August 29 2023

In light of recent cases, it is worth exploring why it is hard for people to speak up about concerns and, often, even harder for people to take them seriously. My second column for GRIP below.

How the human factor affects the culture of whistleblowing

Photo by Sammie Chaffin on Unsplash

August 18 2023

7 murdered babies. Attempts to murder 7 more.

A hospital’s reputation in ruins.

(Oh – and another inquiry to report on all the lessons to be learnt. Like the ones not learnt from previous inquiries. Just as these ones won’t be.)

It is not too cynical to say that care for the hospital’s reputation – rather than investigating serious concerns about staff responsible for babies in their care – was almost certainly one of the main reasons why senior NHS managers, many of them trained doctors and nurses, sought over a year to dismiss and disregard repeated concerns and red flags raised by doctors about Lucy Letby, the nurse found guilty of those murders.

They didn’t just ignore them. According to this Panorama report, they warned off the doctors, threatening them with “consequences“, including possible referral to the GMC. A line had apparently been crossed by daring to criticise a nurse described as “nice Lucy“. After two triplets died, duty executive Karen Rees, who refused to take Letby off duty against the wishes of 7 consultant paediatricians, was asked if she would take responsibility for anything that might happen to other babies and replied “yes“. We will learn now, won’t we, what value to place on that “yes“.

Why do senior executives do this? To protect the institution’s reputation is the usual reason. It never works. When you fail to look into concerns when first raised – and it really doesn’t matter which sector you’re in – the NHS, the police, banks, the press, Parliament, the army, the Guides, churches, the Post Office, oh just about anywhere, let’s face it – these are the consequences:

• A small problem turns into a bloody big crisis.
• You trash your reputation
• You lose trust.
• You’ll be clearing up the mess for years.
• It will take longer than you can possibly imagine to rebuild that trust. Do not fool yourself into believing that quickly shuffling some people around (even out), some shiny new procedures and training, no matter how brilliant, will do it.

It is not the first time the NHS has got itself into these sorts of difficulties. Its treatment of whistleblowers has long been appalling. Similar events happened – and for many of the same reasons – at the Gosport War Memoral Hospital (see my commentary here on the report issued in June 2018). And that is only one of many. NHS management seems utterly oblivious to The Public Interest Disclosure Act 1998. The NHS – like the police – is one of those sacred cows that confuses the importance of its function with the importance of the institution and the egos of those running it, focused on their Key Performance Indicators (none of which would have included “murders solved“). This is a fatal flaw, inimical to the establishment of a healthy work culture. Politicians – those available in the foreseeable future anyway – are unwilling or unable to challenge or change this.

There is another reason why senior staff behave like this.

Cowardice.

Taking a concern seriously means exercising judgment and taking action. The judgments to be made will be difficult. There is no procedure which can act as a substitute for good judgment. The actions will often be tough. So it is easier – much easier – to do nothing (or the minimum you think you can get away with) and tell those bringing unwelcome news to keep quiet.

Senior staff would do well to remember these words:

“All organizations have bad apples but what an organization ….. also has is well paid and exquisitely educated bosses, part of whose job is to spot these bad apples and, if they are spotted, deal with them.”

Who said this? Andy Webb, the BBC journalist, who uncovered the story of how Martin Bashir and Panorama (oh, the irony!) got that interview with Diana, in May 2021. He said about the bosses who failed to do anything about the ethical breach they knew had happened: “It’s my feeling the bosses were not brave enough …. and it prompted the cover up.”

Not brave enough. That’s the only lesson to learn right there.

March 18 2023

It is a measure of how seriously the Swiss authorities view Credit Suisse’s position that they are, according to weekend reports, orchestrating a UBS takeover or rescue.

The Terrible Two

It is not the first time that a merger of these banking behemoths has been considered. Last time it was Credit Suisse which considered acquiring UBS when it was in serious difficulties after the 2008 Global Financial Crisis. UBS survived, with Swiss government backing, shareholder cash, endless cost-cutting and, eventually, after a revolving door of unmemorable CEO’s for its troubled investment bank, a return to its strengths: wealth and asset management not the chimera of an all-singing, all-dancing full service global bank able to compete with the US. Investment banking was scaled down but focused under Orcel’s leadership. Doing this required not just a reset of its business but its culture, which had underpinned and led to so many of its problems. It took — after some false starts — a decade and a lot of hard work at every level before the changes became effective and properly embedded.

