Corporate Governance, Ethics and Compliance Culture

Introduction and context

Banks and insurers are licensed to accept risks that affect depositors, policyholders, investors, payment-system users and the wider economy. Their failures can therefore impose costs far beyond the loss suffered by a single company. Corporate governance in financial institutions is the system through which the organisation is directed, controlled and held accountable. Compliance is the process of ensuring that the institution, its personnel and its business activities meet applicable laws, regulations, supervisory expectations and internal standards. Ethics concerns the values and judgements that guide conduct, including situations where legal rules do not provide a complete answer.

Governance, ethics and compliance are closely related but not identical. A bank may comply technically with a rule while treating customers unfairly. A board may approve extensive policies while failing to challenge management. A compliance department may identify a serious risk but lack access, authority or independence. Effective governance therefore requires more than formal structures: it requires a culture in which responsible conduct is expected, encouraged and demonstrated by leaders.

This chapter adopts a principles-based and jurisdiction-neutral approach. Specific duties vary by country, legal form and supervisory regime. Common reference points include the Basel Committee’s corporate-governance principles for banks, the Financial Stability Board’s work on risk culture and accountability, the OECD Principles of Corporate Governance, the Institute of Internal Auditors’ Three Lines Model, and national fit-and-proper, remuneration, whistleblowing and senior-manager accountability rules.

Learning objectives

By the end of this chapter, students should be able to:

1. Explain the governance responsibilities of boards, committees and senior management.
2. Distinguish the three lines of risk management and understand how they interact.
3. Assess the independence, authority and effectiveness of the compliance function.
4. Explain accountability regimes, remuneration controls and conflicts-of-interest requirements.
5. Evaluate whistleblowing arrangements and professional ethical duties.
6. Analyse how organisational culture influences misconduct and compliance risk.
7. Apply these ideas to a practical banking or insurance case.

1. Corporate governance in financial institutions

Corporate governance allocates decision rights and establishes mechanisms for oversight, challenge and accountability. In a financial institution, governance must address at least five questions:

• Who makes strategic and risk decisions?
• Who is accountable when decisions produce harm?
• What information must reach the board and supervisors?
• How are conflicts between profit, customer protection and safety managed?
• How are failures detected, escalated and corrected?

The board is not expected to manage every transaction. Its role is to set direction, approve risk appetite, oversee management and ensure that the institution remains financially and operationally sound. Senior management is responsible for execution: implementing strategy, maintaining controls, allocating resources and reporting accurately to the board.

The board’s core responsibilities

A competent board normally performs the following functions:

Strategy and risk appetite. The board approves the business model and the level and types of risk the institution is willing to accept. Risk appetite should be expressed in meaningful limits and qualitative statements, not merely in broad aspirations. For example, a retail bank may specify limits for credit concentration, liquidity risk, operational disruption, conduct incidents and regulatory breaches.

Oversight of management. Directors appoint, support and, where necessary, remove senior executives. They should scrutinise performance rather than simply endorse management proposals. Effective challenge is informed, respectful and documented.

Control environment. The board oversees internal controls, compliance, internal audit, financial reporting, data quality and risk management. It should receive information that is timely, accurate and sufficiently independent.

Culture and conduct. The board sets expectations for fair treatment of customers, responsible sales, truthful reporting, respectful employment practices and escalation of concerns. Culture is communicated through decisions about promotions, bonuses and responses to bad news.

Succession and competence. The board should maintain a skills matrix covering finance, risk, technology, legal and regulatory knowledge, insurance or banking operations, and customer or market issues. Collective competence does not remove the need for each director to understand the institution’s principal risks.

Stakeholder protection. Although shareholders are important, directors of regulated firms must also consider depositors, policyholders, creditors, customers, employees, market integrity and financial stability, subject to applicable company and regulatory law.

