Insights from Sean Hughes on Compliance, Challenges and Human Behaviour

The thing about regulators is, you know, no one's sort of forced to be a regulator, and so far there's sort of no certified professional qualification as being a regulator. So we're all just trying to do our best, and absolutely we get it wrong. One of the things that I've taken away from my experience, because, you know, I know that that was the last regulatory role I'll have, is that, you know, humility goes a long way in breaking down barriers. And something that I tried to do When I was interacting with, you know, senior financial services leaders in my role as a Commissioner, is ask them what's working and what's not working for you. There's a bit of a tendency I find for regulators to walk into a room and start talking at their audience and telling them what they need to hear, because you've been given your talk track, you've been told these are the key messages to get across. And this is not a pointed criticism at anyone, but I think regulators could do much more in terms of listening, because at the end of the day, the people that pay the levies which fund the regulators are the ones they're talking to.

Hi everybody. Welcome to The Mentor List. So Shaun Hughes is our star guest today. He's walked all the way across the courtyard from 130 to 150, uh, Lonsdale Street here. And welcome to the studio.

Thanks.

I know it's been a long journey for you. I know we were laughing about that before we got in, but it's great to have you in here. Um, and it's part of our pre-briefing call. Uh, we could have gone many directions with this, but trust and integrity is sort of the, the overarching theme of today's conversation. I couldn't think of anybody better to lead on this conversation. So Sean's run both regular regulatory bodies in Australia, overseas, has an international career, hasn't been always on the regulatory side, and in fact now he's back in commercial roles again. So can speak from many different perspectives, and certainly looking to get some insights into how it works, what your experience is, and how you ended up in, in, in this sort of career. Because I know from our briefing call choosing this as a career path or a compliance-type labeled role wasn't actually a choice when you started out in business. So, so welcome, Sean. So first question to you, and it's a bit of an open-ended one, is, you know, regulation— where does it come from and why does it exist?

Yeah, look, thanks for the invitation. I think regulation at its heart lies in a failure of any given community or sector to self-police or self-regulate. And in saying that, that's not a criticism. I mean, the reality is choices have to be made. You know, there are competing priorities. You know, organisations have to manage scarce resources. They have differing stakeholder expectations. But increasingly there's more and more complexity and expectations, particularly on the part of consumers and other stakeholders, are increasing all the time. Technology and other changes in the way in which we engage with society and with our markets just means that the speed of things has moved up, uh, competitors have become more aggressive. And so there needs to be some sort of arbiter or sort of police force, if you like, in, in the market to ensure that the right behaviors take place, uh, and that, that inequality of bargaining power between the buyer of products and services and the seller is redressed by some sort of impartial mechanism. But, you know, when I said at the beginning regulation is no more, no less than a failure to self-regulate, I mean, when I first came into professional life back in the early 1990s, there was no such thing as compliance as a profession. Just didn't exist.

Because what was your original path?

I came in through law. You know, I started practicing as a litigation lawyer. And that has been my background. It's something I've always gone back to. But, you know, compliance and the sort of need to have somebody who interprets laws and assists organizations to understand what their obligations are and how they can manage them, that's a relatively new phenomenon.

Yeah.

And, you know, even, gosh, in 2003, 2004, when I had my first foray into corporate life, I was the the head of compliance, if you like, for ANZ. I remember talking to the then chair of the, of the ANZ board risk committee who said, you know, the thing that could really take this organization down, or any large bank, is a credit failing. Um, you know, fast forward 10 years on from there, and, and, you know, increasingly you're seeing boards having reputational risk and compliance risk as something that's at the top of their agenda.

That's a good, uh, little strand to maybe pull on. So at the board level, and I, I know it's some of the— some cause for some frustration within our sort of executive communities around, okay, board meetings coming up, um, what is the agenda looking like? And this seems that there's every, um, I don't know, periodic release seems to be more regulation or more or compliance or focus on things like— not that they're bad things to focus on— modern slavery, gender pay gap. They're just new things to add into a bag of things that are being managed and, um, I guess elevated to that level. Um, and some of the anecdotal conversations are around, you know, the amount of pages in a board pack now that a director's, um, you know, sitting to, to work through. So I guess that's probably more of a statement than a question. I mean, are we adding just more regulation, or is there regulation going out the back door? Where have you seen this work well, and is there differing models?

Look, I, I think, I think sadly we're not taking regulation away, we're adding more and more. And although I'm no longer a regulator, I think, you know, from my perspective having been a regulator, is that regulators themselves are not looking for more laws to administer. Um, you know, they've got finite resources as well. They've got a limited bandwidth, particularly those that have got very large remits. And, you know, each time Parliament adds a new piece of legislation for regulators to administer, it's one more thing to add to the, to the day job. Um, I think when I compare what I used to see when I was a general counsel in another organisation prior to becoming a regulator at ASIC, and, and what I'm seeing now as a general counsel again is that yes, the, the additional content driven by regulatory compliance obligations has absolutely increased. There's no doubt about that, and that's certainly the perspective of my peers across the sector. I think, I think there's a limited level of coordination, particularly at the political level, as to the volume and complexity of the regulation that commercial organizations have to face. Now, you know, let's get this in perspective. If I was on the board of an airline or a mining company, I would absolutely want to be crystal clear around what my obligations are around aviation security and aviation safety. Or health and safety requirements in the mine. So that there's no doubt that when compliance obligations mean that people's lives are kept safe and workers return home at night, there is no doubt that boards want to focus in and zero in on that level of detail. But I do think that in other areas of regulation, there is perhaps a reticence and a reluctance to trust management to get that detail right. And boards, because of the reputational risk and sometimes the financial risk to the organisation, are increasingly, in my view, delving more and more into the detail. And to some extent, they're being encouraged to do so by regulators. Regulators are asking boards, you know, show me, prove to me that you have got satisfaction from the management that everything's under control and that they understand their obligations. That's going to break. You know, one day people will miss something blindingly obvious because they're so focused on page 998 of the board pack that they missed what was on page 1. Wow.

