The US Federal Reserve (Fed) again expressed concerns about the culture at financial institutions this month.^[1] This has been a recurring theme since the financial crisis, as regulators in the US and abroad have hit industry players with steep fines for employee misconduct. Since 2008, the largest global banks have cumulatively paid out over $300 billion in fines, with US banks paying about half of that amount.

EU and UK regulators have been the most active in pushing banks to address their culture weaknesses.[2] The EU has introduced new rules limiting bonuses paid to senior employees that are in risk taking roles.^[3] The UK has enacted even tougher bonus limits,^[4] and has introduced a Senior Managers Regime establishing requirements for firms to certify that their employees are “fit and proper” to perform their roles.^[5]

International standard setters have weighed in as well, with the Financial Stability Board (FSB) releasing three relevant documents this month alone. Other relevant proposals include the Institute of Internal Auditors’ (IIA) recommendation that an assessment of culture be included within internal audits (which has prompted significant changes at some institutions) and the Group of 30 suggesting that banks come up with their own culture standards in cooperation with regulators.

Here in the US, regulators have not adopted the prescriptive approach of the EU or UK, nor those of international bodies, and we doubt they will. However, US regulators and other stakeholders (e.g., clients, shareholders, employees, and counterparties) desire stronger links between the profit making goals of the bank (and its various business units) and robust risk management, reinforced by the bank’s culture.

Therefore, we expect the US will address culture through the supervisory process, which Chair Yellen noted in recent Congressional testimony. Additionally, the US will continue to focus on firms’ risk appetite setting process to address all elements of risk taking. Furthermore, under Dodd Frank the Fed must eventually re-propose its compensation rule from 2011.^[6] We believe the re-proposal will encourage clawback measures, longer deferral periods, and bonuses that include company bonds (in lieu of equity) as opposed to capping bonuses.

One thing is certain: major jurisdictions from around the world expect demonstrable improvement in banks’ culture, and it will not be easy. Our Capital Markets 2020 survey found that banks view cultural change as important (and even a possible source of additional business), but 60% of them thought change would take as long as 3 years.^[7]

This memo outlines (a) where banks currently are in improving their culture[8], (b) why culture change is so important, and (c) key steps banks can begin taking now.

Where are banks now?

Over the past five years, banks have instituted complex control systems to detect and punish rogue behavior –where employees cheat their employers or customers, or violate clearly defined rules. In this respect, firms have made great strides. Increased levels of surveillance, with appropriate governance and controls such as mandatory sign-offs, have enhanced firms’ abilities to identify and manage this type of misconduct. Advances in data analytics are rapidly improving these processes at leading institutions.

Beyond this monitoring, most institutions have also addressed culture directly by describing their desired culture through value statements, codes of conduct, or other formal means. They have also initiated processes that impact culture proactively, or incidentally as part of a broader response to certain regulatory mandates. As examples, we have observed a number of reinforcers of good behavior coming from banks’ responses to the mortgage consent orders issued in 2011 and matters requiring attention (MRAs) resulting from bank examinations. These reinforcers include redesigning branch sales incentive plans, clarifying product approval processes, enhancing background checks as part of hiring, investing in employee onboarding and training in risk culture, changing succession planning processes to manage key persons, integrating risk and compliance professionals in the performance reviews of front office employees, and demonstrating clearer links between compensation and behavior.

Finally, a number of institutions have implemented punitive consequences for noncompliance with policies or for ethical violations. Many firms have chosen to publicize these punishments as a way to highlight their efforts to change culture and enhance their reputation.

What is the key conduct that improved culture will avoid?

Addressing the employee conduct highlighted above only solves part of the behavior problem that banks are experiencing. Rather than behavior that violates a clear rule or policy, the conduct for which culture change is most needed results from employees prioritizing the short-term gains of the bank (and often of the individual employee) over the bank’s goals of managing risk (especially reputational risk to support key customer relationships) and achieving long-run profits.

Where rules or policies are more subject to interpretation, a firm’s culture will reinforce good employee behavior and support the bank’s three lines of defense, so employees make better long-run decisions. The past year’s FX manipulation and LIBOR collusion, as well as prior unauthorized or rogue trading incidents, serve as examples of poor short-term decision making.

