Four Australian banks having tech issues with ATM machines

Four Australian banks, including Westpac, are experiencing technical problems which have hit over 3,000 ATM machines nationwide; problems started over Sunday with cash transactions being declined. The problem has now been resolved and the banks involved have said they will refund customers for any fees incurred for using other bank's ATMs.

While this was going on, the elite internal audit team lobbed a three-star internal audit issue relating to weaknesses identified in the risk profiling process and supporting risk oversight practices.

Contrary to how it sounds an internal "three star audit" result at NAB is extremely serious – it is the worst rating possible. (It is worth noting that the internal audit does not relate to credit management or asset quality.)

Since the internal audit was released, the bank has been trying to rectify the issues raised in the report. Since then, it has "substantially" dealt with the issues raised. When it is ready, a fresh internal audit will be launched.

In a statement, NAB's chief risk officer David Gall said "culture and managing risk is a key focus for our executive leadership team and board". He said the internal audit commenced in December 2014, a year after a new system was introduced, the Risk Management Self Assessment (RMSA). This was designed to enhance risk management across the bank.

"There were some gaps identified in how we document control assessments in operational risk profiles and the consistent execution of oversight activities for this specific process," he said.

APRA has recognised that the shadow banking sector relies on the big banks. Bloomberg

Advertisement

Weaknesses

The Financial Review can reveal that the findings of that audit said "audit has identified that CRO's [chief risk officer's] oversight activities which support key elements of the RMSA process requires strengthening".

It said: "This is evidenced through inconsistent and ineffective oversight practices executed between and within divisional CRO teams."

It went on to say that self-assessments by each performance unit had been "confirmed" by chief risk officers without applying the minimum requirements outlined under the risk management self-assessment. "As a result, oversight performed has not detected the weaknesses which exist within operational risk profiles."

This included issues with the completeness of current risks including consideration of the top 10 compliance obligations that are applicable to performance units.

It said often the controls captured in profiling information didn't prevent or detect the likelihood of the risk occurring. It said information contained in the operational risk profile wasn't current.

Advertisement

Operational risk goes to the heart of an organisation. A failure in identifying, measuring, managing, monitoring and reporting operational risk can lead to a breakdown in the risk control environment. Put simply, how can you properly manage risk if you can't properly identify it?

Systemic issues

If an organisation doesn't have the proper warning systems in place, it can result in that organisation not picking up bad behaviour or ineffective practices, which can manifest into systemic issues that can cost customers and shareholders dearly.

NAB's David Gall said performing risk and audit reviews was a normal part of business and that the role of risk and audit was to seek to identify any issues and ensure they are remediated in a timely and appropriate manner.

He confirmed NAB had a three star tier rating system. "Issues are rated depending on audit's assessment of the financial, reputational and compliance risks. A three star audit issue is reported to the executive management risk committee and board's risk committee. APRA is also notified of all three-star audit reports, as is our external auditor. This was done in this case."

He said this audit did not give rise to any material gap in its risk management framework or represent a breach of NAB's prudential or licensing obligation.

Advertisement

He said shortcomings found in the audit had been addressed and an updated process was implemented and was "substantially" complete.

Nevertheless, NAB is still sitting on an outstanding three-star internal audit issue.

Image problems

NAB and the rest of the big banks are firmly in the spotlight, battling image problems that have become an election issue as the opposition has pledged a royal commission if it is elected to government.

The various scandals have generated much debate about the root cause of the financial misconduct. Is it culture? Ineffective risk management practices and a breakdown in the risk-control environment? Is it a combination of both?

What is known is ineffective risk-management practices lead to a breakdown in the risk-control environment. When risks are not properly identified and managed, ineffective practices and inappropriate behaviour can eventuate and get out of control.

Advertisement

Pat McConnell, an honorary fellow at Macquarie University's Applied Finance Centre – who spent 30 years advising banks and insurance companies on risk and regulation and recently published a book in the UK on Systemic Operational Risk which looks at how industry-wide so-called "macro-culture" can give rise to large losses and fines – a three-star is a wake-up call, and even an alarm bell.

"Three-star issues are issues where there is cause for great concern regarding financial and/or reputational loss to the bank," he said. "These issues should be taken with the utmost seriousness, and the appropriate resources and time devoted to ensuring that all components of the audit issue have been rectified."

McConnell says APRA would have been worried because operational risk is the biggest use of risk capital after credit risk. He says banks have got into trouble not managing their operational risk.

"Not only rogue traders but also events such as PPI in the UK [PPI or Payment Protection Insurance has so far cost the industry more than £30 billion in compensation for mis-selling] and the LIBOR and bank bill swap rate manipulation scandals."

Customer centred

He said the audit report did not mention specifics, although one could read between the lines that something was wrong on the operational risk front.

Advertisement

A NAB source said he was disappointed to see the risk framework and supporting risk practices fall into disrepair after APRA complimented Wholesale Banking (now Products & Markets) in adopting industry better practice in risk management in 2010.

"How things have changed," he said. "A three-star internal audit issue doesn't manifest overnight and let's hope this isn't indicative of a 'path to least resistance' attitude to risk management driven by cost-reduction programs that cut too close to the bone."

NAB chairman Ken Henry recently gave a speech on the future of banking. He said the bank that truly put the customer at the centre of everything should not need regulation, prudential regulation or conduct regulation.

"The fact that our regulators are taking such a keen interest in banking culture, right now, means that they are not satisfied that the Australian banks are always sufficiently customer-centred," he said.

Henry is spot on, but it isn't just the regulators who are questioning the banks. Prime Minister Malcolm Turnbull told a lunch recently that banks aren't just businesses but "a fundamental pillar, a foundation, of our society and our economy" and that they risked losing their social licence if they kept betraying public trust.