Um, you've, uh, you've sort of painted a picture there, and it reminds me of— we had one of our CEOs talking about they got into a bit of, um, uh, issues around, uh, compliance and things like this. This is one of the larger casinos, and they ended up having 2 observers from the regulator on their board that were basically observing and minute-taking and watching the whole scenario play out, which I imagine must be a strange dynamic to be working in. And I guess, um, as a regulator and maybe as the leader of, uh, of an enterprise like ASIC— ASIC doesn't sound right saying ASIC— Um, you must be put in some uncomfortable situations from a humanistic perspective? Um, because it's not, you know, it's not fun to be caught out— or is it caught out? Or to be sort of, you know, to have something and be the focus of an investigation, and then, you know, you're the one that's put in that position to, to make sure the right thing's being done. I mean, how have you sort of found that— how do you operate in that environment?

Well, the example you used of having, you know, observers sitting in a boardroom taking notes and making sure that the right questions are being asked and that, you know, appropriate objectivity and independence is being applied. In my view, that is the definition of a destruction of trust. At that point, the organisation is so close to losing not just its regulatory or its legal licence, but its community and social licence to operate.

Yeah.

You know, if you've got to have the teacher in the classroom all the time, and these are adults in the classroom, something is seriously broken.

Yeah.

Now, more generally speaking, I think that there needs to be a level of separation between what the regulator is doing and what the commercial organisation has a licence to operate, to do in whatever market it's operating in. I'm not a great believer in having regulators peering over the shoulders of people who are well remunerated to take appropriate commercial risks and to act in the best interest of their shareholders. at the end of the day is a blurring of lines that I think is really unhealthy. And one of the things that I pushed back on when I was a regulator is this sort of sense that because we've got a license or because we have to file things with the regulator, regulator, that means they're approved. You know, that we've approved that particular product disclosure statement to an insurance customer. That just is never the case. It's not the regulator that's taking on the commercial risk, it's the organization. And, and those two Those two roles should never be confused.

Right. And, um, I think you mentioned when you were working at ANZ, which our chair Mike Smith was CEO there for quite some time, and one of his jovial sort of statements is that regulators don't have any natural predators, um, you know, a bit of a law unto them, unto themselves. I mean, it'd be interesting to get your perspective on, um, you know, someone coming from that sort of background having that as a jovial comment? How do you— what's your view on that?

You may be, and your listeners may be surprised to hear me say I don't disagree with it. Um, I want to make this point first and foremost though, that, you know, certainly having been the Chief Executive of the New Zealand Financial Markets Authority and a Commissioner at ASIC, you know, I could not be more proud and, and feel a deep sense of privilege an honor to have had those opportunities, because at the end of the day, having the ability to be in a leadership role in the public service and to have such a visible leadership role is an immense honor, and one that, you know, I feel very, very grateful to have had that opportunity. But let's be very clear, regulators are people, and like all humans, they make mistakes. And like all of us, we need feedback. And we need encouragement to be nudged in the right direction, and we also need to be slapped on the knuckles when we get things wrong. I think the challenge for regulators, particularly at the senior echelons, is that it becomes very difficult for that sort of feedback and oversight to take place in a real and meaningful way. I mean, these people— I mean, if I take being an ASIC commissioner in my own experience, you're a statutory appointment. you're appointed by the Governor-General, and, you know, no one is going to be actually sort of performing some sort of, um, performance assessment or an annual evaluation of how you've gone. That's just not how it operates. Now, in theory, and to some extent in practice, there are oversight bodies. There's parliamentary committees. There's— for ASIC and APRA, there's a body called the Financial Regulatory Assessment Authority. There's the the auditors, uh, you know, for very serious misbehavior there's the National Anti-Corruption Commission now. But what there isn't, and what I still think is lacking, is any assessment as to efficiency or effectiveness. In other words, who's assessing the return on equity or the return on investment? Who's asking the question, is this regulatory requirement, this obligation, still fit for purpose? To go back to your earlier question, you know, do laws ever expire? No, they don't. Until a brave politician or a brave government decides to repeal something because it's no longer fit for purpose or doesn't suit the circumstances of an evolving or more complex market, those laws stay on the book and the regulators still have to administer them long after, long after they've served their useful life. And probably a good example in the space that I come from is the product disclosure laws, you know, thousands and thousands of pages that are carefully crafted by very well-paid lawyers, but whom I would hazard a guess very few consumers actually read. Now, boards of directors are required to satisfy themselves that those disclosure documents are accurate and, uh, you know, tell the right story and are fit for purpose for for the consumers of those products. But do, do we know if anybody's reading them? And if you get them wrong, you know, there are serious consequences. So I think there does need to be a revitalization or recycling process built into regulatory requirements, whether it be they all have sunset clauses and they get reviewed automatically every 3 or 5 years, whether there be some body set up within the Parliament that runs the ruler across requirements and says, are these, are these being administered effectively anymore? And also for the regulators, of course, to say themselves, we just don't have the resources to do everything. And I know that is something that regulators do, but I'm not sure how well they get listened to.

Because the sunset clause you were mentioning when you were running the, the New Zealand operation, that was in existence. So was that— did you find that that was effective and that was Broad efficiencies, or would they just renew anyway?