Board committees

Committees support, but do not replace, the board. An audit committee commonly oversees financial reporting, external audit and internal audit. A risk committee reviews risk appetite, risk exposures and the risk-management framework. A remuneration committee examines incentives and whether pay arrangements encourage excessive risk-taking or misconduct. A nomination or governance committee addresses board composition, succession and evaluation. The exact structure varies; what matters is clear mandates, appropriate expertise, sufficient time and effective reporting to the full board.

A committee can fail even when its terms of reference are well drafted. Common causes include excessive agenda volume, inadequate information, social pressure to agree, lack of specialist expertise and management control over the committee’s materials. Minutes should record significant questions, responses, decisions and dissent where relevant.

2. Senior management and individual accountability

Senior management converts governance decisions into operational practice. Responsibilities commonly include implementing policies, maintaining adequate systems and controls, ensuring regulatory reporting, allocating competent staff, escalating material issues and correcting deficiencies.

Accountability means that responsibility is attached to identifiable people, decisions and outcomes. It does not mean that every adverse event is automatically blamed on one individual. A fair accountability regime distinguishes reasonable judgement under uncertainty from negligence, concealment, reckless behaviour or deliberate misconduct.

A practical accountability framework contains:

1. Clear responsibilities: job descriptions, committee mandates and responsibility maps identify who owns key risks.
2. Decision evidence: significant decisions record assumptions, alternatives, approvals and relevant challenge.
3. Escalation duties: staff know when and how to report breaches, near misses and emerging risks.
4. Supervision: managers monitor delegated activities and investigate warning signs.
5. Consequences: performance management, remediation and disciplinary action are proportionate and consistent.
6. Protection from retaliation: individuals can raise concerns without career punishment.

The board remains accountable for oversight even when tasks are delegated. Delegation transfers execution, not ultimate responsibility for ensuring that the delegated arrangement is appropriate and monitored.

3. The Three Lines Model

The Three Lines Model, associated with the Institute of Internal Auditors, explains how responsibilities for risk and control are organised. It is a model of contribution and accountability, not three isolated departments.

First line: management and operational ownership

The first line consists of business and support managers who own risks arising from their activities. A lending team, for example, must follow underwriting standards, identify suspicious activity, protect customer data and correct errors. First-line controls include approval limits, segregation of duties, reconciliations, system validations and supervisory review.

The first line cannot outsource ownership by saying that compliance or risk should have detected the problem. Business management remains responsible for operating controls and managing risks within approved limits.

Second line: risk, compliance and specialist oversight

The second line provides expertise, frameworks, monitoring and challenge. It may include enterprise risk management, compliance, financial crime prevention, information security risk, model risk and actuarial or prudential oversight. It develops policies, advises the business, tests selected controls and escalates concerns.

The second line should not become the substitute operator of first-line controls. If compliance performs every approval itself, business ownership becomes unclear and compliance may lose the independence needed to challenge the business.

Third line: internal audit

Internal audit provides independent and objective assurance on governance, risk management and control. It evaluates whether the first and second lines are designed and operating effectively. Internal audit should report functionally to the audit committee or board and administratively to an appropriate executive, with safeguards against interference.

Internal audit is not a guarantee that misconduct will never occur. Its work is risk-based and subject to limitations such as sampling, incomplete information and management override.

Governing body and external parties

The governing body is not one of the three lines. It oversees all three and sets expectations. External auditors, supervisors, actuaries, consultants and other external providers are outside the model, although they may provide assurance or challenge. Their involvement does not eliminate management’s or the board’s responsibilities.

4. Compliance function: authority and independence

Compliance is effective when it has sufficient status, expertise, access and resources. Independence does not mean isolation from the business. Compliance must understand products and operations while retaining the ability to challenge them.

Important design features include:

• direct access to the chief executive, board and relevant committees;
• a formally documented mandate approved by the board;
• authority to obtain records and interview personnel;
• adequate staffing, technology and specialist expertise;
• a risk-based compliance plan;
• direct escalation of material breaches;
• protection from removal or disadvantage for performing legitimate challenge;
• periodic independent assessment of effectiveness.

