BoQ’s embarrassing back-to-the-future risk failure

And what responsibility will the board and management team – led by Patrick Allaway, who was chairman of BoQ between October 2019 and late March, when he shifted to the CEO role to replace Frazis – take for shortcomings in risk management?

Persistent rumours

Rumours that the prudential regulator had BoQ in its sights have swirled for more than 12 months, and they became stronger when Allaway suddenly moved Frazis on last November, citing a need for new focus on risk management as one of the reasons BoQ needed to change horses.

When BoQ appointed Allaway as CEO on March 27, Chanticleer again put the question to him: was BoQ under particular scrutiny from APRA?

Allaway, who wasn’t speaking on Wednesday, insisted this was not the case.

“We, as all banks, are in constant contact with our regulators. We work very closely with them. We’ve got a very transparent and co-operative relationship with APRA. We’re on a continuous journey to improve, and it’s not that anything’s been called out by APRA, it’s actually we believe that we need to build a stronger, more resilient bank. And as you think about the cycle that we’re about to go into, that’s absolutely appropriate.”

What a difference nine weeks makes.

BoQ did previously disclose that it had been in “ongoing engagement” with APRA and AUSTRAC, and set aside $60 million for compliance at its recent results in April.

But the contents of APRA’s enforceable undertaking show Allaway and his board have serious questions to answer about the failure to address problems in risk management that it identified as far back as 2016.

Risk culture gaps

Indeed, the enforceable undertaking says the bank “identified gaps in its risk culture in 2016, 2018, 2020 and 2022. However, BoQ’s risk culture remained immature and BoQ did not prioritise risk culture uplift sufficiently over that time.”

The specific failures listed in the enforceable undertakings read like a list of problems that the banks were dealing with before the royal commission.

There was a risk framework that was “insufficient for a bank of BoQ’s size and complexity”.

There was an over reliance on manual controls, which speaks to a lack of technology investment in the right places.

There were weaknesses in the three lines of defence on which risk management models are built – front-line operation staff being the first line, risk management the second and internal audit the third – particularly the latter two lines.

APRA says there was a propensity for board reports to be overly positive and fail to highlight important issues. “This impacted the BoQ Board’s ability to oversee and make sufficiently informed decisions on risks.”

And the doozy for shareholders as they reflect on how their money has been spent in recent years: “BoQ’s performance and consequence management did not adequately hold BoQ’s leadership to account where risks and issues had not been adequately addressed.”

The AUSTRAC undertaking tells a similar story. A 2018 review by the regulator uncovered five areas of potential non-compliance, and another probe four years later uncovered more issues that reflected “a lengthy period of non-compliance”.

This is simply baffling. By 2018 and by 2020, with the banking royal commission either under way or hanging heavy over the sector, BoQ should have been pouring resources into risk management to bring its systems up to standard.

And yet the problems were not fixed, forcing APRA and AUSTRAC to step in and back their demands for change with the full force of the courts.

Complex set of problems

APRA has emphasised that BoQ is “financially sound and comfortably above its core capital and liquidity requirements”, so the $50 million capital charge that the bank has been hit with will have no big financial ramifications for investors.

But BoQ’s already difficult juggling act has clearly become much more complex.

Allaway was already facing the challenging task of navigating a testing period for the banking sector, where profit margins are under pressure due to intense competition, bad debts are likely to rise (albeit from low levels) as the economy slows, and credit growth will be tepid.

He was already facing the problem of completing the integration of ME Bank into BoQ; the synergy numbers seen so far have been promising, but history says these bank integrations are long and complex.

And now, on top of all this, he must prioritise a risk management rescue job under the eyes of two of the country’s most powerful regulators. This will take money, time and resources – three things a regional bank trying to compete with the big boys never has enough of.

BoQ isn’t the only bank that’s been hit with an enforceable undertaking, of course – Commonwealth Bank previously had one from APRA, Westpac still has one with the prudential regulator and NAB has one from AUSTRAC. Clearly, those arrangements haven’t stopped NAB and CBA from delivering extremely strong results. Indeed, they may have sharpened these banks’ focus on risk management.

But Allaway and his board would do well to reflect on the timely reminder Hayne provided on Tuesday about the need to view poor conduct through the lens of leadership and governance failures.

“If there are persistent ways where breaches of the law are identified, it can say a lot about leadership, culture and governance within the relevant entities,” he said. “But if there is only occasional deviation in the [compliance], what is it in the leadership, culture and governance of the entity that is contributing to that result?”

That’s the question BoQ should be asking itself.