No, no, they weren't necessarily renewed. And, and I think it's a good discipline, um, when laws are passed for there to be some consideration given to how long does it make sense for this to come into— to stay in existence, or even just to, to have a mechanism to review it and say what's working, what isn't working. Because the other problem you face is with the short electoral cycles that we have, at least in the federal system, is that there's a very, very limited bandwidth for, you know, a one-term government to get through all of its legislative policy priorities and to fix up things that are out of date or no longer useful as well. I mean, there is a natural tendency on governments when they are elected to be seen to be doing stuff and getting stuff done, and that often means passing laws. I've never heard of a government say, you know, let's let's clean up the Corporations Act or let's, you know, reduce the length of the Income Tax Assessment Act. It's just, it's not going to win votes, is it?

No, that's true. And I mean, from your perspective, so I'm sure you had an annual planning process and, you know, there's a couple of oversight bodies which you've mentioned are in existence. You're getting new policy to basically regulate year on year. I assume budgets are fairly fixed or probably there's an expectation to reduce. Um, how do you go about what to focus on, as you know, from the leader that who's about to drive, uh, the direction for the year? Are you planning for a year, or what? How do you run that?

Yeah, so there's a, there's a 3 to 4 year corporate plan, um, and in addition there's an annual plan, if you like, or an annual focus areas, uh, document which is put out. And I really think those are certainly that the annual focus areas are really important. It's an initiative that was actually started by the Tax Office some time ago, which was to signal to taxpayers, you know, we've got a lot to do. We, we clearly have to focus on many, many areas of tax administration, but we want taxpayers to be aware of what we're particularly focused on, and, and this is why. And I think that's a good discipline for regulators to signal that. Now, where do they get that from? You know, formally they get that from a number of sources such as Council of Financial Regulators, you know, so APRA, Reserve Bank of Australia, ASIC, and Treasury, and the ACCC all coming together and saying, here are the things that we collectively are concerned about. Uh, you know, organizations will have their own strategic intelligence and analysis areas that will produce a risk outlook. They'll be talking to their international colleagues and saying, what are you seeing in your country? Could that be replicated here? Or indeed, what are the cross-border implications of particular concerns? And a good example of that would be crypto assets, right? Cryptocurrencies. Another source of information would be formal and informal feedback that regulators receive from the market. So for instance, at ASIC, we had external advisory committees in specialist areas, whether it be in, you know, retail banking or consumers or insurance, wealth management, etc. So you're pulling together a lot of feedback. Ultimately, at the end of the day, it's the leadership of the regulator that sets the corporate strategy. That can be informed by what's called a statement of expectations from the Treasurer, in the case of ASIC and APRA. Uh, but obviously regulators are responding to what they're reading and hearing themselves. You know, if there is a near miss or a total collapse in, in a particular entity and that leaves a lot of consumers exposed, if there's particular nefarious practices involving communities that suffer from disadvantage or marginalization, again, that's an area of focus. At the end of the day, What regulators don't tend to do is signal what they won't be looking at.

Okay.

And there's a very obvious reason for that, because they don't want criminals to be saying, well, I'm going to go over there where they're not looking.

Yeah.

But I think, you know, all of us in the market understand there's, there's only so many people who work in the regulators that can, that can look at everything. And, and in a very broad remit, like ASIC's, um, you know, you're constantly having to make those strategic choices. What are we not going to do?

And, and rightly so, because I mean, with the sort of backdrop of you're, you're running at some sort of capacity, you've got new policy coming in, so by default you're almost not culling, but you're, you know, we don't have the sunset clauses, so redundant or things that aren't a focus anymore are not being you still need to police them, but just by, you know, to be able to focus the resources and the effort, there's some key areas. And so then they're not getting focused on, maybe should have been, yeah, removed.

Or, um, and look, it's very different. You know, the closest analogy people will use is, you know, policing the roads for road safety. Now you can put speed cameras and you can put red light cameras on every intersection and they will catch every single person that breaks the law. And that's great because then there's no bifurcation between those that were lucky to get away and those that were unlucky enough to get caught. You can't do that in market regulation.

Right.

I mean, it's inevitable that some entities will be focused on, and the Royal Commission is a great example of that. You know, there was just a zero tolerance and zero focus in on the large financial services companies, particularly the banks and some of the insurers. Because that's where all the stories came from, through the Royal Commission. And a lot of that work was already underway at ASIC before the Royal Commission. But, you know, then the accusation becomes, well, there's lots of smaller players out there regulators are not focusing on. Well, the regulatory response to that is we can't look at everything, but if we set the right tone and we send the right deterrence messages to the market through selected action against, you know, 3 or 4 or however many large entities and, and a selection of smaller ones, then hopefully the market gets the message.

And, and that's certainly, um, I mean, just thinking from a practicality perspective, small business makes up a very large proportion of overall business in Australia, and typically small business, um, doesn't have the resources to, you know, if we look at maybe agenda— oh, that's probably a bad example— but where they've got the same requirements as one of the Big 4 banks, for example, who has the resources to be able to fulfill teams to manage and oversee that. So I imagine that can be quite a challenge. And is there any— as a regulator, would you have some— is there discretion there that, okay, we understand you're a small business, therefore We accept a different standard, or—

No, you, you couldn't say you accept a different standard. What I think you can say is it's a proportionality analysis undertaken. So if you look at the size of the impact of a failing on the part of a, of a large player, and the likelihood of that impact taking place, having a broader systemic impact across the market, then it makes it easier to justify why you would take action against a larger player. That's not to say that the smaller player has a lighter load. They have exactly the same obligations. But this is a real problem because there are limited compliance resources out there. You know, as we were discussing just before, you know, the volume of regulation is getting more and more, and those few resources are having to give more advice and support more processes and systems and uplifts to embed new compliance all the time. You know, unfortunately, we don't have a, you know, central regulatory body that determines who goes first or which regulator's regulatory requirements gets primacy over others. At the end of the day, it's a bit of an unholy mess, and it's up to the organizations themselves to work out what priority are we going to give to this new requirement as opposed to that new requirement. And inevitably— and, and, you know, this is my personal view, I'm not saying this is a corporate view— inevitably there does have to be some pricing for risk embedded in those decisions. You know, how likely is it that we are going to get that wrong? How likely is it that the consequences of getting it wrong will resound in a significant penalty?