The chief compliance officer’s reporting arrangements should be examined carefully. In many sound models, the officer reports administratively to senior management but has a functional reporting line to the board or a board committee. Pay, appointment and removal should not be controlled solely by the business units being challenged.

Compliance monitoring should distinguish between a policy breach, a legal violation, a control weakness, a customer harm event and a cultural indicator. A low number of recorded incidents may indicate strong controls, but it may also indicate under-reporting or fear of escalation. Metrics therefore require interpretation.

Useful indicators include overdue regulatory actions, repeat findings, complaints, sales cancellations, exception approvals, training quality, speak-up reports, disciplinary consistency and time taken to remediate issues. Quantitative indicators should be combined with qualitative evidence such as interviews, thematic reviews and observed management behaviour.

5. Ethics and professional judgement

Law provides minimum enforceable standards; ethics asks what responsible conduct requires. Ethical reasoning is essential when rules are ambiguous, incentives conflict or a technically permitted action could cause foreseeable harm.

Major ethical approaches provide different perspectives:

• Duty-based ethics: asks whether an action respects obligations, rights and rules.
• Consequence-based ethics: evaluates foreseeable benefits and harms.
• Virtue ethics: focuses on character traits such as honesty, prudence, courage and fairness.
• Stakeholder ethics: considers effects on all materially affected parties, not only shareholders.
• Professional ethics: requires competence, confidentiality, integrity, objectivity and avoidance of misleading conduct.

A practical ethical decision process is:

1. Identify the decision and affected stakeholders.
2. Establish the relevant law, policy and facts.
3. Identify conflicts, incentives and missing information.
4. Consider duties, consequences and fairness.
5. Seek challenge from compliance, risk or an independent colleague.
6. Document the reasoning and decision.
7. Monitor outcomes and reconsider if facts change.

A useful test is whether the decision could be explained honestly to a customer, regulator, board and the public. This is not a substitute for legal analysis, but it exposes concealment, unfairness and weak reasoning.

6. Conflicts of interest

A conflict arises when a personal, financial or organisational interest could improperly influence judgement, or could reasonably appear to do so. Conflicts may be actual, potential or perceived. All three can damage trust.

Typical examples include lending to directors or connected parties, gifts from brokers, employee trading, sales incentives, cross-selling, outside directorships, related-party transactions, procurement relationships and the use of confidential information.

A sound conflict framework includes:

1. identification and periodic declaration;
2. a central register;
3. preventive controls such as segregation, approval limits and information barriers;
4. disclosure where appropriate;
5. recusal from discussion or decision-making;
6. independent approval of related-party transactions;
7. monitoring and disciplinary consequences.

Disclosure alone is often insufficient. If a director has a material interest in a transaction, the stronger response may be non-participation, independent review and a documented decision by disinterested members.

7. Remuneration and risk-taking

Remuneration systems influence behaviour. A bonus based only on short-term revenue can encourage unsuitable sales, excessive leverage, weak underwriting or concealment of losses. Responsible remuneration links reward to sustainable performance, risk outcomes, conduct and customer impact.

Important mechanisms include:

• balanced financial and non-financial performance measures;
• risk adjustment before awards are made;
• deferral of a meaningful portion of variable pay;
• malus, allowing reduction of unvested awards;
• clawback, allowing recovery in defined circumstances;
• restrictions on guaranteed bonuses and inappropriate sales contests;
• independent remuneration governance;
• comparable treatment of similar misconduct across levels of seniority.

Suppose an employee earns a variable award based on a portfolio’s reported profit, but later losses reveal that controls were bypassed. A sound framework may defer part of the award and reduce or recover it, subject to law and the employment contract. The purpose is not automatic punishment for every loss; it is to align reward with the quality and sustainability of the underlying performance.

Remuneration metrics should also avoid encouraging employees to suppress complaints or avoid recording incidents. A low complaint count is not necessarily good performance if customers are prevented from complaining.

8. Whistleblowing and speak-up systems

Whistleblowing is the reporting of suspected wrongdoing, legal breaches, unethical conduct or threats to customers and the public interest. An effective speak-up system offers multiple channels, confidentiality, prompt triage, impartial investigation and protection against retaliation.

