How To Improve Corporate Governance In A Regulated Financial Institution

Transcription

1 CORPORATE GOVERNANCE IN FINANCIAL INSTITUTIONS JOHN F LAKER Chairman Australian Prudential Regulation Authority ABAC/ABA/PECC Symposium on Promoting Good Corporate Governance Melbourne 19 October 2005

2 CORPORATE GOVERNANCE IN FINANCIAL INSTITUTIONS Introduction I am pleased to be participating in this Asian Bankers Association Symposium on Promoting Good Corporate Governance, being organised with the APEC Business Advisory Council and the Pacific Economic Cooperation Council. Clearly, the corporate governance debate still has much life in it. The need for strong standards of corporate governance to underpin confidence in market economies is unchallenged, but the debate now seems to be shifting to whether recent efforts by governments and regulators around the globe to promote such standards may have swung the pendulum too far. This is a legitimate question to pose. At the same time, the blows to confidence from the unprecedented number of corporate scandals over recent years should not be allowed to recede too quickly in memories. And the latest judgments of courts in the United States and Australia confirm that the community does indeed expect high standards of personal accountability from boards and senior executives. For APRA, Australia s integrated prudential regulator, this Symposium is timely for two particular reasons. Firstly, we have recently put forward proposals to update and harmonise our existing prudential framework for governance of regulated institutions and we have been having some spirited consultations on our proposals. Secondly, Australia is currently taking part in the IMF/World Bank Financial Sector Assessment Program, which involves an assessment of Australia s observance of various financial sector codes and standards. The relevant standards for APRA are the core principles for banking and insurance supervision, in which the need for effective corporate governance is a recurring theme. One issue posed for this session concerns the challenges in promoting good governance in financial institutions. A very relevant topic for a prudential regulator. The calibre and decision-making processes of those charged with running regulated financial institutions is a central focus of prudential supervision in Australia, as in any market economy. To encourage discussion, I want to raise and address three questions: Should corporate governance standards in regulated financial institutions be higher than those for non-financial firms? If so, how does a prudential regulator seek to promote those standards? Are governance requirements a burden on financial institutions? Unavoidably, I will refer mainly to Australian experience but the issues have a broad significance throughout the Asian-Pacific region. Governance and the prudential framework As the prudential regulator, APRA s mandate is to promote prudent business behaviour and risk management on the part of regulated institutions banks and other deposit-takers, insurance companies and superannuation (pension) funds so that these institutions can meet their financial promises. In pursuing this mandate, we do not act on behalf of shareholders or individual customers but on behalf of groups we call beneficiaries. These are depositors, policyholders and pension fund members, who rely on the continued solvency of regulated institutions for

3 2 their financial security but who are themselves not well placed to assess financial soundness. In APRA s view, the prime responsibility for the prudent management and financial soundness of a regulated financial institution rests with its board and management. We cannot repeat that mantra often enough! The group with overall responsibility is the board. It is the board that should set the strategic direction of the institution and approve and review significant policies. It is the board that should determine the institution s tolerance for risk, approve its risk management strategy and policies, and ensure that management is monitoring the effectiveness of risk controls. It is the audit or risk committee of the board that should satisfy itself that all material risks are identified, that appropriate risk management systems are in place and that the monitoring and audit process highlight any significant issues or weaknesses. It is the board that should ensure that the institution maintains capital resources commensurate with the level and type of risk exposure. And it is the board which should take the lead in establishing the culture and ethical values of the institution, setting the tone at the top, so to speak. These are critical responsibilities, and we expect boards of regulated institutions to pursue them in a diligent and effective way. We want no more reminders in Australia of the sorts of governance shortcomings that contributed to the failure of HIH Insurance Ltd, our second largest general insurer or, a decade earlier, the demise of two large state banks. Is APRA alone among prudential regulators in setting high standards of corporate governance for financial institutions? Not at all! Prudential regulators have long had an interest in governance issues, particularly in the banking sector, and the reasons were restated by the Basel Committee on Banking Supervision as recently as July this year. In its consultative document, Enhancing Corporate Governance for Banking Organisations, the Basel Committee set out the arguments why corporate governance for banking institutions is of greater importance than for other companies, given the crucial financial intermediation role of banks in an economy, the need to safeguard depositors funds and their high degree of sensitivity to potential difficulties arising from ineffective corporate governance. The Committee stated that effective corporate governance practices, on both a system-wide and individual bank basis, are essential to achieving and maintaining public trust and confidence in the banking system, which are critical to the proper functioning of the banking sector and economy as a whole. The Committee concluded, without qualification, that minimum standards of corporate governance for banks should therefore be more ambitious than for non-financial firms. (p4). APRA strongly supports this conclusion. Indeed, we believe it also applies to all regulated institutions responsible for safeguarding the financial and physical assets of the community. The importance of strong corporate governance permeates the core principles for banking and insurance supervision, against which Australia is currently being assessed. Take the Core Principles for Effective Banking Supervision, for example. The particular principle dealing with internal controls puts the onus on the prudential regulator:

