4 A failure of internal control
The weaknesses of the federal
48. HBOS operated a federal model. With
the exception of the Treasury Division from 2004, each of the
divisions whose operations we referred to in the previous chapter
and the Insurance & Investment Division operated with their
own Chief Executive and their own divisional management and risk
and control structures. Day-to-day management of the Group was
delegated to the Group Management Board, subsequently renamed
the Executive Committee (ExCo). ExCo comprised the Group Chief
Executive and the Finance Director, along with the divisional
chief executives and other, selected senior executives.
49. Each division was formed by combining
activities of the two constituent banks. The lead role was assumed
by the stronger partner in the relevant area. Former Halifax management
led the Retail and Insurance & Investment Divisions, while
former BoS executives led the Corporate and Treasury Divisions,
as well as the International Division from 2004. The Group's two
Chief Executives both came from the retail side, Sir James Crosby
from the previous Halifax leadership and Andy Hornby recruited
to head the Retail Division in the first instance. Large exposures
required an additional executive director to sign them off, but
because Colin Matthew (International) and Peter Cummings (Corporate)
were recognised as having the most corporate expertise, they were
largely responsible for signing off each other's exposures.
50. Jo Dawson felt that the level of
internal challenge to the divisions was "quite low".
She said that she understood ExCo to be an "advisory committee
whose role was to support" the Group Chief Executive; the
authority to challenge executive directors rested with the Group
Chief Executive, supported by the Finance Director.
Peter Hickman shared this view.
With regard to the Corporate Division, Mike Ellis admitted that
the challenge process at Group level did not necessarily involve
people with direct corporate banking experience.
Peter Hickman said that the senior management of HBOS clearly
had a lot less understanding of corporate banking than the divisional
managers and that there was "huge degree of trust" in
Peter Cummings's judgement.
Andy Hornby admitted that most of his focus was on other areas
because "there were other parts of the business that were
causing us more concern in terms of the risk profile than corporate
51. Risk Assurance was provided by internal
control functions, including the Audit Committee and Internal
Audit. Divisional Risk Control Committees (RCCs), distinct from
the divisional risk committees, reported to the Audit Committee
and comprised two non-executive directors, an executive director
from another division, and a member otherwise external to the
HBOS Group. The RCCs were the result of an initiative from the
Chairman, who believed they examined all the risks present in
their area. Anthony
Hobson, Chairman of the Group Audit Committee from 2001 to 2008,
considered that the RCCs had the duel advantage of giving non-executive
directors direct exposure to risks in individual divisions and
executive directors knowledge of risks in other parts of the Group.
Andy Hornby indicated that he "relied very much" on
the RCCs and their composition.
52. However, Anthony Hobson regarded
the function of the Audit Committee as more backward than forward
looking, which was in his view more the responsibility of the
executive risk committees. He regarded the RCCs as effectively
performing the role of divisional audit committees in their role,
compared with the executive divisional risk committees.
53. The HBOS Group operated a federal
model, with considerable independence given to the divisions.
Central challenge to the divisions from senior executive management
appears to have been inadequate in the case of the three divisions
that ultimately caused the most significant losses (Corporate,
International and Treasury). HBOS senior management derived from
Halifax and the Retail Division. Accordingly, their understanding
of retail banking was stronger, and their relative weakness in
other areas meant that their reliance on divisional management
in the corporate banking areas was greater. The key role of assessing
exposure to future credit risks was dominated by the executives
of the individual divisions. These weaknesses in senior management
were instrumental in the pursuit by these three divisions of the
policies and practices that led to devastating losses.
The group risk function
54. The weaknesses of executive control
could perhaps have been mitigated by an effective risk function
at Group level, but the Group Chief Executives did not develop
a strong Group-level risk function. Paul Moore took up a post
as Head of Group Regulatory Risk in late 2003, but said that he
met resistance to his proposed approach to the management of risk.
The main reporting line of the divisional risk functions was to
the divisional management rather than to the group risk function.
Paul Moore said that this
created a kind of 'us and them'
culture between the group risk functions and the divisional risk
functions, which was dysfunctional.
He also detected what he termed a "cultural
indisposition to challenge".
55. In early 2003, Sir James Crosby
wrote to the FSA accepting "the need to make more progress
in some areas, notably the relationship between group risk and
divisional risk functions".
In evidence to us, Sir James rejected Paul Moore's characterisation
of the relationship as "dysfunctional",
and his chosen solution at the time involved creating a new role
of Group Risk Director, going through "a good succession
planning process" and concluding that "somebody else
other than Paul Moore was better qualified to head that function"
in consequence of which Mr Moore was made redundant.
56. The new post of Group Risk Director
was held by Jo Dawson for 14 months before she was promoted to
Head of the Insurance & Investment Division. Her successor,
Dan Watkins, was Group Risk Director for less than a year before
also being promoted to Head of Retail Products and being appointed
to the Board. He in turn was succeeded by Peter Hickman. Jo Dawson
had held senior positions in the Retail Division before taking
up her post, but had no market or large corporate experience;
Dan Watkins had worked in the Morgan Grenfell treasury and become
Managing Director of Birmingham Midshires, which undertook higher
risk mortgage lending for HBOS. Peter Hickman was previously director
of group finance.
57. During her brief time in the role
of Group Risk Director, Jo Dawson concluded that she had influence
rather than authority. Her ability to effect change was dependent
on her relationship with the divisions.
This arrangement essentially reflected the very weakness that
the creation of the post was, according to Sir James Crosby at
the time, designed to address. When Jo Dawson raised concerns
from competitors that the Corporate Division was too aggressive
from a risk perspective, her recollection was that the Chairman
and Chief Executive said that they were comfortable with the position
and that competitors were "mudslinging".
