Consultants compete for Westpac risk gig
Westpac in coming weeks will lock in an accounting or consulting firm to conduct a key 2021 risk management assessment.
Westpac in coming weeks will lock in an accounting or consulting firm to conduct a key 2021 risk management assessment, as it overhauls many of its compliance processes due to explosive financial crimes legal action brought by Austrac last year.
Sources told The Australian an appointment for the CPS 220 Risk Management review was being finalised, with KPMG among the frontrunners to win the work. Rival Deloitte is also in the mix.
A Westpac spokesman on Sunday said the selection process for the next CPS 220 review had not been completed.
The appointment is set to occur at a turbulent time for Westpac as its deep dive into accountability for millions of anti-money-laundering breaches comes to a head, and as it continues to squabble with regulator Austrac over the size of a penalty.
Work on the bank’s various accountability reviews for the anti-money-laundering breaches has been completed and parties are preparing their final reports. One of those is an independent panel that includes NBN chairman Ziggy Switkowski, energy expert Kerry Schott and Lendlease director Colin Carter.
Westpac has committed to making the panel’s recommendations public.
The Australian last week foreshadowed that the bank planned to release aspects of its accountability reviews this month.
IBM-owned Promontory Financial Group is separately providing assurance over Westpac’s assessment of management accountability and adequacy of its financial crime program.
New Westpac chief executive Peter King wants to draw a line under past failings and fix the lax approach to compliance, which culminated in the bank being hit with action last year by Austrac alleging 23 million breaches of anti-money-laundering laws. The damning case included that Westpac helped facilitate payments for child exploitation material.
The CPS 220 Risk Management review typically happens every third year, although this year’s assessment was delayed until 2021 due to the COVID-19 turmoil.
The prudential standard for the risk review stipulates how it is conducted, and next year’s broad assessment for Westpac comes at a crucial time.
“An APRA-regulated institution must … ensure that the appropriateness, effectiveness and adequacy of the institution’s risk management framework are subject to a comprehensive review by operationally independent, appropriately trained and competent persons (this may include external consultants) at least every three years,” the standard says.
“The results of this review must be reported to the institution’s board risk committee, the senior officer outside Australia or compliance committee.”
Accounting firm EY delivered the prior Westpac CPS 220 report to the bank in August 2017, but the firm will not be used this time around.
In its 2017 review, EY said Westpac’s risk framework was adequate, but the firm raised a string of problems in the bank’s approach and systems.
“Westpac’s IT infrastructure has continued to contribute to issues within risk function, including a lack of integrated data, poor data quality, manual workarounds and system performance and capacity issues,” it said.
Separately, though, EY is said to be undertaking work for Westpac in the financial crimes and anti-money-laundering space, as the bank works through its response to Austrac’s legal case. It is among several firms involved in helping Westpac bolster its financial crime systems and compliance.
Westpac’s response to the Austrac action included closing its LitePay product, and adding staff and resources to financial crime functions.
Mr King — who has set aside $900m for an Austrac penalty despite the regulator pushing for at least $1.5bn — has a long list of near-term challenges including replacing three spots on his executive team.
On Friday, head of the institutional bank Lyn Cobley signalled her retirement from Westpac. Her departure adds to the exit of consumer boss David Lindberg and chief information officer Craig Bright, who are leaving for roles with Royal Bank of Scotland and Barclays respectively.
Last month, Mr King appointed Les Vance to the new position of executive for financial crime, compliance and conduct, allowing chief risk officer David Stephen to focus on the credit portfolio.