4 3 to require that boards and senior management of a bank understand the underlying risks of their business and be committed to the control environment; to determine that a bank s internal controls, for which the board is responsible, are adequate for the nature and scale of the business; to evaluate the composition of the boards and senior management to determine that they have the necessary skills and can address the changing risk profile of the bank; to have legal authority to require changes in the composition of the board and management; and to require the internal audit function to report to an Audit Committee. In other words, the Core Principles expect an active engagement by the prudential regulator in governance matters. This should hardly be controversial to our Asian friends in this audience. Only last month, for example, the Monetary Authority of Singapore released enhancements to its existing corporate governance requirements for banks, financial holding companies and direct insurers. The Hong Kong Monetary Authority also imposes governance requirements on its authorised institutions. Curiously, however, APRA s recent governance proposals have prompted a response from some quarters in Australia that corporate governance is no place for a prudential regulator and should be left to business laws in our case, the Corporations Act. This view is plainly wrong, and betrays a lack of understanding of the role and history of prudential regulation in this country. The Corporations Act establishes general obligations on board directors and other officers to act with care and diligence and in good faith; inter alia, it also sets out requirements for independence of external auditors. These obligations apply to all incorporated bodies, as much to a small manufacturing concern as to a major financial institution. However, the Corporations Act is silent on the interests of depositors and policyholders. It is silent on a board s responsibilities for risk management. It is silent on board composition and skills. It is silent on the internal audit function. On its own, the Act provides a starting point for a robust prudential framework for governance of financial institutions, but additional requirements are needed in the interests of APRA s beneficiaries. This was recognised some time ago. The Reserve Bank of Australia, APRA s predecessor as prudential supervisor of banks, introduced a prudential statement on the ownership and control of banks as far back as 1986 and updated it in 1994; the main elements were incorporated into a prudential standard for general insurers in July This is the prudential framework for governance which APRA is proposing to harmonise and bring into line with current good practice. APRA s approach to promoting good governance APRA s approach to promoting strong and effective governance has three main elements: a statement of key principles to which regulated institutions should have regard in establishing governance arrangements;

5 4 a set of minimum requirements on board structures and processes, the so-called architecture of governance; and on-going supervisory reviews of governance of individual institutions. Our key principles start by confirming the ultimate responsibility of the board for the decisions and actions of the institution, and then outline APRA s expectations on issues of independence, renewal, expertise, diligence, prudence, transparency and oversight. A well-functioning board of a regulated institution would not be daunted by these principles but would see them, surely, as coinciding with their own aspirations. Take independence, for example. We look to the board to perform its review and oversight role effectively and independently of the interests of dominant shareholders, management and competing and conflicting business interests. On expertise, we look to the board collectively to have, or have ready access to, the expertise needed to meet its responsibilities. On renewal, we look to the board to ensure that it provides for fresh insights and new ideas without losing the necessary understanding of the business. Would a good board have a different set of goals? Our proposed minimum requirements on board structures and processes seek to reinforce these high-level principles. Broadly summarised, we want boards to have: a majority of independent non-executive directors; an independent, non-executive director as chairperson, with a fallow period of three years before a chief executive officer can become chairperson; a Board Audit Committee with a majority of independent directors, including the chairperson, and with unfettered access to the internal auditor; a Board Risk Committee with responsibility for formulating risk management strategies, approving policies for ensuring adherence to these strategies and monitoring adherence; and a formal policy on board renewal and procedures for assessing its own performance. Again, these should not be daunting requirements for a well-functioning board. Some are already part of the prudential framework. And it is not a case of the prudential regulator setting the bar high. Many of these requirements, in fact, are deemed best practice for all companies in Australia listed on the Australian Stock Exchange (ASX), as recommended by the ASX Corporate Governance Council. And our criteria for independence are exactly those proposed by this Council. High-level principles and minimum requirements will promote good governance and increase the probability of sound prudential outcomes. However, they cannot guarantee this. Hence, an important focus of our supervisory reviews is how well boards perform in practice. Our reviews, which feed into our overall risk-rating of institutions, cover a number of dimensions of board competence and performance. We look, for example, at how boards assess the fitness and propriety of directors and how they go about forming a strong cell of collective knowledge, skills and experience, given their individual make-up. We look for the presence of overly influential or dominant