The challenge is that the behavior in such cases is often aligned with the profit-generating interest of the bank – a situation that tends to empower revenue generating business units relative to cost centers such as risk or compliance. Moreover, these employees often act with the knowledge and approval of their peers and immediate superiors who have failed to take ownership of the problem. Such behaviors are especially likely to be accepted as “business-as-usual” in areas where there is not a clear law or regulation prohibiting the behavior, rendering pushback by control areas less effective. Most dangerously, the individuals that cause the firm the greatest damage are often also the “star” profit-generating performers of recent quarters.

Therefore, the way to improve culture, and in turn improve employee conduct, is not by simply publishing new codes of conduct or values statements, or by implementing some new processes. It is also not by merely lowering the firm’s overall financial risk as some banks have done. Although these reactions are understandable, and in some cases helpful, they miss the full point and may needlessly sacrifice returns.

Instead, culture change is really about embedding the right incentives throughout the organization to instill a sense of right and wrong, and of responsibility. New York Fed President Bill Dudley recently referred to this idea as cleaning up the “apple barrel” rather than the individual apples. We would go even further, and suggest that the apple trees and even the surrounding soil are ripe for change.

How can culture be changed?

There are plenty of ideas for influencing culture, but a successful approach must be structured and reinforced throughout the organization. Below are the five conditions that we believe are necessary for achieving the cultural change that will improve the management of banks for all stakeholders, including the US regulators.^[9]

Align compensation with risk taking

Despite continued scrutiny, key employees at financial institutions do not have their performance or compensation evaluated for adherence to risk policies and procedures. In our research, we have found that a quarter of employees admit they do not understand the personal consequences for failing to follow these protocols, and even fewer strongly agree that nonconformance is consistently addressed by superiors.^[10] On the other hand, tying employee compensation to revenue is a common and significant motivator – a potentially dangerous coupling that can encourage individuals to make risky, perhaps illegal, decisions for short-term financial gains.

As a result, EU and UK regulators have been requiring banks to revise their compensation models, but we do not expect regulators in the US to be as prescriptive. Because there are many ways that compensation can help align behaviors with the institutions’ values and risk appetite, the US is more likely to articulate principles, leaving it to the firms to design specific programs and practices. Regulators will likely use the supervisory process to assess these programs’ effectiveness, perhaps somewhat in line with the recommendations from the FSB’s recent Progress Report on compensation practices. US regulators are giving particular credence to incorporating some of the features of partnership models into compensation supervisory practices, including clawbacks, longer deferral periods, and the payment of some portion of deferred compensation in cash or debt instead of stock options.^[11] Clawbacks in particular seek to deter excessive risk taking by exposing decision-makers to more downside risk.

Banks can begin using compensation as a tool for change by reviewing adherence to risk limits or procedures as part of employee performance reviews, both to incentivize sound risk taking and to disincentivize misconduct. When the opportunity exists for bank employees to profit through risky behavior, the negative compensation consequences of such violations would need to be significant to serve as a deterrent.

Control functions gain more prominence

Balancing power between the business and control functions is critical to reinforcing the right culture message. Although an overwhelming majority of the industry recognizes that risk and control functions need to independently assess and challenge business decisions, and many institutions have begun to embed risk and control considerations into formal front office performance reviews, more needs to be done. For example, in many cases control staff find it difficult to effectively challenge revenue generators given their stature and authority. Our recent risk culture survey reveals that only 16% of respondents strongly agree that the risk control function could override a business decision at their institution.^[12] Solving this dynamic begins with clarifying roles and responsibilities, and involving control functions early in the decision-making process, and not merely as an afterthought or a rubber stamp.

Because it is not practical for modern financial firms to preemptively set limits on every nuanced risk or every aspect of a business, control functions must be sufficiently empowered to challenge risks that may violate the spirit, and not just the letter, of the firm’s agreed risk appetite. Processes that rely simply on checking activity against limits may miss potential problems and, in extreme cases, create incentives to optimize against internal limits in ways that produce new, undesirable risks.

Conform leadership’s message to real action

Boards and management should ensure that their actions are consistent with their message to employees. Current realities, however, fall short of this goal, as our research indicates that 30% of banking professionals do not believe the actions of their management consistently align with their communications regarding risk.

This reality often results from a gap between the values that the board or upper management espouse relative to the execution of those values by middle management. In other words, “tone in the middle” is just as important as “tone at the top.” Middle manager actions are critical in the eyes of employees to help instill and reinforce good behavior, and perhaps as importantly to discourage rationalization of bad behaviors.

