It’s time to set the record straight: governance is not just about following rules and regulations.
While financial institutions have a legal responsibility to their stakeholders and consumers, governance goes beyond merely checking compliance boxes; it’s the foundation of a resilient, strong, and sound financial institution (FI).
Unfortunately, too many financial institutions take a reactive approach to governance. They fail to seize strategic opportunities and learn how to leverage governance strategies to thrive in an era of constant change.
So, where are FIs going wrong with governance? What can we learn from past enforcement actions that address governance issues? And how can FIs take a proactive stance toward governance? Let’s explore.
Table of Contents:
Governance refers to the internal rules, processes, policies, and structures that guide an organization’s decision-making and strategy. It defines how an organization is controlled and operated, including roles and responsibilities.
As an organization's foundation, the governance strategy provides accountability and transparency and ensures that the institution operates responsibly, sustainably, and in accordance with its mission, vision, values, and risk appetite.
Governance also plays an important role in strategic growth, transforming risks — including compliance, operational, and third-party risks — into assets. Institutions with strong governance make smarter decisions, respond faster to crises, and create sustainable competitive advantages.
While every financial institution’s governance looks different based on its size, resources, and market, some key components make up a strong framework:
Related: Business Resiliency: Your Guide to Business Continuity Management
Governance can be further broken down into a few key areas:
The Office of the Comptroller of the Currency describes corporate governance as the “authorities and responsibilities of the board and senior management, in their respective roles, to govern the bank’s operations and structure.” It typically includes the bank’s board of directors (BOD), management (CEO, CRO, etc.), shareholders, and other stakeholders (compliance officers, risk management team members, etc.).
Risk governance is part of corporate governance. It applies corporate governance principles to the institution’s risk management plan and includes the policies, processes, personnel, and control systems that support risk-related decision-making.
Related: Essential Risk Assessments for Financial Institutions
While governance isn’t only about adhering to regulatory guidelines, the topic has become a growing concern among regulators. A lack of effective governance — alongside unmanaged innovation risk, insufficient Anti-Money Laundering (AML) and Countering Financing of Terrorism (CFT) programs, and violations of fair lending practices — is one most frequent issues identified in consent orders issued in 2024.
The Comptroller’s Handbook: Corporate and Risk Governance from the Office of the Comptroller of the Currency (OCC) emphasizes that a robust corporate and risk governance framework is essential for the sound operation of banks. It notes that governance practices must align with a bank's size, complexity, and risk profile. As such, larger or more complex FIs should have more sophisticated and formal board and management structures and processes.
In addition to the OCC, other regulatory bodies, including the Federal Deposit Insurance Corporation (FDIC), the Federal Reserve Board, and the Consumer Financial Protection Bureau (CFPB), also offer guidance on governance practices to help ensure that financial institutions meet necessary standards.
Related: Laws vs. Regulations vs. Guidance: What's the Difference?
In recent years, Wells Fargo's account opening scandal has been one of the most egregious examples of poor governance.
Wells Fargo & Company and its subsidiary, Wells Fargo Bank, agreed to pay a $3 billion settlement for consistently pressuring employees to meet unrealistic sales goals from 2002 to 2016, ultimately leading to millions of unauthorized accounts and misuse of customer information. "This case illustrates a complete failure of leadership at multiple levels within the Bank. Simply put, Wells Fargo traded its hard-earned reputation for short-term profits, and harmed untold numbers of customers along the way," said U.S. Attorney Nick Hanna for the Central District of California.
But false accounts were the tip of the iceberg. Other controversies included charging 570,000 customers for unnecessary auto insurance, illegally repossessing cars from service members, overcharging small businesses for credit card transactions, and mishandling high-net-worth customers' personal information. Shortly after launching a "Re-Established" ad campaign to rebuild trust, the bank found itself in trouble again by settling SEC charges for encouraging inappropriate trading practices.
The problem is that management and the board failed to consider the risks of pushing staff to meet extremely aggressive sales goals. They didn’t align strategy with risk.
Wells Fargo is just one example of an institution reaping the consequences of its actions. However, poor governance goes beyond compliance issues; it's ultimately a failure in leadership that can derail an institution. That's why governance is integral to your institution's enterprise risk management strategy.
Related: What TD Bank’s Money Laundering Debacle Teaches Us About Underfunding Compliance
Enterprise risk management (ERM) is defined by the Committee of Sponsoring Organizations (COSO) as the "culture, capabilities and practices that organizations integrate with strategy-setting and apply when they carry out that strategy, with the purpose of managing risk in creating, preserving, and realizing value."
Governance plays a crucial role within COSO's ERM framework and is one of five components of a successful ERM program. The components that create governance and culture include:
So, how can financial institutions incorporate governance into their risk management strategies while taking advantage of strategic opportunities? Here are some best practices:
Related: Board and Management Action Plan for Enhancing Resiliency with Sound Governance
Remember, governance isn’t just something that happens. It requires an ongoing effort from your institution’s board, management team, risk team, and other stakeholders. Like a compliance culture, a commitment to governance starts from the top down.
Clearly communicate your institution's commitment to governance. Ensure that all relevant processes, policies, and systems are centralized in one accessible location that serves as the definitive source of truth for all appropriate team members. When changes occur, inform team members so they can make adjustments as needed.
An effective governance strategy is a team effort, but the proper governance, risk, and compliance (GRC) software can streamline the process, enabling your team to focus on your strategic objectives and make the best use of your time, money, and other resources. Look for a software solution that meets your financial institution’s needs, whether staying updated on relevant regulatory updates, simplifying reporting, analyzing risks, monitoring risk with risk evaluation modeling, or more.
What does strong governance and management look like?
Find out in our on-demand webinar The ‘M’ in CAMELS: The Role of Risk Management.