6 5 directors, who might undermine the collective soundness of boards and the quality of their decision-making. As you would expect, we look in detail at the board s involvement in governance of risk. Well-functioning boards tend to encourage news (good or bad) and appear on top of all risk areas, being proactive in their questioning of management and requests for reports. We look at the board s due diligence processes for new initiatives such as outsourcing key functions, replacing auditors or purchasing other companies. We look at how boards handle conflicts of interest. The list goes on, because our reviews of governance are comprehensive. APRA does not sit in board rooms and we have to make our judgments at one remove from the dynamics of board meetings. We do so on the basis of our discussions with boards, on market intelligence but, very importantly, on board papers and minutes. Board documentation can provide an excellent insight into the level and quality of reporting to the board, on how issues are raised and followed up and, generally, on how the board operates. We sometimes hear claims that APRA requires boards to keep detailed minutes. We do not. However, where boards have scant records of discussions and decisions taken at board meetings, we will need to be persuaded in other ways that such boards are not reactive or passive, or overly fearful of litigation. Prudential requirements and regulatory burden APRA s governance proposals have been criticised by some as introducing an extra layer of regulation in this area. We do not believe this criticism is well-founded. One claim being made is that governance in Australia is the primary responsibility of other bodies the Australian Securities and Investments Commission (ASIC) which administers the Corporations Act, and the ASX which establishes listing requirements for companies listed on the ASX. I have already explained why the governance of regulated institutions cannot be left to the Corporations Act, and has not been for many years. Nor can it be left to the ASX, for one very obvious reason. Of the over 400 institutions APRA regulates in the deposit-taking and insurance industries, only 18 or four per cent are listed companies. Without APRA s prudential framework, there would be no ambitious minimum governance standards, to use the Basel Committee s words, for 96 per cent of regulated financial institutions in Australia. A related claim is that APRA s proposed requirements are an additional burden on that small number of regulated institutions that are listed on the ASX. How could this be if, at first blush, our requirements merely reproduce the best practice recommendations of the ASX Corporate Governance Council? The issue is that our requirements, as proposed, would bind on all regulated institutions whereas the Council s recommendations apply only on an if not, why not basis. They are guidelines for listed companies and if a company considers that a recommendation is inappropriate to its particular circumstances, it has the flexibility not to adopt it, provided shareholders are given an explanation. An if not, why not approach is not a normal part of a prudential regime. In Australia, deposit-taking institutions do not have an if not, why not option for meeting the minimum Basel capital standards. General insurers do not have that option for the valuation of insurance liabilities for capital adequacy purposes. Prudential standards are intended to ensure minimum standards of prudence across our regulated industries. Yet, for reasons that are not always spelled out to us, some are arguing that ARPA should take a different approach when it comes to the critical matter of governance.

7 6 Whatever the arguments being raised, the reality is that our regulated institutions are voting with their feet. They are already introducing strong governance arrangements, of their own accord. Of our largest 25 regulated institutions, almost three-quarters are already fully compliant with the full range of our proposed minimum requirements and most of the others depart in only one or two areas. Overall compliance with our minimum requirements is around 95 per cent. At the other end, a sample of 25 of our smaller regulated institutions shows 40 per cent already fully compliant but a more mixed picture of departures from specific requirements. Even with this group, however, overall compliance is around 87 per cent. Clearly, the message reinforced in recent studies that good governance goes hand-in-hand with good business outcomes is being increasingly accepted by our regulated institutions. This is the message that our governance proposals would reinforce across our regulated industries. Having said that, a prudential regulator should always allow itself some flexibility to make exceptions in limited circumstances, where the interests of beneficiaries are not prejudiced. We do so on other prudential matters, where there is scope, and we are considering how an element of flexibility can be introduced on governance matters, without undermining the high standards we are seeking to endorse. Given that best practice as industry itself defines it has already established a substantial foothold, those financial institutions seeking our endorsement of alternative governance arrangements, or arrangements that fall short of their peers, will obviously need to make a strong case. Consultations on our governance proposals are not yet complete and we have had constructive input from a number of parties. To date, however, we have heard no compelling arguments that a prudential regulator, in the interests of promoting a sound financial system, should not include governance among the important areas of potential risk for financial institutions. The challenge in developing the prudential framework is, as always, to get the right balance between freedom and safety.