To address this problem, firms should develop clear, measurable protocols and open channels for escalation and resolution of issues related to failures in culture and controls, especially with middle management. Additionally, a savvy approach to training and development would help: as part of annual goals for employees, some banks are requiring their front office employees to participate in control function projects. Such participation has increased cooperation between business and control functions and has informally improved the relative stature of control functions.

Assess and measure changes in culture

Paramount to any change in the culture of an institution is quantitative and qualitative measurement – gauging the attitudes of employees, particularly at critical points where they most impact business outcomes. For example, firms may want to assess how employees interact with customers, review the informal criteria used for promotion decisions, or utilize surveys and focus groups to verify whether the message from the top is consistently reinforced by managers.

Measuring culture will help senior executives develop a focused and deliberate plan for change. Furthermore, such diagnostics can pinpoint particular areas of behavioral vulnerabilities, and track and demonstrate the progress of culture change to boards and other stakeholders. Firms that are currently measuring progress against their desired culture are using scorecards of indicators that are readily available from existing systems and periodically tracked. They may include statistics related to people (e.g., attrition, promotion, training, and exit interviews), customer feedback, or operational risk (e.g., exceeding trading limits, compliance violations, and trade surveillance data).

Increase transparency

With advances in technologies, and an increasing desire by regulators (and other stakeholders) for less opacity, a much more transparent environment within financial institutions is becoming more necessary and more plausible. Although the tendency of some employees has been to resist any sort of audit trail that would be “discoverable” during an internal or external review, the emerging workforce is very familiar with sharing certain aspects of personal day-to-day activity. We can see a time when a greater level of transparency is not frowned upon but becomes accepted as the norm.

From a culture perspective, the advantage of a more transparent organization is fewer occurrences of negative behaviors by employees and further encouragement of positive behaviors. Not only will it be harder to hide behaviors misaligned with those desired by the firm, but greater transparency will likely engender a self-policing culture (i.e., a “neighborhood watch”) in which employees will be more inclined to behave better and bolster their reputations with the firm. In the long run this could result in less extensive and less costly control frameworks being needed to identify the poorly behaving employees and to reward those with good behavior.

Conclusion

Culture change will not be easy and will take time, but firms will find it advantageous to focus on it early and accelerate change. In addition to lowering the chances of fines, culture change will rebuild trust with customers, investors, employees, regulators, and the general public. Furthermore, early actors will have the opportunity to set best practice standards that are more tailored to their business and influence the future supervision of their organization. But perhaps most importantly, culture change will lead to better overall decision making by employees, which will reap dividends in the future.

ENDNOTES

^[1] On November 5, 2015, the Federal Reserve Bank of New York held a workshop on culture and behavior in the financial services industry, similar to a workshop held last year at this time. The agency is likely to soon release notes from the workshop.

[2] Of all regulators, the UK’s Financial Conduct Authority (FCA) and Prudential Regulatory Authority (PRA) have arguably most strongly promoted culture change.

^[3] See PwC’s Regulatory brief, EU bonus cap: the net widens (March 2015).

^[4] See PwC’s First take: UK final bonus compensation rule (June 2015).

^[5] The regime provides little guidance as to what constitutes “fit and proper” for these employee evaluations. For more information, see PwC UK’s, The Senior Managers Regime: no big surprises for UK branches of foreign banks (August 2015).

^[6] See PwC’s Regulatory brief, EU bonus cap to take effect (July 2013), which describes the US’s 2011 proposal.

^[7] See PwC’s Capital Markets 2020 (April 2015).

[8] We define culture as “the assumptions or beliefs common in an organization that allow you to predict how people will behave.”

^[9] This section builds on views we introduced in PwC’s Viewpoint, Cure for the Common Culture (October 2014) and PwC’s Forging a winning culture (January 2015).

^[10] See PwC’s Viewpoint in prior note.

^[11] The SEC this year proposed separate clawbacks for executive compensation for accounting misstatements, and proposed requiring public companies to disclose the ratio of the CEO’s total compensation to employees’ total compensation. We do not view these as compensation rules that will meaningfully impact bank culture, although they serve other objectives.

^[12] See the results of PwC’s 2014 Global Banking Risk Culture Survey (October 2014).

The preceding post comes to us from PwC and is based on the memorandum available here, which was published in November 2015.