The system should clarify:

• what matters can be reported;
• who may report, including contractors where appropriate;
• available internal and legally permitted external channels;
• how anonymity and confidentiality are handled;
• investigation standards and timelines;
• record-keeping and data protection;
• escalation to the board or regulator when required;
• remedies for retaliation.

A hotline is not a culture by itself. Employees use it when leadership demonstrates that bad news is welcome, investigations are credible and retaliation is punished. Management should analyse themes, not merely count reports. A rise in reports may indicate worsening conduct, but it may also indicate increased trust in the system.

9. Culture and misconduct risk

Culture is the pattern of shared assumptions and behaviours that determines how people interpret and respond to situations. It is visible in what leaders reward, tolerate, investigate and ignore. A written code of conduct is one cultural artefact; actual decisions under pressure provide stronger evidence.

Misconduct risk increases where there is:

• unrealistic sales or profit pressure;
• strong hierarchy and fear of challenge;
• tolerance of rule-bending by high performers;
• fragmented accountability;
• poor customer outcomes hidden by aggregate metrics;
• weak supervision of third parties;
• ineffective consequences;
• incentives that reward volume without quality;
• normalisation of deviance, where repeated exceptions become accepted.

Culture can be assessed through surveys, interviews, focus groups, complaints, conduct incidents, turnover, exit interviews, internal audit findings, disciplinary records and patterns in management decisions. No single metric measures culture accurately. Triangulation is essential.

A useful distinction is between stated values, embedded values and experienced values. Stated values appear in codes and speeches. Embedded values appear in systems, incentives and promotion decisions. Experienced values are what employees and customers actually encounter. Misconduct risk is often highest when these three differ substantially.

10. Technology, data and emerging issues

Digital banking, automated underwriting and artificial intelligence create new governance questions. Boards must understand who is accountable for models, data, third-party technology and automated decisions. Relevant risks include biased outcomes, inadequate explainability, privacy breaches, cyber incidents, model drift and over-reliance on vendor assurances.

The Three Lines Model still applies. Business owners remain responsible for the use of an automated system; specialist functions challenge model, privacy, cyber and regulatory risks; internal audit provides independent assurance. Governance should require documented purpose, data quality controls, testing, human oversight, incident escalation and periodic review. Automation does not transfer accountability to an algorithm.

Illustrative case: Northbridge Bank’s sales-culture failure

Background. Northbridge Bank introduced aggressive targets for unsecured consumer lending. Branch managers received bonuses based primarily on monthly loan volumes. Compliance training was completed online, and the board received reports showing strong growth and low formal complaint numbers.

Problem. Internal audit later found that employees were encouraging customers to take unnecessary insurance and were recording incomplete affordability information. Several employees had raised concerns informally, but managers discouraged escalation because the branch was exceeding targets. Compliance had identified unusual cancellation patterns but lacked direct access to the remuneration committee and treated the issue as a local process weakness.

Analysis. The first line failed to own customer and conduct risks. The second line monitored transactions but did not escalate the pattern effectively. Internal audit’s review was delayed because its annual plan focused on credit losses rather than sales conduct. The board relied on volume and complaint metrics without asking whether complaints were being suppressed or whether customers understood the products. Remuneration rewarded short-term output and ignored customer outcomes.

Approach and solution. Northbridge suspended the sales campaign, reviewed affected accounts, refunded inappropriate charges where required and notified the supervisor. It changed incentives to include suitability, cancellation rates, verified customer understanding and substantiated conduct findings. The chief compliance officer gained direct access to the risk and remuneration committees. A speak-up channel was provided to branch employees and contractors. Internal audit conducted a thematic review of sales culture, while the board commissioned an independent investigation into management decisions.

Outcome. The bank incurred remediation and enforcement costs, but it improved the quality of management information and identified similar issues in another product line. Several managers received proportionate disciplinary action. The board began reviewing customer outcomes and conduct themes alongside financial performance.