It was not just banks which had to rethink themselves. So did the Swiss financial and political establishment. For the best part of a century, Switzerland’s financial USP was discretion, carefully protected by banking secrecy laws. Or, more bluntly, Swiss banks were where you hid your money, few questions asked. That ended as a result of US fury on discovering how UBS and others, including Credit Suisse (fined $2.6 billion in 2014) had helped US taxpayers evade tax. So the new USP became expertise: put your money in Switzerland not to hide it but because Swiss bankers know how to manage it well.

Credit Suisse’s current travails blow a hole in that. How is it that, despite all the regulatory changes, all the scrutiny, all the lessons learned (surely?), all the training, all the rules, Credit Suisse has got itself into such a mess that its acquisition by its rival is now even in contemplation? And if such a large, important bank can get into such a mess, what does it say about Swiss expertise and, indeed, Swiss regulatory effectiveness?

Blowing the whistle?

One clue may be in the reason for its announcement on 9 March of a delay to its 2022 annual report after a “late call from the US Securities and Exchange Commission” the previous day. Why was the SEC making comments about the “technical assessment of previously disclosed revisions to the consolidated cashflow statements” in 2019 and 2020 and — this is the kicker — “related controls” in March 2023 in a late night call? What or who triggered this? One possibility is that someone escalated this to the SEC because other attempts at escalation and remediation within Credit Suisse had not worked. If correct — if there was a whistleblowing to the SEC — that is very troubling because it suggests either that there were no effective routes for raising concerns within the bank. Or, worse still, that concerns raised were ignored or ineffectively handled. In short, the problem may not just be inadequate financial processes (“material weaknesses in our internal control over financial reporting” and a management failure to “design and maintain an effective risk assessment process” — oops!). It may also be that the bank’s processes — and culture — for identifying, escalating and handling concerns are inadequate too. If that is the case, what other problems are lurking? This will be bothering Credit Suisse, the Swiss regulator (which was very annoyed by whistleblowing failings in UBS in relation to the FX scandal), the Swiss central bank — and UBS — if it does decide to acquire all or part of its rival. What exactly would it be acquiring?

A Bargain or a Pig in a Poke?

What is in it for UBS? Taking out a competitor, its clients, funds under management and its better employees. Yes — all these. But is an acquisition necessary? Clients and staff will make their own decisions, regardless of what Boards decide. Funds are already flowing out of Credit Suisse, as happened to UBS when it was in trouble.

The risks for UBS are considerable. Bigger is not always better. Absorbing a well-run company is hard enough; absorbing one with difficulties something else entirely. There is every likelihood of plenty more nasties lurking under the carpet. The reputational difficulties will stick to UBS’s name, no matter how often the press releases refer to past Credit Suisse problems. The costs of investigating these — as well as the remediation work necessary to put matters right — will be enormous; not just financially but in management time, energy and enhanced regulatory scrutiny. What will the effect be on the share price? UBS shareholders had a lost decade as UBS cleaned itself up. Are they really willing to finance another clean up, another set of potentially unquantifiable liabilities? Will an acquisition be a distraction from UBS’s own plans and for its current senior management, largely new and brought in to build on what has been achieved by UBS not to clean up another bank’s mess?

Conflicts of interest

There have been plenty of red flags (Greensill, Archegos, Mozambique tuna bonds, GFG, for instance) that all has not been well within Credit Suisse. Some parts (the Compliance department) were well able to identify issues with some of the clients the bank was keen to do business with and warn against this. Despite that those concerns were ignored or, more likely, rationalised away. (Why, for instance, did anyone think it sensible to take on Archegos, an entity set up by someone — Bill Hwang — fined a few years earlier by the SEC for insider dealing?) This suggests an institution with no sound way of managing its risks and the conflicts of interest arising from the desire to do apparently profitable business set against the risks of taking on clients whose adherence to rules is more apparent than real. Changing that is not the work of a moment as Ulrich Koerner, Credit Suisse’s CEO (part of UBS’s senior management team 2009–2022) or its new General Counsel (formerly UBS’ General Counsel 2008–2022) will tell you.

