MAS Calls on Financial Institutions to Address Culture Behind Recurring Risk Failures

Key Takeaways

• MAS Pushes Remediation Beyond Control Fixes: The Monetary Authority of Singapore said recurring serious risk events are seldom explained by control deficiencies alone, and lasting remediation may require financial institutions to address the behavioral patterns and cultural conditions behind them.
• Four Culture Capabilities Form the Framework: MAS identified board and senior management leadership, culture root cause analysis, targeted interventions, and monitoring and validation as capabilities associated with more effective remediation and a lower likelihood of recurrence.
• Boards and Senior Management Remain Accountable: Leadership is expected to set the direction and tone for culture change, model desired behaviors, provide sufficient resources and establish effective governance and oversight.
• Root Cause Analysis Must Go Deeper: MAS wants institutions to examine organizational, leadership and social drivers of behavior rather than stopping at control weaknesses or broad explanations such as "poor culture" or "lack of accountability."
• Institutions Need Evidence That Behavior Changed: Monitoring and validation should assess actual changes in behaviors and cultural drivers rather than simply tracking whether remediation actions, training or other tasks have been completed.

Deep Dive

The Monetary Authority of Singapore is urging financial institutions to look beyond control deficiencies when serious risk events recur, warning that remediation may not hold if the behavioral patterns and cultural conditions behind those failures remain unchanged.

In a new information paper on culture capabilities, MAS set out supervisory observations drawn from its work with financial institutions, identifying four capabilities it has associated with more effective remediation and a lower likelihood of recurrence. They cover leadership and oversight, culture-focused root cause analysis, targeted interventions, and monitoring and independent validation of whether change is actually taking hold.
The paper builds on MAS's 2020 work on culture and conduct and gives greater definition to an area of remediation that can be difficult to pin down. A financial institution can strengthen a control, rewrite a procedure or alter its governance arrangements and still leave intact the behaviors that contributed to the original failure.

MAS said recurring serious risk events are seldom explained by control deficiencies alone. Its supervisors have observed excessive focus on short-term objectives and failures to learn from previous mistakes among leadership, as well as employees avoiding accountability, inconsistently executing controls and hesitating to escalate concerns.

Behind those behaviors can sit harder-to-see problems: leaders who do not model the conduct expected of employees, hierarchical norms that discourage ownership, insufficient psychological safety and incentive structures that reward business targets at the expense of ethical conduct and sound risk management. Unless those drivers are addressed, MAS said, similar risk events are more likely to recur.

The regulator's argument is not that controls matter less. It is that controls and culture cannot be neatly separated. Governance arrangements, organizational structures, policies, systems and processes shape behavior, while leadership and social norms influence how those formal arrangements are applied when employees have to exercise judgment.
One case observed by MAS shows how remediation can miss that distinction. After repeated control failures, a financial institution imposed stricter penalties for risky practices. The failures persisted.

Further examination found that employees were reluctant to escalate issues because they feared being blamed, allowing problems to develop until they became critical. The tougher penalties had inadvertently deepened that fear. Progress came only after the institution turned to the underlying psychological safety and leadership issues sustaining the behavior.

Putting Culture on the Board's Agenda

The first of MAS's four capabilities places responsibility for culture change with the board and senior management. MAS said boards and senior management are accountable for shaping and sustaining a sound organizational culture that supports robust risk management and ethical business practices. Where repeated serious risk events require cultural change, that means setting the direction and tone from the top, modeling the expected behaviors, providing adequate resources and establishing clear governance and oversight.

The paper points to several ways institutions have put that responsibility into practice. One incorporated progress on culture change into the balanced scorecard used to assess senior management. Another involved senior management directly in interventions, including engagement sessions with junior employees to understand concerns and gather feedback. Elsewhere, culture became a standing topic at board and senior-management oversight forums, supported by indicators including employee survey results, remediation timelines, customer complaints and the proportion of issues identified internally rather than by auditors or regulators. MAS also cautioned that the message from the top can produce unintended results.

At one institution, senior management introduced rapid changes to controls and processes without adequately explaining why they were being made or how employees were expected to implement them. Sales staff struggled to keep pace and some returned to previous practices, resulting in inconsistent execution and repeated control lapses. At another, an effort to encourage greater ownership inadvertently suggested that employees could take on tasks for which they lacked the necessary expertise.

Leadership, in other words, is not measured simply by whether management has communicated. What employees understand from that communication matters too.

Looking for the Cause Beneath the Control Failure

The second capability takes remediation into root cause analysis. MAS said repeated serious risk events, including recurring or high-severity control failures and misconduct, can signal entrenched behavioral patterns. Those patterns are rarely attributable to one cause. They can emerge through the interaction of organizational structures, leadership behavior and social conditions over time.

A culture root cause analysis should therefore go beyond identifying deficiencies in governance, policies, procedures or control systems. MAS said institutions should examine recurring behavioral patterns, assess relevant organizational, leadership and social drivers, establish credible connections between those drivers and the resulting behavior, and support their conclusions with quantitative and qualitative evidence.

The distinction can materially change the diagnosis.

At one institution, employees' tendency to prioritize speed over sound risk management was initially attributed to unclear policies. A later culture assessment found a deeper issue: leadership placed strong emphasis on speed and delivery and frequently checked on timelines. That contributed to a mindset among employees that favored short-term delivery over careful execution, which in turn contributed to risk-management lapses.