And speaking of personal views, I know there's an article which you contributed to in the AFR when you, when you finished up at ASIC Um, which, you know, got a bit of, um, attention. Maybe if you want to share that, because it was probably quite controversial coming from someone who was running ASIC to, to come out in the newspapers with that view.

So at a— as part of the normal sort of course of finishing up at ASIC, I was, you know, interviewed as to my views on a number of things, including, um, you know, the quality of the parliamentary committee oversight. of ASIC, and I ventured a view which I think was widely shared at the time, not only within my own organisation, but I think amongst other regulators, that there are a lot of committees. And, you know, there's a lot of time spent preparing for those oversight hearings. They involve, you know, very senior people from these organisations having to spend time in Canberra waiting in anterooms to be brought on. I for hearings that often run very late, uh, and where the time is ultimately truncated because they are falling behind. And that there are times in those committee hearings— and I certainly encountered this— where members of the committees will turn up and, and throw gotcha questions at you. Um, now it's not meant to be some sort of courtroom interrogation process. It's meant to be a thoughtful exchange of information and, you know, well-prepared, well-articulated responses to good questions that seek to further the public understanding of what the regulator is doing and how efficient they're becoming.

Yeah.

If you get a left-field question out of thin air that you had no advance warning of, of course you're not going to turn up and have the answer. And, and to use those sorts of events as a spectacle to embarrass and to score political points, you know, I'll hold to this view. I'm not sure that anyone is the winner there. And, you know, as, as a voter, as, as somebody who elects, um, you know, my representative to go to Parliament, I'd want to make sure that they're making good use of their time when they're there.

Yeah.

And, you know, I hold to the views I expressed. Um, I know that some people after the event disagreed that that was a view that was held within ASIC. You know, I stick to the line I said at the time. It was certainly a view that we could always improve the quality of the, of the oversight and assessment. No one at ASIC, or at any regulator I've ever worked at, ever says we shouldn't be overseen, or that we shouldn't be grilled and challenged on things that we could do better on. That absolutely is the case. But let's make sure that the quality of the questions are pretty good as well.

Speaking of quality questions and grilled and challenged, And just maybe now really getting an appreciation for the power that this role could yield. Tell me about the screening process to then become the successful chief exec of ASIC. Was that as— I imagine that was quite gruelling and challenging to make sure that the right individual is in that role.

Well, so I was a commissioner at ASIC and As I said before, it's what's called a statutory appointment. So it's saying you're not part of the employees, you sort of operate as sort of slightly above, um, the organization, sort of like a quasi-board, but, but you're, you're not independent and, and, um, you know, you're full-time. It's not like being a non-executive independent director in a listed environment.

Right.

Um, I can only talk about my own experience. I, I believe, you know, other people have different experiences. I remember once being on a panel and, and, you know, other regulators that I was there with all kept talking about being tapped on the shoulder. And I thought, well, there must be something wrong with my shoulders because I never got tapped. You know, I saw an advertisement, you know, in the Financial Review and I applied to it.

Wow.

And, and then I went through a screening process like you go through for any other job. Was it rigorous? Yeah, it was the right level of rigor in terms of, you know, testing and challenging both your sort of critical thinking and your conceptual thinking. And then there was a, again, an appropriate degree of probity assessment to make sure that, you know, there was nothing in your closet that might come out and embarrass the organisation down the track. You know, if I compare it to, for instance, the process I went through to become in my current role at Vanguard, you know, as a general counsel in Australia, that was a far more rigorous process.

Mm-hmm.

But, you know, that was being set by US standards. Um, you know, which has a sort of higher, higher bar.

Yeah.

Um, I can't speak for the experience that others went through. I know that it's easy to criticize people who are in positions of authority as to their skill or their ability in the role. It's a pretty cheap shot. Uh, you know, when you're in those jobs, you don't have any friends, let alone many friends. It's a lonely place. Um, you know, I, I would say that I suffered at times, particularly during the pandemic, from, you know, quite acute anxiety. Um, I was depressed. Uh, there were times when I was, you know, I felt I could have been better supported, particularly when we were being aggressively criticized and attacked over some of the public policy development we were doing. I was leading some reforms and revitalization, talking about updating, revitalization of our policy settings around responsible lending.

Right.

And, you know, some of the vitriol and mistruths and half-truths and mythologies that were thrown at us as to what we were meant to be doing or said to be doing or allegedly doing You know, it was just not only ignorant but hurtful. And, you know, there were times when I genuinely thought, I cannot believe I'm doing this. Why am I doing this? And I stuck around because it was the right thing to do for the team, you know, to show that leadership, to show courage and resilience. But, you know, it wasn't pretty. And, you know, personally, having been through that experience, I would struggle to urge somebody to follow in my shoes.

And it's— I mean, it would have been an interesting— when you saw that role in the Fin Review and knowing your background, knowing that you've been in the commercial, um, you know, financial institutions, I'm making an assumption here that it wasn't the pay that— or the opportunity. Um, so what was the driver for, um, I guess initially getting into it? And I know you're saying it might be hard to recommend knowing now what you've been through, Um, but what were maybe some of the things that you didn't expect that you, you came across that you enjoyed in the role potentially? Or what, what, what drive— what was the motivator to become a regulator? What was the motivator now you've been a regulator that you would suggest to others?

