Commonwealth Bank's chief risk officer David Cohen admitted that risk management at the bank remains inadequate and that a complete overhaul of the department will take up to five years, the Hayne royal commission has heard.

Mr Cohen said there were instances where the bank had been "not thorough enough", "lacked compliance policy" and had difficulty seeing "the wood for the trees".