Corporate Governance, Ethics and Accountability

Introduction and Context

Corporate governance in banking is the system through which a bank is directed, controlled and held accountable. It allocates authority among shareholders, the board, senior management, control functions, supervisors and other stakeholders. Governance is strategically important because banks operate with high leverage, substantial maturity transformation, public confidence and often an implicit or explicit social safety net. A governance failure can therefore create losses not only for investors but also for depositors, taxpayers and the wider financial system.

Banking governance is broader than compliance with company law. It concerns the quality of decisions, the reliability of information, the management of conflicts, the independence of challenge and the ethical standards that shape behaviour when rules do not provide an obvious answer. International supervisory expectations, including the Basel Committee’s principles for corporate governance, generally emphasise an effective board, capable senior management, independent risk and compliance functions, robust internal controls, sound remuneration and a strong risk culture.

A useful distinction is between governance, which determines direction and oversight; management, which executes strategy; and control, which provides assurance that strategy is pursued within approved risk appetite and legal requirements. These functions must cooperate, but they must not become indistinguishable.

Learning Objectives

By the end of this chapter, the reader should be able to:

1. Explain the structure and purposes of governance in banks.
2. Assess the responsibilities of boards, committees and senior management.
3. Evaluate the independence and effectiveness of risk, compliance, internal audit and other control functions.
4. Analyse remuneration, conflicts of interest, whistleblowing and professional ethics.
5. Explain accountability regimes and the relationship between individual conduct and organisational responsibility.
6. Assess how risk culture, technology and artificial intelligence influence governance.

1. Why Banking Governance Is Distinctive

Banks accept deposits, extend credit, operate payment systems and transform short-term liabilities into longer-term assets. Their balance sheets are therefore sensitive to liquidity shocks, credit losses, market movements and confidence effects. Governance must address at least five distinctive features:

• Leverage: relatively small asset losses can materially reduce capital.
• Opacity: the quality of loans, models and off-balance-sheet exposures may be difficult for outsiders to assess.
• Interconnectedness: one institution’s distress can affect counterparties and markets.
• Public interest: depositors and payment-system users depend on continuity and trust.
• Information asymmetry: directors, managers, customers and investors rarely possess equal information.

The central governance problem is an agency problem. Managers may pursue growth, compensation or personal status even when those objectives increase risks borne by shareholders, creditors or the public. Directors are expected to monitor management, but directors themselves may lack information or independence. Regulation, disclosure, fiduciary duties, assurance functions and supervisory review reduce—but do not eliminate—these problems.

A sound governance system must answer four questions:

1. Who has authority to decide?
2. What information must decision-makers receive?
3. Who challenges decisions and tests controls?
4. What consequences follow from poor decisions or misconduct?

2. The Governance Architecture

2.1 The board of directors

The board is collectively responsible for the long-term safety, soundness and viability of the bank. Its duties normally include approving strategy, risk appetite, capital and liquidity planning, major policies, financial statements, succession arrangements and the control framework. It should also oversee culture, conduct, material outsourcing, recovery planning and the effectiveness of remediation.

A board is not effective merely because it meets frequently. Effectiveness depends on competence, independence, diversity of experience, access to reliable information, constructive challenge and sufficient time. Non-executive directors should be willing to question optimistic forecasts, aggressive growth targets and explanations that are unsupported by evidence.

The chair leads the board and should promote open discussion without becoming an alternative chief executive. The chief executive implements strategy and manages the institution. Combining these roles may weaken challenge and is generally inappropriate for a large or complex bank unless there are exceptional safeguards.

2.2 Board committees

Common committees include:

Committees prepare and scrutinise matters, but delegation does not remove the board’s collective accountability. Committees need clear mandates, appropriate membership, direct access to control functions and escalation rights.

2.3 Senior management

Senior management translates board-approved strategy into policies, limits, systems and behaviour. It is responsible for identifying and managing risks, maintaining adequate resources, implementing controls, reporting accurate information and correcting weaknesses. Executives should not treat the board as a formal approval mechanism; they must provide candid, timely and decision-useful information.

The chief risk officer, chief compliance officer and chief audit executive have specialised responsibilities. Their precise legal status varies by jurisdiction, but independence, authority, expertise and access to the board are essential. A control officer who can be dismissed, overruled or financially penalised by the business being reviewed may be nominally independent but practically ineffective.

