In performing an independent review of a breach incident that was reported to the local regulator, my remit was clear – to understand how the root cause was not picked up earlier. If it was picked up earlier, arguably management could have acted on it quickly and thus avoid the regulatory scrutiny the organisation eventually had to endure.
The review, spanning several departments and different ‘control’ points, pointed to one main issue – people were not speaking up when they sensed something wrong. Intrigued by this finding, we started delving into this a bit more. What became apparent were these common attributes:
- Staff had a sense that something was not quite right, but weren’t thoroughly convinced that it was something that should be escalated and looked into more carefully.
- Staff trusted, whether blindly or otherwise, that a person more senior/competent/experienced then them would have either picked this up already, or would pick it up as it went up the ‘food chain’.
- Where staff did raise an issue with their manager, they did not actively follow up to enquire about the status of the issue reported, either because they forgot, or because they did not wish to further intrude on the manager’s time, or simply because they felt that their job was done.
- Where it was cross-divisional, there was a question mark about who should report the issue as well as a question about to whom the issue should be reported to, with no clear line of accountability or responsibility.
While much has been said about creating the right environment for speaking up, less has been acknowledged about the practical difficulties and realities of building (or re-building, as the case may be) a culture that encourages people to speak up without fear. Some of the barriers include:
- Cultural differences – diverse teams in terms of gender, nationality, race, upbringing etc naturally means differences in the way people communicate with one another, be it peers, subordinates or people more senior in authority and rank. There are many cultures that view authority figures as positions that need to be respected, so raising your voice may be seen to be career-limiting.
- Organisational complexity – organisational silos is the antithesis of open and transparent communication. Some issues don’t have natural ‘homes’, and it takes a dedicated staff member who will search and find someone that they can report their concern to, without fear of sounding ‘silly’ or wasting time. Given this challenge, staff members resort to just parking their concerns with their immediate manager, and leaving it at that, which leads to the next problem….
- Time vs benefit – we can all relate to this, especially Managers. We have limited time to work on a never-ending stream of things that come our way. Dealing with a concern will only ever get the attention it deserves if the person who raises it in the first place is either persistent, or presents a compelling reason for me to give it the time of day. Or both. Which brings us to the last point…
- Competence and experience – it takes a competent, inquisitive, curious or experienced staff member to identify a concern in the first place. It takes an even braver, more courageous person to actually take the necessary time and effort to report the issue and co-operate in any subsequent investigation.
So, the challenges are clear. The answers are less clear. We’ve heard it before – set the right tone from the top. Create open lines of communication. Reset values and embed them through training. Improve processes so that there are easier ways to report concerns. Create anonymous concern hotlines. Actively encourage people to speak up. Respond to concerns raised in a timely manner. All these are right, and good, and will no doubt help with addressing the issue head-on. After all, any action is better than total inaction. But care must be taken to take a whole-of-organisation approach to resolving the issue rather than band-aid solutions alone.
Alas, there is no silver bullet and no blueprint that guarantees success. But I am encouraged by the principles laid out by the Financial Conduct Authority regarding the 5 conduct rules that apply to all financial service individuals. While not prescriptive, it provides clear fundamental expectations of anyone working in financial services in relation to their expected conduct – a ‘true north’, if you may – principles that should prevail in every decision we make as responsible and accountable individuals of the organisations we represent. It is this true north that should empower us to speak up and feel completely justified in doing so without any fear.
For the record, I think rule number 4 is the most important principle that should be embedded into every single individual who has the distinction of working in financial service : to pay due regard to the interests of customers and to treat them fairly. Because, ultimately, we are all customers, and we have every right to be treated with fairness, respect and dignity. If we expect this of ourselves, shouldn’t we accord the same to others?
Join Meetig8 and the Institute of Risk Management as we delve further into the topic of accountability, risk culture and conduct in financial services with Aileen Gillan, Chief Risk Officer of Metro Bank and Richard Gossage, ex-PwC Risk Partner and Managing Director of Copper Bottom Enterprises at our January Networking Event. Click here for further details. Tickets are limited.