Another institution initially blamed employee misconduct and regulatory breaches on unclear policies. Focus groups later identified frequent changes in requirements from leaders, limited time to adjust and uncertainty about how new expectations should be implemented. Employees responded by relying on familiar working practices rather than fully adopting the new requirements.

MAS warned against root cause assessments that stop at descriptions such as "poor culture" or "lack of accountability." Institutions should be able to explain how observed behaviors contributed to the risk event, how particular cultural drivers produced or reinforced those behaviors and how the drivers interacted. Without that analysis, remediation can be directed at symptoms while the conditions responsible for the failure remain.

The regulator also wants the conclusions tested against evidence. Quantitative analysis and surveys can identify the prevalence of patterns across an organization, while interviews, focus groups and observations can expose perceptions and social norms that are difficult to see in data alone. MAS said combining the two can reduce blind spots, particularly when the analysis reaches sensitive subjects such as leadership decisions and internal dynamics.

Designing Remediation Around What Actually Went Wrong

Diagnosis leads to the third capability: designing interventions that address the identified cultural drivers rather than merely the visible consequences. Financial institutions commonly respond through restructuring, governance changes, revised policies and procedures, incentive adjustments, communications or additional training. Those measures remain important, MAS said, but may have limited effectiveness if they do not directly address the leadership and social drivers influencing behavior.

The paper points to speak-up programs as one example. Reporting channels and training can give employees the means and skills to raise concerns. They do not, by themselves, create psychological safety if leadership behavior, team dynamics or social norms continue to make employees wary of speaking.

MAS also cautioned against treating individual interventions as independent fixes. Structural arrangements, leadership behaviors and social norms can reinforce or undermine one another. Strengthening consequence management without considering how leaders respond to mistakes, for example, may increase employees' fear of escalation and worsen the behavior the institution is trying to change.

One institution confronting recurring operational risk events paired structural controls with cultural measures. It introduced role-based system access controls and greater automation to reduce reliance on manual processes, while senior leadership reinforced expectations around risk and compliance standards. The institution also clarified behavioral expectations and accountability for misconduct, increased communication about risk and control responsibilities and introduced scenario-based training based on previous lapses.

Another institution had identified a pattern in which employees avoided accountability for mistakes. Its assessment found three interconnected drivers: a consequence-management approach employees regarded as excessively punitive, leadership behavior that did not treat mistakes as opportunities to learn and a perceived power distance between employees and leaders that discouraged challenge.

The resulting interventions addressed all three. The institution clarified how consequences should be applied, trained leaders on using the framework fairly and proportionately, and held small-group sessions across seniority levels intended to normalize employees raising concerns and leaders responding openly to them.

Measuring Change, Not Completion

The final capability concerns whether an institution can demonstrate that its remediation has changed anything beyond its paperwork. MAS said culture monitoring and validation should assess whether interventions are producing effective and sustainable movement toward the desired culture. Both should go beyond implementation status or the completion of remediation tasks and examine actual changes in behaviors and their underlying drivers. Validation should be conducted by an independent function or external party, and MAS said monitoring and validation should preferably be performed by different parties to strengthen objectivity.

That makes the choice of indicators important. Financial institutions already track measures such as process failures, whistleblowing cases, audit findings, regulatory breaches and customer complaints. MAS said those measures can identify signs of cultural problems but should not automatically be treated as evidence that culture is improving.

A decline in disciplinary actions, for example, could reflect better conduct. It could also result from changes in detection, investigation or enforcement. In one case described by MAS, serious risk events continued even as disciplinary actions remained low or declined.
Reporting-channel data can be equally ambiguous. One institution used utilization rates to assess whether employees had overcome their fear of adverse consequences. The measure showed whether people used the channels, but not whether they felt safe challenging decisions or escalating problems. Low usage could indicate an environment with few issues or one with little trust.

MAS instead encouraged institutions to combine indicators and methods. Survey results on psychological safety can be considered alongside observations of leadership behavior, interviews with employees, speak-up reporting and the proportion of issues employees identify themselves. Contradictory results can be revealing: positive survey responses and favorable interview feedback may warrant closer examination if self-reporting rates are falling and meetings show little constructive challenge in practice.

The framework is not intended only for institutions already dealing with the consequences of a serious failure. MAS said the same capabilities can be developed preemptively, allowing financial institutions to identify emerging behavioral risks and cultural hotspots, investigate the conditions behind them and intervene before they contribute to a serious risk event.

MAS said it will continue working with industry bodies, including the Culture and Conduct Steering Group and the Insurance Culture and Conduct Steering Committee, to support collective learning and the sharing of good practices across the financial sector.

The paper leaves financial institutions with a more demanding standard for remediation. Closing a finding can demonstrate that an institution has completed the work it promised to do. It says considerably less about whether the behavior that produced the problem has changed. MAS wants institutions to be able to show the difference.

The GRC Report is your premier destination for the latest in governance, risk, and compliance news. As your reliable source for comprehensive coverage, we ensure you stay informed and ready to navigate the dynamic landscape of GRC. Beyond being a news source, the GRC Report represents a thriving community of professionals who, like you, are dedicated to GRC excellence. Explore our insightful articles and breaking news, and actively participate in the conversation to enhance your GRC journey.