If your organisation does not have a culture in which people can speak truth to power, no system or process of governance or compliance will work, the former banker who blew the whistle on HBOS told an audience of charities yesterday.
Paul Moore was delivering the opening plenary at the ninth annual Trustee Exchange conference in London, entitled 'Governance lessons learned from the banking crisis'.
Dubbed the 'HBOS whistleblower', Moore was the only senior UK banking employee to speak out publicly about the high-risk sales techniques that he witnessed from the inside of a bank. He lost his job as head of group regulatory risk at HBOS as a result, and has been unable to secure another job since.
Moore told the audience of charity trustees and chief executives that having processes and policies in place did not mean that nothing could go wrong, and warned against “letting the process of governance triumph over the purpose”.
Within HBOS at the time, there was a non-executive board, a head of risk, a risk committee and an internal audit function, backed up externally by statutory auditors, regulators and politicians. Yet none of these were able to balance the power of the executive.
“There was obviously something wrong with the process at HBOS but that had nothing to do with there not being enough of it,” said Moore. “There was plenty of policy-itis, email-itis, form-itis, committee-itis.
“Don't let process and policy give you the false assurance that everything is under control. I’m not saying you don’t need it, but it only works so long as the real focus is on people and culture.”
He said it is not difficult to do reviews of culture, and trustee boards ought to make sure they are aware of the culture of their charity. "Don't wait to make it sophisticated, do it fast and make sure you know what the culture of your organisation is."
Moore also mused on the type of person that is best suited to a risk-management role, pointing out that effective handling of risk does not mean avoiding risk completely. He said the ideal personality type was as much about anthropology and psychology as technical competence and experience of making and implementing process.
He concluded that the most important piece of advice he could give the delegates was that control functions such as risk management, internal audit and compliance should "never, ever" report to the executive; they should report to someone senior on the non-executive board.
"Of course, the executive won't like that, they will say that would slow them down," Moore said. "I say they probably should slow down.
"Likewise, if you allow a visionary founder to run a charity with no checks and balances, you will have a disaster on your hands."
- The Charity People & Culture Conference returns on 29 September 2016, with a theme of 'Building workplaces to be proud of'. To book your place or find out more, click here.