3. The Three Lines and Internal Control

The “three lines” model is a practical way to allocate responsibility:

1. First line—business and operations: own risks, serve customers, follow procedures and operate controls.
2. Second line—risk and compliance: establish frameworks, monitor adherence, advise management and challenge risk-taking.
3. Third line—internal audit: provide independent, risk-based assurance on governance, risk management and controls.

The model is not a rigid organisational chart. Some specialist functions may operate across lines, and external audit and supervisors are outside the three internal lines. Its essential principle is that risk ownership cannot be outsourced to compliance or internal audit.

Internal control commonly includes:

• control environment and ethical leadership;
• risk assessment;
• preventive and detective control activities;
• information and communication; and
• monitoring and remediation.

Examples include segregation of duties, maker-checker approval, access controls, reconciliations, credit limits, transaction surveillance, model validation, incident reporting and business-continuity testing. Controls should be proportionate to risk. Excessive controls can create delay and workarounds; weak controls can permit fraud or error.

Internal audit should be independent from operational management, use a risk-based plan, report significant findings to the audit committee and track remediation to closure. “Issue closure” should mean that the underlying cause has been addressed and effectiveness tested, not merely that a policy has been rewritten.

4. Compliance Independence and Regulatory Accountability

Compliance is a management responsibility supported by an independent compliance function. The function should identify legal and regulatory obligations, advise on new products, monitor conduct, investigate breaches, train staff and report material weaknesses. It must have adequate resources, unrestricted access to records and personnel, and a direct reporting channel to the board or an appropriate committee.

Independence has several dimensions:

• Structural: appropriate reporting to the chief executive and board committee.
• Economic: remuneration not determined solely by revenue-producing units.
• Operational: authority to investigate and escalate without prior business approval.
• Cognitive: willingness to challenge established assumptions.

Compliance should not become a “tick-box” function. A bank may have complete policies while incentives, systems or managerial pressure make compliance unrealistic. Effective compliance therefore combines rules with monitoring of actual behaviour and customer outcomes.

Accountability operates at multiple levels. The institution may face fines, licence restrictions, capital consequences, remediation orders or litigation. Individuals may face disciplinary action, bonus reduction, removal, prohibition, civil liability or criminal sanctions where applicable. A fair accountability regime distinguishes intentional misconduct, reckless disregard, negligence, reasonable error and system failure. Accountability is weakened when responsibility is so widely distributed that no individual can be identified, or so narrowly assigned that organisational causes are ignored.

5. Remuneration and Incentives

Remuneration is a governance mechanism because it influences risk-taking. A sound policy should consider financial and non-financial performance, risk-adjusted outcomes, conduct, customer treatment, capital usage and sustainability of results. Variable pay should not reward short-term revenue that later produces losses or regulatory breaches.

Important tools include:

• deferral of variable remuneration;
• retention in shares or other long-term instruments;
• malus, which reduces unpaid awards; and
• clawback, which recovers awards already paid in defined circumstances.

These tools are not substitutes for good judgement. Their effectiveness depends on clearly drafted conditions, reliable performance measurement and enforcement. Remuneration committees should test whether targets encourage loan growth without underwriting discipline, sales without suitability, or trading profits without adequate capital and liquidity.

A simple conceptual test is:

This is not a universal accounting formula. It is a governance framework for asking whether reported performance remains satisfactory after foreseeable losses, resource usage and misconduct consequences are considered. The terms must be defined consistently and should not be interpreted as a replacement for regulatory capital calculations.

6. Conflicts of Interest

A conflict exists when a personal, financial, relational or institutional interest could improperly influence judgement, or appear to do so. Banking examples include lending to directors, preferential treatment of connected parties, investment-banking conflicts, gifts from suppliers, personal trading, related-party transactions and “revolving door” relationships with regulators or vendors.

An effective conflict framework requires:

1. identification and periodic disclosure;
2. a central register where appropriate;
3. recusal from relevant decisions;
4. independent approval and arm’s-length terms;
5. documentation and monitoring; and
6. disciplinary consequences for concealment.

Disclosure alone is insufficient. A director who declares a personal relationship but continues to influence the decision has not adequately managed the conflict. The board should also consider perceived conflicts because trust depends on reasonable observers believing that decisions are impartial.

