Leaked NAB interviews: compliance risk sat 'red' for 20 months as bosses stayed confident

In the winter of 2018, with National Australia Bank reeling from the banking royal commission's revelations about shoddy customer treatment and foot-dragging compensation, chairman Ken Henry sat for a confidential EY interview to help prepare the risk-management and culture report APRA required. Startlingly, the minutes record Henry saying he was 'confident' the bank was still selling products that would trigger customer compensation in the future, highlighting SMSF borrowing to invest in managed funds as an example.

The interview minutes were part of a trove leaked to the Herald and The Age by a whistleblower who felt the royal commission had glossed over problems. It included minutes of more than 70 interviews with NAB executives and directors — Henry, CEO Andrew Thorburn, Mike Baird and Phil Chronican — plus EY's internal observations and risk reports. They revealed a flawed approach to risk, poor controls, technology challenges, failure to fix compliance issues and slow remediation, plus wealth-division problems, new AML breaches and a financial-crime risk rating of 'excessive' and 'not effective'.

NAB's own dashboard told the story: compliance risk had been 'red' on its traffic-light system for at least 20 months, operational risk 'amber' for 35 months and regulatory risk 'amber' for 26 months. A 'highly confidential' report by then-chief risk officer David Gall said the bank's risk profile and outlook remained 'amber' as it battled financial-crime challenges, regulatory investigations and technology issues. Much of this material, the whistleblower noted, did not make it into EY's draft report.

The chairman's confidence that compensation-triggering products were still being sold showed the board understood the exposure but treated it as business as usual.

Red and amber ratings persisting for years indicated, in the whistleblower's words, a breakdown in the capability of people, processes and technology inside the bank.

Compliance alerts that do not work properly, insiders warned, are precisely what turns into scandals and consumer detriment.

A review process that let senior executives' admissions stay out of the draft report raised questions about the value of the APRA-monitored self-assessment itself.

A bank can know exactly how sick it is — red ratings on the dashboard for years — and still not act until an outside review makes the sickness public.

The SMH and The Age published the leak in August 2019, as Phil Chronican was preparing to take over from Henry as chairman. The articles noted it was unclear whether EY's final report contained the material, and that the leaked documents raised questions about the prudential regulator's monitoring process for major banks. The source article does not report APRA's response to the leak.