APRA needs to protect whistleblowers in the CBA inquiry

The Australian Prudential Regulation Authority (APRA) should ensure its inquiry into the governance of the Commonwealth Bank has all the unfettered powers of the prudential regulator to investigate any wrongdoing. This includes protecting whistleblowers.

The terms of reference of this inquiry and the panel of experts are yet to be disclosed.

As part of its responsibilities for considering corporate governance under the Basel rules (international rules regulating banking), APRA should have mostly unrestricted access to banks’ staff, to conduct its investigations:

Supervisors should have processes in place to fully evaluate a bank’s corporate governance. Such evaluations may be conducted through regular reviews of written materials and reports, interviews with board members and bank personnel, examinations, self-assessments by the bank, and other types of on- and off-site monitoring.

So, APRA must ensure that the members of the inquiry team can at least interview not only board members but also, because “culture” is involved, bank staff.

Groundbreaking research by Professors Elizabeth Sheedy and Barbara Griffin from Macquarie University, shows there is often a disjoint between the perceptions of senior management and front line staff on issues of risk and culture. They found senior managers have a much rosier view of how things are actually operating.

This also shows the APRA inquiry team need recognise that just talking to senior management is not enough to see what is actually going wrong in a firm.

Obviously, such wide powers must be exercised with care by the regulator. In particular, APRA must protect the confidentiality of all written and verbal material gathered during an investigation, and importantly, the sources of that information. This implies whistleblowers also need protection as part of APRA’s prudential role.

APRA needs to set out explicitly within the terms of reference of the inquiry that whistleblowers will be protected. Unless CBA staff are actively encouraged to provide information that is relevant not only to the money-laundering scandal but to other governance failures at CBA, the inquiry’s conclusions will lack credibility.

Despite their internal policies, CBA does not treat whistleblowers kindly. Like other organisations that exhibit a “groupthink mentality”, the worst crime is not doing something wrong but rather washing the firm’s dirty linen in public.

The treatment of Geoff Morris, who blew the whistle on the CBA financial planning scandal, was meant as a clear message to other CBA staff that dobbing in your mates was not to be tolerated.

And appalling treatment of people was not only restricted to the sick and dying in the case of CommInsure. It also extended to the treatment of the Chief Medical Officer, Benjamin Koh, which seemed designed to send a message to other bank staff – keep your head down, or else!

In the CommInsure case, CBA commissioned an “independent” inquiry by Deloitte into the insurer’s claims processes which “did not identify any systemic issues relating to historically declined claims”. In an object lesson on how to write terms of reference to get the answers you want, the Deloitte inquiry has been criticised by lawyers as being too narrowly defined. This is because that particular inquiry looked only at policies selected by CommInsure and did not talk to any customers affected. Hear no evidence, see no evil.

A later investigation by the conduct regulator, the Australian Securities & Investment Commission (ASIC) “found no evidence to support allegations that CommInsure claims managers applied undue pressure on doctors to change or alter their medical opinions”. But, interestingly, their search for evidence did not consider whistleblowing complaints.

APRA should ensure the terms of reference for the CBA inquiry explicitly state that the inquiry panel will have unrestricted access to all internal complaints to the bank’s Speak-Up whistleblower hotline. They should also have access to the results of any whistleblowing complaints.

In addition, the bank should be required to set up an additional confidential channel for reporting staff concerns on culture and governance to the independent inquiry and APRA.

Without clear support for whistleblowers in the terms of reference for the inquiry into CBA’s (lack of good) corporate governance, the conclusions will inevitably be tainted. APRA needs to do its job itself and head off such criticisms.