who do we want policing King’s Cross at midnight on Saturday night — the local neighbourhood watch or the NSW Police Force?
In policing behaviour, the GRC function can only be effective if it has power over business objectives or if there are other positive drivers motivating the behaviour of those in the organisation. The GRC function needs leverage to encourage people in the business to only take lawful actions and to resist unlawful actions — regardless of the potential profit that stands to be made. That leverage is consequence.
GRC as a framework and as a function has never been given the power or the ability to impose consequence within organisations. The impotency of GRC to police bad behaviour in the financial sector has, in effect, left us where we are today. Sifting through the charred remains from the GFC; witnessing multi-million-dollar sanctions and AML penalties get handed down with alarming regularity; and watching from afar as the LIBOR hearings reinforce the public’s dismal view of the reputations of financial institutions.
The power of penalties
If GRC is powerless and ineffective in promoting good conduct, then the only remaining force weighing in on the activities of profit makers and takers is the force of law and regulation.
Laws and regulations covering the activities of financial institutions, built on appropriate criminal penalties, are the only external forces that have a chance of changing the scandal-laden world of financial institutions. Such laws and regulations will only work if they are fearlessly enforced by government, regulators and law enforcement agencies alike. Criminal penalties need to apply to corporations (loss of banking and other licences, penalties, liability to shareholders) and personally to directors, senior managers and profit makers and takers.
When calling for a return to criminalisation of activities engaged in by profit makers and takers within financial institutions we need go no further than the concepts of fraud (LIBOR) and the crime of money laundering. Fraud is a criminal act. Money laundering is a criminal act. Yet those working in financial institutions are seemingly immune to any form of criminal prosecution. There are some limited exceptions, such as the criminal prosecution of Lucy Edwards and the Bank of New York resulting in a “slap on the wrist” home detention order for Edwards with no jail time served. Yet even the Bank of New York was able to negotiate a delayed prosecution agreement after it violated a cease and desist agreement in the same matter.
If the risk is that a civil penalty might roll out the door of the regulator in three or five years’ time, what deterrence value is there? By the time a civil penalty is imposed the profit takers and makers involved will have moved on to another financial institution or taken up residence in other rolled-gold pastures. Despite the attempted reforms to remuneration practices, in most cases the bonuses will have been paid and the options exercised long before the regulators swoop.
The past decade has shown that GRC has not had an effective seat at the executive table. If it had a seat at all, its voice must have been drowned out or ignored by the profit makers given the slew of scandals over the past 10 years.
The thin blue line
If GRC cannot police effectively then what persuades the profit makers to act lawfully? Not much it seems.
There are many apologists within financial institutions who say criminal laws will be misused and people will be prosecuted for crimes that they have not committed. Granted, there is always this risk. But society as a whole does not advocate removing the penalties for murder because there is a risk that innocent people will be convicted of those crimes. It is a risk that society deems essential to take.
Criminal laws with suitable penalties that require those who work in financial institutions to avoid fraudulent behaviour and to ensure that they are not dealing in the proceeds of crime, aiding corruption and facilitating other criminal acts, should hold little concern for directors, chief executives, senior managers and bankers who are committed to good corporate conduct.
What is essential, however, is that financial market participants do fear the second Chinese curse – coming to the attention of the authorities through criminal prosecution — for the offences that many of them seem tempted to commit with monotonous repetition.
If their commitment to good conduct comes from the personal fear of criminal prosecution for crimes they might participate in — rather than a belief in the value of GRC — then so be it. That is of little concern to members of the public. What does matter is that members of the community and “financial citizens” — be they mortgage holders, superannuation investors, or bank depositors — are one day able to have confidence in the members of the financial sector that they feed.