Learning points. First, low complaints do not prove fair treatment. Second, incentives are governance mechanisms, not merely human-resources tools. Third, compliance independence must include access and escalation authority. Fourth, accountability should examine both individual decisions and system design. Finally, a healthy culture is demonstrated when concerns lead to investigation and correction rather than retaliation.

Challenges and limitations

Governance frameworks have limitations. Rules may encourage a checklist mentality. Boards may receive large volumes of information without understanding its significance. Independence can be weakened by social relationships, career dependence or inadequate expertise. Three-lines labels can create silos and disputes over ownership. Whistleblowing systems can be abused, although that risk should be managed through fair investigation rather than discouraging reports. Remuneration clawbacks may face legal and evidential constraints. Culture metrics are imperfect and can be manipulated.

These limitations support a principles-based approach: define responsibilities clearly, use multiple sources of evidence, investigate anomalies, encourage challenge and continuously test whether formal arrangements operate in practice.

Best-practice checklist

An institution seeking a strong compliance culture should:

• maintain a skilled and constructively challenging board;
• align strategy, risk appetite, incentives and customer outcomes;
• document responsibilities and escalation routes;
• preserve compliance and internal-audit independence;
• use risk-based monitoring and thematic reviews;
• maintain a credible conflict-of-interest register;
• link remuneration to sustainable performance and conduct;
• protect whistleblowers and analyse reporting themes;
• test culture through qualitative and quantitative evidence;
• ensure technology and outsourced services have named accountable owners;
• report material weaknesses honestly and remediate root causes;
• review whether policies are actually understood and followed.

Chapter Summary

Corporate governance in banking and insurance allocates authority, establishes oversight and protects stakeholders from poorly controlled risk. Boards set strategy, approve risk appetite, oversee management, shape culture and ensure that control functions have sufficient authority. Senior management implements strategy, owns operational risks and must provide accurate escalation and reporting.

The Three Lines Model separates operational ownership, specialist oversight and independent assurance. The first line operates controls, the second line advises and challenges, and the third line audits governance and controls. The board oversees all three. Compliance independence depends on access, authority, resources, expertise and protection from interference.

Ethical conduct extends beyond minimum legal compliance. Conflicts of interest require identification, prevention, disclosure and, where necessary, recusal. Remuneration should discourage short-term or harmful risk-taking through balanced measures, deferral, malus and clawback arrangements. Whistleblowing systems work only when employees trust confidentiality, investigation and protection from retaliation.

Finally, culture is a practical determinant of misconduct risk. The real culture of an institution is revealed by incentives, promotion decisions, responses to bad news and treatment of customers and employees. Effective governance therefore combines formal rules with ethical leadership, credible challenge, reliable information and consistent accountability.

Key Terms

Corporate governance: The system by which an organisation is directed, controlled and held accountable.

Risk appetite: The amount and type of risk an institution is willing to accept in pursuit of its objectives.

Conduct risk: The risk that behaviour causes unfair customer outcomes, market harm or other regulatory and ethical failure.

Compliance function: A specialist function that advises, monitors and challenges adherence to laws, regulations and internal standards.

Independence: The ability to exercise objective judgement without inappropriate influence.

Three Lines Model: A framework distinguishing operational ownership, specialist oversight and independent assurance.

First line: Business and operational management that owns risks and operates controls.

Second line: Risk and compliance functions that provide frameworks, monitoring and challenge.

Third line: Internal audit, which provides independent and objective assurance.

Accountability: The obligation of an identified person or body to explain decisions and accept appropriate consequences.

Risk culture: Shared attitudes and behaviours concerning risk-taking, control and escalation.

Conflict of interest: A situation in which personal or organisational interests could improperly influence judgement.

Recusal: Withdrawal from a decision because of a relevant interest or conflict.

Malus: Reduction or cancellation of an unvested remuneration award.

Clawback: Recovery of remuneration already paid in specified circumstances.