7. Whistleblowing and Speaking Up

Whistleblowing systems allow employees and other stakeholders to report suspected misconduct, control failure or legal breach. They are especially valuable where hierarchy, sales pressure or group loyalty suppresses ordinary escalation.

A credible framework provides confidential or anonymous channels, independent case handling, protection against retaliation, triage based on seriousness, documented investigation standards and feedback to the reporter where legally possible. The board should receive aggregated information about cases, themes, delays, substantiation rates and retaliation allegations.

A high volume of reports does not necessarily indicate poor culture; it may indicate that employees trust the system. Conversely, a low volume may reflect fear, ignorance or ineffective channels. Management should examine both reported events and “near misses” that were resolved before causing harm.

8. Professional Ethics and Risk Culture

Professional ethics concerns the standards by which decisions are made, not merely whether conduct is technically legal. Core principles include integrity, competence, objectivity, confidentiality, fairness, accountability and respect for customers and colleagues.

Risk culture is the shared pattern of values, incentives, assumptions and behaviours concerning risk. It is visible in what leaders pay attention to, reward, tolerate and investigate. A strong risk culture does not mean avoiding all risk. Banks must take measured risk to perform their economic function. It means that risk-taking is understood, authorised, monitored and consistent with capacity and appetite.

Indicators of culture may include:

• quality and timeliness of escalation;
• willingness to challenge senior staff;
• frequency of control overrides;
• treatment of complaints and audit findings;
• staff turnover in control functions;
• incentive outcomes after misconduct;
• survey evidence on psychological safety; and
• consistency between stated values and executive behaviour.

Culture measures are imperfect. Surveys may be affected by fear or response bias, while incident data reflects only detected events. They should therefore be triangulated with interviews, customer outcomes, control testing and independent review.

9. Accountability Regimes and the “Duty to Act”

Modern regimes increasingly seek to identify the individuals responsible for material decisions. Examples include senior manager certification systems, conduct rules, statements of responsibilities and “reasonable steps” obligations. The objective is not automatic punishment for every failure. It is to prevent responsibility gaps and encourage active oversight.

A senior manager should be able to demonstrate:

• a clear mandate and delegated authority;
• adequate knowledge and resources;
• effective monitoring;
• timely escalation;
• records supporting significant decisions; and
• reasonable action when weaknesses are identified.

Documentation is important, but retrospective paperwork cannot cure an absence of supervision. Conversely, accountability should recognise collective decision-making and the limits of reasonable prediction. Boards should avoid creating a defensive culture in which employees conceal uncertainty merely to protect themselves.

10. Technology, Data and Artificial Intelligence

Digital banking increases governance complexity. Automated credit decisions, cloud outsourcing, algorithmic surveillance and generative AI can improve efficiency but introduce model risk, cyber risk, privacy concerns, bias and third-party dependency.

Governance should require clear ownership of each material model or AI system, documented purpose and data provenance, validation, performance monitoring, explainability proportionate to use, human escalation and secure change management. A vendor’s assurance report does not transfer accountability away from the bank. The board should understand material limitations even when it does not understand the technical code.

AI-generated advice or documentation should not be accepted without human review. In regulated decisions, audit trails should show the data used, model version, approval authority, overrides and subsequent outcome. Governance must also address unauthorised use of confidential customer information in external AI tools.

11. Illustrative Case: The Rapid Growth Bank

Background

Rapid Growth Bank (RGB), a fictional regional bank, doubled its small-business loan portfolio in two years. The board celebrated growth, while remuneration was strongly linked to loan volume and quarterly revenue. The chief risk officer attended executive meetings but reported administratively to the chief executive, whose bonus depended on expansion.

Problem

Internal audit found rising exceptions to underwriting policy, incomplete customer affordability files and repeated overrides by senior sales managers. Compliance reported the issue to management but did not escalate it promptly to the risk committee. Several employees used an anonymous channel to report pressure to approve weak applications. The reports were classified as “performance complaints.”

Analysis

The failure was not caused by one defective policy. It involved interconnected governance weaknesses: misaligned incentives, insufficient independence, weak board information, cultural suppression of challenge and poor issue classification. The board saw growth as evidence of strategy execution but did not demand risk-adjusted performance or cohort loss analysis.

