After damning the Commonwealth Bank's management, regulators want the bank to fix itself

A report on the Commonwealth Bank’s governance, culture and accountability has stripped away the bank’s delusion that it is well run and a model of good governance.

The report by the Australian Prudential Regulation Authority (APRA) is a damning indictment of every aspect of CBA management, from the board of directors to executive management and even the lower levels of the bank. However, APRA has done little more than rap CBA on the knuckles.

Responsibility for fixing up CBA has been turned over to the bank itself. More could have been done, including placing conditions on CBA’s banking licence and removing board members and executives.

APRA has applied a A$1 billion add-on to CBA’s minimum capital requirement. These are the financial assets that the Commonwealth Bank is required to hold to ensure a stable banking system.

APRA has also accepted an enforceable undertaking from the CBA. This is essentially an agreement under which CBA accepts the report’s findings (but does not expressly agree with them) and promises to prepare a plan to respond to its recommendations.

There are indications in the APRA report that there will be further investigations of the conduct of bank employees.

What penalties?

The A$1 billion add-on to CBA’s capital requirements is not a penalty, despite commentary to that effect. APRA can and does require top-ups of this kind from time to time under the Banking Act to ensure security and confidence in the banking sector.

Given the Commonwealth Bank’s size and leading role in the sector, the additional capital requirement is prudent but hardly controversial. The funds will be returned to CBA when it completes the actions proposed by the enforceable undertaking.

At best, the capital requirement is a temporary but not significant inconvenience for CBA. It represents a mere 0.103% of its total assets as of the last financial year

That leaves the CBA enforceable undertaking as the principal outcome from the APRA report.

Read more: Why the new banking laws won’t be the slam dunk the government is expecting

The enforceable undertaking is mostly a procedural document. For instance, CBA must submit its remedial action plan by June 30 2018.

It must have a clear and measurable set of responses and a timetable for each response, and must nominate a person responsible from the CBA executive team. CBA must also appoint an independent reviewer, approved by APRA, to report to APRA on compliance with the enforceable undertaking and the completion of items in the plan. CBA must report separately on executive pay issues.

In essence APRA has handed over the responsibility for cleaning up the management mess found at the CBA to the bank itself, despite finding that it is culturally unfit to properly manage itself.

Why should anyone take comfort from that arrangement?

APRA’s report also makes clear that the problems at the Commonwealth Bank do not stem from one specific issue. The problems affect the whole organisation of more than 45,000 employees with A$967 billion in assets.

An independent reviewer will vet what is being done and report on its success or otherwise to APRA. But that report will be made to APRA, not to the general public. We may never know what measures the bank implements as APRA has no obligation to disclose anything.

What else could have been done?

An enforceable undertaking can save the regulator the time, cost and uncertainty of taking legal action, as well as enable it to craft specific remedial actions to fit the circumstances.

But there is very little tailoring in the Commonwealth Bank’s enforceable undertaking. APRA has opted to wait and see what remedial action the bank comes up with. The regulatory touch is so light that even describing it as featherweight would be an exaggeration.

APRA could have done much more than it did. Banks require a licence and APRA is empowered by Banking Act to place conditions on these licences that restrict or limit how banks can operate.

APRA could have used this power to place immediate restrictions on CBA’s business practices, including on the size and calculation of executive compensation. One of the major findings of APRA’s report is that CBA executive compensation schemes did not provide sufficient incentives for senior executives to account for risk in their decision-making. Certainly, the criticisms of CBA management in the APRA report are sufficient to warrant this kind of action.

Read more: APRA and ASIC have the legal power to sack bank heads, but they need willpower

APRA has the power to remove a bank director or senior manager if the person does not meet one or more of the criteria for fitness and propriety. That APRA did not do this may be because there have already been resignations and new directors at the Commonwealth Bank.

APRA should have queried whether these changes were sufficient. Perhaps this is part of the wait-and-see approach implied in the enforceable undertaking.

The APRA report highlights systemic problems in Australia’s leading company and premier bank, including a culture of complacency, defensiveness, insularity and overconfidence. But for all of that, and despite the financial and emotional costs borne by the Australia community, APRA’s response appears to be no more than “wait and see”.