Well, look, going way back, uh, the very first time I took a job at ASIC was when it was actually first established as ASIC. It used to be called the Securities Commission, and then it became the Securities and Investments Commission. That was in around about 1998, 1999. And up to that point in time, I had been a litigator, uh, a court-based, you know, lawyer, uh, in the UK, Hong Kong, and, and then later on in Australia. I'd always been on the defense side. I'd always acted for the people that were being sued, whether it be by the regulator or by others. And I had a genuine curiosity— what would it be like to be on, on the prosecution side? And I'd become a partner in a law firm at that stage. I was in my early 30s, and I thought, wow, is that it? Is that the best that life could be, a partner in a law firm? I thought it must be really interesting to be on the other side. And so what attracted me was firstly being in public life and being, you know, in a, in a role in the community where you can hold your head up high at a barbecue and say, you know, I work I worked for the Commonwealth, I worked for, for the public. Um, you know, there's an element of sort of do-goodism, I suppose, about all of that. Um, I found that it gave me fantastic breadth in terms of experience and opportunity. I went from being, you know, a fairly narrowly focused black-letter lawyer to being a general manager of people, of teams that were comprised of a multitude of different disciplines and composition. And I thought that was a great opportunity in terms of my own development skills. Uh, you know, as a regulator, you get to largely pick and choose the sorts of cases you want to work on. Um, going back to the point we were making before, you don't go after everything. You pick the ones that you think are going to have the biggest impact. And so that was very appealing for me as well. But, you know, fast forward, uh, to years later, um, when the role at ASIC as a commissioner came up, well, at that stage I had been the CEO of the Financial Markets Authority in New Zealand. So I thought, well, That's a great learning opportunity, having been, you know, the executive leader of a regulator in a smaller environment, to then stepping up, you know, into the ASIC role where I'd worked as a staffer, you know, where I'd had that experience at the middle management level, to, to be at the top of the organisation and to be one of, you know, 5 or 7 commissioners. I thought, this is the pinnacle of my career. I mean, this was gen— I thought this was where I would end up. That was, that was my goal.

Yep.

And, you know, the, the thought of being able to work with some incredibly bright people, be at the forefront of cutting issues that are so significant to financial consumers, you know, being involved in those strategic discussions with, you know, the leaders of the largest financial institutions You know, some of the, some of the conversations and issues that I was personally involved in leading into the pandemic and through the pandemic, particularly around, you know, emergency relief and a relaxation of some of the rules to enable, you know, mums and dads out there that are locked down to get access to cash and to be able to get services from their banks and to get credit cards that otherwise they'd have to go into a branch to— I mean, just Yeah. Everyday simple stuff, that was fabulous. And, you know, sitting around the Council of Financial Regulators with, you know, the Governor of the Reserve Bank and the heads of the other agencies, immensely privileged position to be in. But as I say, it's not for everybody. It is a lonely role. You're not really part of a team. You know, you exist in something of isolation. And you don't manage any staff. And to me, that was, that was not a great model. I didn't enjoy being disconnected from having a team that I was a part of, and I realized it was pretty lonely.

Well, you're not, you're not alone there. We should have found you as a Mastermind participant in that time of, um, I mean, it sounds like quite a challenging time, and it's nice to hear some of the, the high notes there and some of the, the reasons why you would actually, uh, take on that role as well. So great, as usual, getting both perspectives. Um, you're kind of like a chameleon, even in the law room where you're acting on the defense, and then you're sort of jumping onto the other side to get that perspective of being in the prosecution seat. Um, and just something else maybe we could flick to, you've mentioned it a couple of times but we haven't quite gotten there, around public opinion. So, you know, what is the right thing to do? There's regulation, there's law, then that now there's the court of public opinion, which is, I guess, probably one of the fastest evolving things. And now with the new media channels and political influence, maybe we could talk about that as a dynamic. So you're— what's your view on how does that wield power, and then how does that impact you as the regulator, and how did that all— how does that flow efficiently, and what maybe some bad examples that you've seen, or where it doesn't work as well?

Well, I, I think this comes back to a comment, you know, we made right at the outset around trust. Um, and Laura Tingle's got a piece in, um, in last month's Monthly talking about civility in public discourse. And one of the things that really worries me, uh, and, and certainly something I experienced myself when I talked about that example of working on the responsible lending policy updates at ASIC, this, this binary nature now in public life. And, you know, it's not only in politics, it's in the media, it's in business, it's in sport, it's in society. You have to pick a side. You can't sit on the fence. You can't be neutral. You can't really be objective because what are facts anyway? Whose facts are you talking about? And, you know, right now we're seeing some appalling examples of that, you know, particularly in the US presidential election. We're seeing it in, in relation to opinion around Middle East conflict. Um, I'm no expert, I'm just a commentator and an observer, but what I can say from my lived experience of being on the Commission at ASIC and having read, you know, various articles that made accusations about what we did or didn't do I mean, the reality is there are a lot of commentators and experts out there who sit comfortably in their armchairs with the safety of anonymity behind them as they, you know, post sometimes quite repugnant and disgusting material behind an anonymous pseudonym, don't have the courage to put a face or a name to their opinion. And when they do, they are often ill-informed. And, and to their, you know, to their defense, I might say ill-informed by people who should know better, you know, by media who choose to take a particular line or ignore a particular fact. So I'll use the example of responsible lending. You know, there was a, a very strong rhetoric coming through the, uh, some, some journalists in the Financial Review at the time that what ASIC was seeking to do was to starve mums and dads of credit, uh, you know, whether it be mortgages or personal loans or credit cards, because we would require them to have to jump through such high hurdles that no bank would ever lend to them. And, you know, various so-called evidence was pointed to to suggest that, you know, credit was drying up in Australia right at a time when everyone needed it. In the pandemic. There was absolutely no factual basis for that. And even though parliamentary committee after parliamentary committee, briefing after briefing, media report after media report where we tried to tell the truth, it just didn't get reported. It either wasn't interesting enough, it didn't create a headline, and therefore there was no revenue from that click, or it didn't suit the narrative. And, you know, I'm not going to make a comment about politicians, but there were certainly politicians that bought that line as well and sought to use it to their own advantage. So, you know, if anybody is who's listening to this genuinely interested in a life such as the one that I've had in a regulator, just be prepared. You know, be prepared for what will be a torrid, um, a torrid, you know, volume of, of lies and half-truths that get thrown at you, and, and which are very difficult to rebut sometimes. I think what this means is that we, we all have a duty on ourselves to educate ourselves, to inform ourselves, including looking at things that may be uncomfortable and seeking to educate us ourselves about things that we may have made assumptions about. And it absolutely speaks to me of the, the necessity for us to have, you know, a very broad-based media that isn't beholden to, to one particular viewpoint over another, and that, and that journalists and researchers should be appropriately remunerated so that they're not forced to make outlandish claims just to get a click.