Whistleblowing: Reporting suspected wrongdoing, breaches or threats to the public interest.

Retaliation: Adverse treatment imposed because a person raised a concern or participated in an investigation.

Fit and proper: The standard that individuals performing important functions must be competent, honest and suitable.

Normalisation of deviance: Acceptance of repeated exceptions until unsafe or improper behaviour appears normal.

Review Questions

Short Answer Questions

1. What are the principal governance responsibilities of a bank’s board?
2. Distinguish the first, second and third lines in the Three Lines Model.
3. Why should compliance have direct access to the board or a board committee?
4. What is the difference between malus and clawback?
5. Why is a low number of whistleblowing reports not necessarily evidence of a healthy culture?

Long Answer Questions

1. Explain how board oversight and senior-management accountability interact in a regulated financial institution.
2. Evaluate the strengths and limitations of the Three Lines Model.
3. Discuss how remuneration design can create or reduce misconduct risk.
4. Explain the relationship between professional ethics, legal compliance and customer protection.
5. Analyse how a board can assess whether the institution’s experienced culture matches its stated values.

Analytical / Application Questions

1. A bank’s highest-producing sales team has the lowest complaint rate, but employees privately report that managers discourage complaints. What evidence should the board request, and what actions should it consider?
2. The chief compliance officer discovers a material breach involving a powerful business head. The chief executive asks compliance to resolve the matter quietly. Analyse the governance and independence issues and propose an escalation process.
3. An insurer uses an automated pricing model that produces systematically higher premiums for a protected customer group. Apply the Three Lines Model and ethical decision process to determine the appropriate response.

Multiple Choice Questions with Answers

Question 1

Which body has ultimate oversight responsibility for the institution’s governance, risk and control framework?

A. The board or governing body

B. The compliance department

C. The external auditor

D. The sales department

Correct Answer: A. The board or governing body

Question 2

Which activity belongs primarily to the first line of the Three Lines Model?

A. Providing independent assurance

B. Owning operational risks and operating controls

C. Setting external accounting standards

D. Appointing the supervisor

Correct Answer: B. Owning operational risks and operating controls

Question 3

What is a central feature of compliance independence?

A. Avoiding all contact with business units

B. Having authority and access to escalate material concerns

C. Reporting only to the sales director

D. Performing every operational control personally

Correct Answer: B. Having authority and access to escalate material concerns

Question 4

Which remuneration mechanism reduces an unvested award?

A. Recusal

B. Clawback

C. Malus

D. Disclosure

Correct Answer: C. Malus

Question 5

Why can disclosure alone be insufficient for a conflict of interest?

A. Disclosure always violates confidentiality

B. The conflicted person may still influence the decision

C. Disclosure eliminates the need for records

D. Conflicts are never capable of management

Correct Answer: B. The conflicted person may still influence the decision

Question 6

Which statement best describes internal audit?

A. It owns all first-line controls

B. It provides independent and objective assurance

C. It approves every customer transaction

D. It replaces the board

Correct Answer: B. It provides independent and objective assurance

Question 7

A rise in whistleblowing reports may indicate that:

A. Misconduct has certainly increased

B. The reporting system may be trusted more

C. All reports are false

D. Compliance is no longer necessary

Correct Answer: B. The reporting system may be trusted more

Question 8

What is normalisation of deviance?

A. The independent review of controls

B. The acceptance of repeated exceptions as normal behaviour

C. The formal appointment of a director

D. The recovery of variable pay

Correct Answer: B. The acceptance of repeated exceptions as normal behaviour

Question 9

Which practice most directly reduces short-term sales misconduct?

A. Rewarding volume alone

B. Removing all customer feedback

C. Including customer outcomes and conduct in remuneration

D. Delaying all compliance reports

Correct Answer: C. Including customer outcomes and conduct in remuneration

Question 10

In the Three Lines Model, who remains responsible for operational risk after compliance provides advice?

A. The business or operational management

B. The external auditor

C. The regulator

D. The board committee alone

Correct Answer: A. The business or operational management