Approach and solution

The board appointed an independent review team and required immediate reporting to the risk committee. RGB paused the highest-risk product, reassessed affected loans and strengthened affordability controls. The chief risk officer received direct access to the risk committee. Remuneration was revised to include portfolio quality, conduct and customer outcomes, with deferred awards subject to malus and clawback. Whistleblowing cases were reclassified and investigated independently. The board introduced a dashboard covering policy exceptions, early arrears, override rates, complaints and unresolved audit findings.

Outcome

Short-term growth declined, but underwriting quality improved and the bank identified losses earlier. Several managers were disciplined for intentional circumvention, while process weaknesses were addressed through training and system controls. The case demonstrated that accountability must address both individual behaviour and organisational design.

Learning points

1. Growth is not inherently evidence of sound performance.
2. Independence must be practical, not merely formal.
3. Speak-up data is a governance signal.
4. Incentives should reflect the time horizon of banking risk.
5. Boards need information about exceptions and outcomes, not only aggregate targets.

12. Challenges and Limitations

Governance frameworks face several limitations. First, formal compliance can coexist with unethical behaviour. Second, directors may suffer from information overload and fail to identify the most important signal. Third, independence can reduce operational knowledge if control functions are isolated from the business. Fourth, risk culture is difficult to measure reliably. Fifth, accountability regimes may produce excessive conservatism, slow decisions and defensive documentation. Finally, global banking groups must reconcile different legal standards, cultures and supervisory expectations.

These limitations support a principle of proportionality: governance should be rigorous in relation to risk, complexity and systemic importance, while remaining understandable and usable. Independent challenge should be strong, but management must retain responsibility for decisions.

13. Best-Practice Governance Questions

A board assessing its governance should ask:

• Do we know the bank’s most material current and emerging risks?
• Can control functions escalate directly and safely?
• Does remuneration reward sustainable, risk-adjusted performance?
• Are conflicts disclosed, managed and independently approved?
• Do employees believe that speaking up is safe?
• Are audit and regulatory findings corrected at root cause?
• Can we identify the individual accountable for each material responsibility?
• Do dashboards show customer outcomes, exceptions and near misses?
• Are technology and third-party risks governed as seriously as traditional credit risk?
• Does executive behaviour match the bank’s stated values?

Chapter Summary

Corporate governance in banking allocates authority, information and accountability among the board, management, control functions, shareholders, supervisors and stakeholders. Its purpose is not simply procedural compliance but the safe and ethical pursuit of strategy. Boards are collectively responsible for oversight, while senior management executes strategy and owns day-to-day risk. The three-lines model clarifies that business units own risk, risk and compliance functions challenge and monitor it, and internal audit provides independent assurance.

Effective governance requires genuinely independent compliance and audit functions, credible remuneration arrangements, disciplined conflict management and protected whistleblowing. Accountability regimes should identify individual responsibilities while recognising organisational causes and reasonable limits of foresight. Risk culture is revealed through incentives, escalation, challenge and responses to bad news. Technology and AI create new governance demands involving model ownership, data, explainability, cybersecurity and human oversight. The strategic test is whether governance enables informed, ethical and sustainable risk-taking rather than merely producing policies and minutes.

Key Terms

Governance: The system by which an institution is directed, controlled and held accountable.

Board accountability: The collective responsibility of directors for oversight and stewardship.

Risk appetite: The level and types of risk a bank is willing to accept in pursuit of objectives.

Senior management: Executives responsible for implementing strategy and managing operations.

Three-lines model: A framework distinguishing risk ownership, oversight and independent assurance.

Internal control: Processes designed to manage risk, support reliable reporting and promote compliance.

Compliance independence: The ability of compliance personnel to challenge and escalate without improper influence.

Internal audit: An independent assurance function assessing governance, risk management and controls.

Remuneration governance: Oversight of pay and incentives to align behaviour with sustainable performance.

Malus: Reduction of an unpaid or deferred award.

Clawback: Recovery of remuneration already paid under specified conditions.

Conflict of interest: A situation in which personal or institutional interests may improperly influence judgement.

Whistleblowing: Reporting suspected wrongdoing through protected internal or external channels.

Risk culture: Shared values and behaviours concerning risk-taking and control.

Conduct risk: The risk of harming customers, markets or integrity through inappropriate behaviour.