Yep. Well, thank you, thank you for sharing that, that perspective. And maybe just something, if we could round out, um, this part of the conversation. You sort of started with, you know, regulation exists around where there's a failure of the community to self-police or self-regulate. And this is probably a generalization of a question, but is— do we not self-police or self-regulate because there is a commercial benefit or a benefit to that? Or is it a laziness? Or do we need to talk about a specific example to make broad brushed? Why don't we self-regulate? Is it not in our commercial interest or— Yeah, is there something that's like, you know, generally this is what happens and this is why we need, you know, a new piece of regulation? Or is it that it's got in the rumor mill and therefore politicians picked it up and therefore it's the news of the day, there's a vested interest to push a new piece of regulation? And yeah, I mean, I'm just throwing scenarios out there.

No, no, no, no. And you know, it's good that you filled up time asking the question because then it means I've got less time to answer.

But, um, no, we're not on the clock here. We're, uh, we'll go forever.

But Look, I'm no sociologist or psychologist. Um, the sort of modern theory of regulation is espoused by a guy called Malcolm Sparrow, and Sparrow talks about regulation being there to avoid harm. And I think, you know, that is a, that is a good way of contextualizing it. And then we have to think about, well, what does harm mean and, and whose harm are we talking about? I think there's a simpler overlay, which is if you take any slice of the population, there are people who inherently, um, are minded to break the law. And that, that's in any context. You know, some of those people that are, you know, criminally, um, minded, you know, that they don't fear being caught. They are driven by other imperatives, whether it be greed, whether it be anger, whether it be you know, some other form of, of inducement. Studies have shown that the largest percentage of the population are what's called opportunists. So they will comply if they think there is a risk of being caught. And the classic example is when you're going along the freeway and you know that there's a speed camera up ahead, everybody adjusts their speed so that they don't get caught. They go on the other side of the bridge where the speed camera is behind them and they accelerate again. And that's just called convenience. Some people call that laziness, some people call that, um, you know, being, being risk-aware and opportunistic, but it is what it is. And then there is a percentage of the population who, whether they're being watched or not, will do the right thing.

Mm-hmm.

And, you know, I think that is a great virtue in an organization, to have a culture where you do the right thing even when no one is watching, because it is the right thing to do, and you don't need to be deterred by the risk of a penalty. You don't need to be punished into submission. You're doing it because you know that it's in everyone's best interests to be compliant. Um, regulators rely on that last group to sway opinion and to nudge and influence the behaviors of others. And you want that percentage of the population to be as large as possible. Regulators have to focus most of their time and energy on the first group because those are the ones that can do the real harm and where the most negative media will, will follow that regulator for not pursuing those people. You think about every time a company collapses when it doesn't pay its workers for their entitlements, or where a financial advisor goes rogue and steals the investment money of its clients. You know, the regulators are expected to be there and prevent that behavior from happening. There's a big slice of the population of people who, genuinely speaking, will do the right thing if they know what it is. And, you know, one of the things which came through the Royal Commission studies was that there was little, if any, evidence of people acting deliberately to do the wrong thing. There was plenty of evidence of failure of process, poor systems, poor policies, the wrong inducements, and that led to the failures that we saw in the Royal Commission. But I would call that more failures of omission and of ignorance, and sometimes willful ignorance, rather than people who set out to harm somebody else. And so this sort of concept of harm is a— you know, it applies in different contexts. So go back to the example before of an aviation regulator. You, you know, near misses in aviation could be fatal. And so we need to make sure that we learn from the near misses. We don't want planes being too close to each other in the air. Whereas in other parts of the marketplace. Near misses aren't such a bad thing, and, you know, that's something we learn from.

What an interesting, uh, way to sort of round out the conversation. And just, just from a— is there a gut feel around, you know, you're sort of talking about percentages, if you had to sort of guesstimate? And I'm putting you on the spot, so, um, you know, as if you look at the population of Australia, which You know, 20-odd million people, how would you break that apportionment up between the 3? How many of us are looking to actively break the law? How many are in that opportunistic sort of category? And maybe who's in that sort of most—

This is gonna be one of your rapid-fire questions. I'd say 10, 70, 20.

10, 70, 20. Okay. Okay. So you've got 70% who are potentially in that optimistic—

Opportunistic.

Yeah. Area.

And who are crying out Well, maybe not crying out, but they're looking for leadership.

Yeah.