Peter Hickman saw his role as more than advisory, but acknowledged
that the seniority of his post relative to that of the divisional
heads was an issue.
58. When we asked Eric Daniels, Chief
Executive of Lloyds TSB at the time of the takeover of HBOS, for
his reflections on the difference in the culture of the two organisations,
he highlighted the difference in approach to Group risk functions:
My observation would be that HBOS
had a desire to grow rapidly and they were seemingly able to pull
off growth within acceptable risk parametersseemingly [...]
I think it was a question of having an ambitious set of growth
goals without having some of the experience and moderating influences
in many of the cases [...] In HBOS [the group risk role] was viewed
more as a rotational set of assignments to round out people. So
rather than getting experts, they would bring in people as development
He accepted the possible benefit of
senior managers aspiring to run a bank serving in risk positions
at an earlier stage in their career, but not at the most senior
level of risk:
I do not believe that you can put
talented amateurs in some of these positions, no matter how smart
the individuals are. You really need deep professionalism, especially
in today's environment: the sophistication of financial products
and the ways in which things can go wrong are that much greater
than in the good old days.
59. Sir James Crosby told us that his
aim in creating the position of Group Risk Director was to enhance
its profile and "enhance the position in the context of the
Group". He nevertheless
conceded that it was "unusual" that two successive holders
of the new post had no specific experience in risk functions.
Indeed, he conceded that it could be characterised as "bizarre".
Lord Stevenson agreed that the rapidity with which Jo Dawson moved
on from the risk function was "less than desirable",
but said that it reflected "the philosophy of trying to give
our outstanding executives experience of the risk function".
60. Seeking to draw lessons from his
experience in HBOS, Andy Hornby told us:
In big, diverse banks, to have a
technically strong and personally adept group risk director is
totally crucial because to be able to see through the various
trends to what the really big things are that need to be challenged
is utterly crucial. Secondly, I believe that it is easier if the
divisional risk teams have a straight-line reporting relationship
to the group risk director, as that takes away an element of potential
tension. Ultimately, though, however good your credit risk assessors,
divisional risk teams and group risk teams may be, you need to
ensure that there is a proper culture of welcoming challenge from
the risk teams. That is [the] responsibility of the entire board,
and that has to be constantly emphasised.
61. Sir James Crosby and Jo Dawson indicated
that the prime responsibility and expertise for risk management
and credit assessment rested with the individual divisions, while
group risk functions set overall policy and standards, provided
functional leadership and oversight and undertook reviews of certain
issues. In particular,
the divisions had sole responsibility for individual credit sanctioning,
with no involvement at Group level. The Corporate Division in
particular had a strong sense of its ability to source good quality
assets. Jo Dawson indicated that Corporate was less open to challenge
and that it did not believe Group functions had the expertise
to advise it. George
Mitchell regarded the function of Group Risk as concerning "macro
issues" such as sector limits, approval processes, policies
and the bank's readiness for Basel II.
However, the view of the Corporate Division was that individual
counterparty assessment was the most important judgement in credit
risk. It therefore
requested headroom in sector limits, so as to have the flexibility
to lend on the basis of its assessment of individual counterparty
risk, rather than being constrained.
This effectively rendered sector limits meaningless.
62. Both Peter Hickman and Jo Dawson
said that the Corporate Division had great confidence in its credit
expertise, partly because it had not only weathered previous downturns
but had also benefited from them. Peter Hickman acknowledged that
he had had "quite full debates" with Dan Watkins, then
in charge of Retail on specialised mortgage lending risks, "probably
helped by the fact that he had been a group risk director".
In contrast, Corporate Division was more confident in its own
63. Group senior management and central
risk functions had greater understanding of the Retail business
and several of them had direct expertise of working on the Retail
side. There was therefore greater involvement by senior management
and central functions in Retail and greater willingness to accept
that on the part of the Division. By contrast, there was much
more limited challenge and ability to challenge Corporate, International
and Treasury activities and also, on the part of Corporate at
least, willingness to accept it.
64. The risk function in HBOS was
a cardinal area of weakness in the bank. The status of the Group
risk functions was low relative to the operating divisions. Successive
Group Risk Directors were fatally weakened in carrying out their
duties by their lack of expertise and experience in carrying out
a risk function, by the fact that the centre of gravity lay with
the divisions themselves rather than the group risk function,
and by the knowledge that their hopes for career progression lay
elsewhere in the bank. The degradation of the risk function was
an important factor in explaining why the high-risk activities
of the Corporate, International and Treasury Divisions were not
properly analysed or checked at the highest levels within the
65. The weaknesses of group risk
in HBOS were a matter of design, not accident. Responsibility
for this lies with Sir James Crosby, who as Chief Executive until
2005 was responsible for that design, with Andy Hornby, who failed
to address the matter, and particularly with Lord Stevenson as
Chairman throughout the period in question.
67 BQ 1278 and B Ev w 248 Back
BQ 259 Back
B Ev w 195; BQ 238 Back
BQ 505 Back
BQ 315 Back
BQ 506 Back
Q 1446 Back
Q 1629 Back
BQ 937 Back
Q 1468 Back
BQ 939 Back
BQ 7 Back
BQ 40 Back
B Ev w 469 Back
Q 1386 Back
Q 1388 Back
BQ 216 Back
BQq 217, 233 , 234; B Ev w 194 Back
BQ 253 Back
BQq 489 - 92, 507 Back
Q 4293 Back
Q 4294 Back
Q 1425 Back
Q 1422 Back
Q 1423 Back
Q 1742 Back
Q 1756 Back
Q 1513 Back
BQq 204, 206, Q 1392 Back
BQq 222 , 227 Back
BQ 675 Back
BQ 507 Back
BQ 507 Back
BQ 493 Back
BQ 489 Back