Accountability regime: Rules assigning responsibilities and consequences to institutions and individuals.

Model risk: The possibility that a model is unsuitable, incorrectly implemented or misused.

Psychological safety: The perceived ability to raise concerns without fear of retaliation.

Review Questions

Short Answer Questions

1. Why is governance in banking more consequential than governance in many non-financial firms?
2. Distinguish the responsibilities of the board and senior management.
3. What are the three lines in the three-lines model?
4. Explain the difference between malus and clawback.
5. Why is disclosure alone insufficient for managing a conflict of interest?

Long Answer Questions

1. Evaluate the role of board committees in supporting, but not replacing, collective board accountability.
2. Discuss the conditions required for an effective and independent compliance function.
3. Explain how remuneration can produce excessive risk-taking and how governance can respond.
4. Analyse the relationship between whistleblowing systems and risk culture.
5. Discuss how accountability regimes should balance individual responsibility with organisational causes of failure.

Analytical / Application Questions

1. A bank’s chief executive receives a bonus based mainly on quarterly loan growth, while early arrears and policy overrides are increasing. Analyse the governance weaknesses and propose revised performance measures.
2. Internal audit discovers that a vendor’s AI credit model produces materially different approval rates across customer groups. Design a governance response covering investigation, customer protection, model oversight and board reporting.
3. Employees report that a senior director pressures staff to bypass controls, but the reports are not escalated because the director is commercially successful. Assess the failures in accountability, independence and culture, and recommend corrective action.

Multiple Choice Questions with Answers

Question 1

Which body has primary collective responsibility for approving a bank’s strategy and risk appetite?

A. The external auditor

B. The board of directors

C. The sales department

D. The payment-system operator

Correct Answer: B. The board of directors

Question 2

In the three-lines model, who owns day-to-day business risk?

A. The first line, consisting of business and operations

B. The external supervisor

C. The internal audit function

D. The remuneration committee

Correct Answer: A. The first line, consisting of business and operations

Question 3

What is the principal purpose of malus?

A. To increase an employee’s fixed salary

B. To reduce an unpaid or deferred award

C. To transfer a loan to another bank

D. To remove the need for performance assessment

Correct Answer: B. To reduce an unpaid or deferred award

Question 4

Which feature most directly supports compliance independence?

A. Exclusive reporting to the revenue-producing business unit

B. Authority to investigate and escalate without business approval

C. Remuneration based only on sales volume

D. Prohibition on access to the board

Correct Answer: B. Authority to investigate and escalate without business approval

Question 5

Why can a low number of whistleblowing reports be misleading?

A. It always proves that controls are effective

B. It may reflect fear or lack of trust in reporting channels

C. It automatically demonstrates excessive regulation

D. It proves that misconduct has been eliminated

Correct Answer: B. It may reflect fear or lack of trust in reporting channels

Question 6

A conflict of interest is best managed when the interested decision-maker:

A. Discloses the conflict and continues to control the decision

B. Keeps the conflict confidential

C. Recuses themselves and the matter receives independent approval

D. Receives a larger performance bonus

Correct Answer: C. Recuses themselves and the matter receives independent approval

Question 7

Which function provides the third line of independent assurance?

A. The lending team

B. The compliance training team

C. Internal audit

D. The marketing department

Correct Answer: C. Internal audit

Question 8

Which is the best example of risk-adjusted remuneration?

A. Rewarding only the number of loans originated

B. Rewarding revenue while ignoring later losses

C. Considering sustainable performance, risk cost and conduct outcomes

D. Paying identical bonuses regardless of results or behaviour

Correct Answer: C. Considering sustainable performance, risk cost and conduct outcomes

Question 9

What is a central governance concern when a bank uses an external AI vendor?

A. The bank has no accountability for the vendor’s decisions

B. The bank must retain ownership of material model and customer risks

C. Human review becomes unnecessary

D. Data provenance is irrelevant

Correct Answer: B. The bank must retain ownership of material model and customer risks

Question 10

Which statement best describes a strong risk culture?

A. The bank avoids all risk

B. Risk-taking is hidden to preserve confidence

C. Risk is understood, authorised, monitored and consistent with capacity

D. Only the compliance department is responsible for risk

Correct Answer: C. Risk is understood, authorised, monitored and consistent with capacity