They are looking for corporate leaders, community leaders, political leaders to show them the way, to steer them in the right direction. And with the right level of inducement, encouragement, and the right behaviors from those leaders, they will follow. I'm not saying they're like sheep— that wasn't a New Zealand joke, by the way— but, you know, that they are— they genuinely want to know what to do. And they see somebody that inspires them and they go, okay, well, that's what I'll do.

All right, so thank you, Sean. Just one last question. I know you've sort of had many different— built up many different perspectives, and one I'd like to maybe tease out is leading in a regular regulatory body like ASIC or some of the other regulatory bodies you've worked in versus, you know, your current role at Vanguard or some of the senior roles you've had in financial institutions. Is it different? Is it the same? I'd love to get your perspective.

Well, the obvious difference between leading in a regulator and leading in a corporate environment is that in a regulator you've got one shareholder, right? But it's a very big shareholder, and it's called the public. You know, everybody has a view, everybody will express expectations of you, and not all of those expectations will be positive. I think, you know, corporate life has its obvious challenges, uh, you know, whether it's higher risk or, or lower risk. I don't think you can make that simplistic assessment. Um, it— in, in public life, you can always hold to the, the rung of the ladder and say, we're doing this for the good of the community. And at the end of the day, you know, we will, we will fight or— and, and we will live by the fact that this is what we're doing is in the public interest and we're protecting those who can't protect themselves. And there is an element of being noble and that, that honor that goes with being in leadership roles in a public organization that I personally find, you know, very attractive. It's not for everybody, as I've said before, but it certainly appeals to me and it appeals to my values. But having said that, there's an excitement and there's a, there's a greater sense of innovation and the ability to take well-considered risks that goes in corporate life. I, you know, when you get to the top of these organizations, I don't think there's a lot really between them in terms of the sorts of skills that you need as a leader. Your audiences may be different. You know, if you're talking about a CBA, for instance, it's a pretty big audience. Um, and if you think about the regulatory remit that ASIC has, it's not everybody in Australia. It's most people in Australia because most people will have a financial product. So you can see there's sort of some clear overlap there, but I think accountability is something that there is a big difference. And I touched on this before— accountability, feedback, oversight, performance evaluation in the corporate sense, I think, is a lot clearer and it's more predictable, and you know when it's going to happen, and there are structures and systems around it. I think as we were saying before, the efficiency and the effectiveness of regulators and how they get measured in meeting those expectations is a lot more fuzzy. And that makes it a challenging role because you never really know whether you're hitting your marks. It's not like saying, well, you know, we can measure return on equity, you can measure our value by the share price, we can measure our value by how much market share we've gained. You just don't have those metrics in a regulatory role. I— we thought about developing something like that when I was involved in the setup of the New Zealand regulator. For instance, we thought, you know, would we be able to measure flow of capital into markets as an indicia that this is a well-regulated, well-respected market? But, you know, how much of that is due to regulation and how much of that is due to increased household wealth investing? You just don't know.

It's an interesting sort of conundrum, isn't it? Because the more regulation that you're doing, obviously the more failure to self-regulate, or the more activity you're doing and the less that you're finding, then that's a good thing. However, yeah, it's— but then it's, also, are you doing your job as a regulator because you haven't found any outcomes of, you know, non-compliance? But then finding compliance would be a great outcome for the— your shareholder being the public. Yeah.

And I, I know something we talked about briefly yesterday was, you know, we measure regulatory effectiveness by, you know, let's be blunt, heads on sticks.

Yeah.

How much enforcement action has there been in the last year? And the— and, you know, ASIC is very proud of its enforcement record and, and regularly reports on it to convince stakeholders, particularly politicians, that it's doing a good job. You know, there is a theory that others ascribe to, which is the less you're seen, the more effective your regulation must be because the market is self-policing.

That's true.

And, uh, many, many years ago, I was lucky enough to meet, um, the Dutch regulators who were visiting Australia, and They talked about using a very different philosophy, which was actually to reward good behavior. And they would publish— now, I don't know if they still do this, but at the time they were publishing what is essentially a table of entities that had not been the subject of any regulatory action in the last 12 months, 3 years, whatever it might be.

Yeah.

Now, you know, that, that can also be a bit of a dangerous league table because there's only one way from the top, um, and the market will notice that. But Um, yeah, I, I don't know whether it's a sort of a balanced use of the carrot and stick, but one thing I do know that corporates like the one that I'm currently working with would say that there really, there really is no sense from the regulators that they think you're doing a good job or that the quality of your services and products is meeting the standard. I mean, the absence of a response is the equivalent to a compliment.

Right. Wow. I mean, it's— when you, when you put it like that, I mean, you're absolutely right. I mean, it, it— that role does become even more isolating than, than a senior leadership role in a corporate organization, which is already isolating in itself. Um, interesting. Yeah, positive-negative reinforcement. I mean, um, you know, having an 8-year-old daughter, I, I see the reluctance, the resistance which comes with, you know, the negative reinforcer. If you don't do this, then there'll be no TV or whatever the simple scenario is. But that would, you know, change the interactions that someone like an ASIC would be having with positive reinforcements, 'cause it can be more enjoyable rewarding good behaviour. And I mean, there's lots of literature around one versus the other.

Yeah, and I think, you know, APRA, you know, I never worked at APRA, but, had a lot to do with them and worked very closely with them when I was at ASIC. I really like the fact that they do have what I think is a more sophisticated toolkit to influence behavior, and particularly their ability to impose capital on an organization when things are not going well and when they want to ensure that management's attention is focused on fixing a problem. Now, when capital comes off, as they have done, you know, with some of the banks recently, and that is a clear signal not only to the market but to the board and to the management that, yes, we think you've, you've done what we asked you to do and we're happy, we're comfortable with your performance. They're never going to take out a full-page advertisement to say that, but that's the signaling that I think it's important. And the market, at the end of the day, like any person needs rewards, needs to be acknowledged. I mean, we're all human, and it's important we get feedback. And the absence of feedback being a compliment, as I said before, it's not, not nearly enough.

