Kept under wraps for the best part of a year, the ugly findings of an APRA prudential review into Bank of Queensland are now out in the open. BOQ yesterday disclosed it has into entered into two court enforceable undertakings - one with APRA and one with AUSTRAC. APRA, AUSTRAC and the bank announced the undertakings yesterday.  The details in the undertakings BOQ provided APRA are extraordinary. “APRA is concerned about, and BOQ acknowledges, the nature and extent of the underlying weaknesses, the prudential standard breaches that these caused, the slow pace at which they were identified and the potential for new and significant prudential issues, including more prudential standard breaches, to arise if the underlying weaknesses are not rectified as a priority,” the bank’s undertaking to APRA said. The underlying weaknesses included:

the “design and operation of BOQ’s Risk Management Framework was insufficient for a bank of BOQ’s size and complexity … partly due to inadequate controls and over-reliance on manual controls;” “BOQ was not able to sufficiently monitor risks, controls and obligations on an ‘end to-end’ basis across the business, and it was unable to accurately report on and monitor non-financial risk;” despite BOQ’s identifying gaps in its risk culture in 2016, 2018, 2020 and 2022, its “risk culture remained immature and BOQ did not prioritise risk culture uplift sufficiently over that time”. “reporting to the BOQ Board and to Board committees was overly positive and failed to highlight material issues;” BOQ did not sufficiently engage with regulators when heightened risks or significant issues arose; and “BOQ’s performance and consequence management did not adequately hold BOQ’s leadership to account where risks and issues had not been adequately addressed.”

 APRA introduced a A$50 million capital add-on as a result of the prudential standard breaches. The most BOQ divulged in the past on these matters was in April, ahead of its results, when it said it would undertake a three-year risk program to strengthen its non-financial resilience. Some will be wondering: why didn’t the continuous disclosure obligations on the part of the bank lead to knowledge of the APRA prudential review? At the recent investor briefing, BOQ even denied that it was being investigated by AUSTRAC.