It is not a problem confined to Credit Suisse of course. Questions have been raised about Goldman Sachs’ dual role in relation to Silicon Valley Bank. (It’s not for the first time that Goldmans has faced such questions in relation to M&A deals). Barclays has faced endless issues caused by the tensions between its investment bank and its retail bank, its latest problem arising from its appointment of Jes Staley and the judgment shown by its Board when questions about his relationship with Epstein were raised. (If only the Board and the FCA had taken more seriously Staley’s judgment and failure to understand why whistleblowing matters when concerns were raised in 2017–2018.)

Over the last few decades, the creation of ever larger financial institutions has led to multiple conflicts of interest between the interests of the institution, its clients, between different categories of clients and between different parts of the business. Internal Chinese Walls and oodles of rules sought to recreate what had previously been legal barriers in order to manage those conflicts. Self-regulation and — post the Guinness, Maxwell and Barings scandals — light-touch regulation were meant to do the rest. It did not work. Repeated scandals and harm to the ultimate customers of banks and taxpayers led to more intrusive regulation and ring-fencing — the 21st century’s equivalent of Glass-Steagall. Loopholes have been closed or tried to be anyway. Regulators have been playing Whack-A-Mole with financial institutions ever since. But conflicts of interest are at the heart of all financial scandals. As an official of the US’s Financial Crimes Enforcement Team said when the Vatican Bank did a deal with the US in 2013 “large amounts of money sometimes bring out the worst in people.”

What about governments?

It is not just large banks which have conflicts of interest. Governments have these too. Finance brings in lots of tax revenue. It can be — for a while anyway — a Golden Goose, ready to be plucked for politicians’ favourite projects: banks make money, bankers get paid extraordinarily large sums and consider themselves very clever and worth all this money rather than lucky, politicians get tax revenues and voters get all the goods those revenues pay for without having to pay for any of it themselves. Win-win. Until it all goes Splat! (For those of a more literary bent, the La Fontaine poem about the frog wanting to be a cow — La Grenouille et Le Boeuf — pithily sums up what went wrong.)

While it is all going well, though, politicians fall over themselves to attract such institutions to their country and take especial pride in having ever larger institutions.

• Think of Ireland and its International Finance Centre, which became the location of choice for various dubious German entities, which Ireland then decided to support at vast expense.
• Or Gordon Brown boasting about light-touch regulation for the City in 2004-5.
• Or Alex Salmond and his support for RBS’s ill-fated over-reaching pursuit of ABN AMRO.
• Or, more recently, the support by German politicians and the BaFin, the German regulator, of Wirecard, a German — but apparently cutting edge, global and profitable — fintech entity. A German champion to rival those arrogant Anglo-Saxons! Until it turned out to be so much hot air, fraud and money-laundering.

The desire to have a national financial champion can blind even the most sober of governments and regulators to the risks of letting such companies think themselves indispensable and/or grow too big, unwieldy and, effectively, hard to manage and regulate well.

Two risks

There are only two things which matter about financial institutions, whether large or small, whatever sector they are in: –

1. Do they understand the risks they are managing? This is not a side issue. It is their core work. Managing money — whether it is mortgages, shares, derivatives, loans to business, assets of the wealthy — is all about understanding and managing risk.
2. The only capital that matters is the trust that customers, staff, counterparties, regulators and others have in such an entity. The amount of capital, its liquidity and all the other measures are simply a way of putting figures on this. Once that trust has gone, a bank is finished.

There are serious doubts about Credit Suisse’s ability to understand and manage the risks it is running. What is not yet clear is whether the trust it needs to have the time to sort itself out is still there. Monday may provide an answer.

What Next?

Whatever that answer is and assuming there is no systemic fall-out, governments and regulators (and voters) need to ask themselves whether it is time to rethink whether such large global institutions, however well-capitalised or regulated, are a good idea. If you have institutions with built-in conflicts of interest, you will always have problems, even if systemic risk is avoided. Maybe smaller, more focused entities are best, ones which understand that finance is a service industry, part of an economy’s plumbing, there to serve others not help itself. Maybe global banks — much like other aspects of globalisation — are an idea which needs challenging and rethinking?