Yep, yep. Fantastic. Well, I'm glad I asked that last question, and what a great segue to move us into some of the shorter answer questions. So is there a favorite quote or saying or proverb that you sort of— that stuck with you that you'd like to share?

So I have my own sort of proverb, I suppose, which is you can't be challenged and comfortable at the same time. And it's driven my career choices and my path. But, you know, I'm not going to claim credit for it because actually those of you who know Theodore Roosevelt's book, you know, the poem, The Man in the Arena, it really sort of comes from that. I'm just going to quote from it. You know, the man who at the worst, if he fails, at least fails while daring greatly, so that his place shall never be with those cold and timid souls who neither know victory nor defeat. And it's that sense that— and I think it particularly appeals to people who've been in public life or endured any particular challenge to get something done. It's not about popularity, it's not about winning votes, it's about around trying and, and trying to leave things better than you found them.

Yeah, well, I bet that would have been right on your desk when you were in the middle of COVID and taking on a bit of a, you know, bad PR and misinformed articles flying around. So I'm sure that would have given you some strength to know that, okay, I'm doing this for the right reasons and making an impact. Thank you for sharing that. Um, just some advice. So you've had many different perspectives now. Advice for your younger self, what would you tell yourself Before all this began?

I'm not sure it was worth it all. But no, seriously, without being too self-indulgent, I think I've been way too serious and I took life too seriously, particularly at an early age. I didn't have enough fun. I didn't explore all the opportunities that might have come my way. And I sort of saddled myself with responsibilities pretty early. I sort of fell into the law. I really wanted to be a journalist. And, you know, I, I look back on, on what I've done and I've achieved. I'm very proud of it, and I've had some great opportunities. But particularly reflecting on, on the, the last career I had, um, I, I feel as though I sort of stood still for a while and didn't really grow as an individual. So I wished I'd taken more risk in my career in, in the early stages and had a bit more fun.

Yep, great. Well, thank you for that, for sharing that. And I, I guess being the head of a regulatory body, and this is my naive opinion, would some ways condition you to, well, you know, you should be serious because you've got a serious role and a serious thing to do. Um, I wonder if yet that was a pressure to be more serious because you're in a very serious role, you're in compliance, even when you're in corporate in a compliance function. You need to be the serious guy because you need to keep it all in check, which is interesting, you know, and a desire to have more fun. 'Cause I imagine you may have had to suppress that to be so effective in these types of roles and functions.

Yeah, I remember once going through like a development assessment piece of work which Egon Zehnder ran at ANZ when I was, you know, in running the compliance team there. And the sort of feedback which came through the 360 process was, you know, has got absolutely the right image for the job, you know, very serious, you know, very focused, absolutely trustworthy, lots of integrity, but hell, you'd never want to get stuck with them at a barbecue.

God.

And, you know, that I've reflected on that over the years, that because of the nature of the jobs I've had, people do after a while sort of think you're a bit of a goody-two-shoes, or that you are judging them, or, you know, you, you don't have a fun side. And I've— I almost feel as though I've developed 2 personalities, that I've got a home personality and I've got a work personality.

Yeah.

And it genuinely saddens me that in roles like risk or compliance or internal audit or regulation, it's very hard to be yourself if you're not innately that person that people expect you to be. Um, it is lonely, and no one expects you to be the person that will generate the success for the organization. They see you as the person that will stop bad things from happening.

Yeah.

And, and I think there's a common criticism or grievance amongst people who work in functions like the ones I've worked in, that we're very good at celebrating success by the, the sales staff, for instance, but it's often the legal and compliance people that get thrown in the heat when things go wrong. Or, why didn't you stop us from, from that happening? Now, that— I think it's a very jaundiced view, and I think the truth lies somewhere in the middle there.

To make it easy to— yeah, stereotype, make it easy to get the concept. Yeah, I, I think—

yeah, but you know, I've been I've been to some pretty painful offsites, corporate offsites over the years where you walk into the room, you know, for the pre-dinner drinks and everyone goes, oh, let's don't get stuck with him.

Make sure you've got your cab charge and no locations.

Yeah, get all your receipts in your wallet.

That's right. Oh gosh, um, you sort of, when you were, when you were talking there, you reminded me of sort of the stereotype of the accountant, which I think is now, uh, very much evolved now where accountants are probably one of the most outlandish individuals in the corporate—

Particularly in the tax planning area.

Yeah, absolutely. You know, there was a stereotype that they were quite introverted and all these things, which eventually gets broken down. And maybe because it is still a relatively new function, as you mentioned, didn't exist compliance when you started your career. Perhaps those stereotypes will continue to get broken down and we can merge your home and work personalities together. Um, just a book— is there a favorite book that you'd recommend people pick up and read, or one you found beneficial?

My dad, um, who passed away earlier this year, gave me a book called Reach for the Sky by Douglas Bader. And, you know, you can probably tell from my age that, uh, you know, my, my parents' generation were all in World War II, and I had some uncles that, that went and fought. And the thing about Reach for the Sky by Douglas Bader is he wanted to be a pilot and was training to be a pilot when he had a horrific accident and had both his legs amputated. And he didn't give up. He was the first pilot ever to go into a combat role and ended up flying successful missions and being shot down in the European campaign during World War II. Now, you know, he's a sort of a swashbuckling hero of a character, and I understand in real life, you know, was a little unpleasant and, and probably would be seen in, in today's world as, you know, discriminatory, derogatory, and a whole bunch of other things. But it's not so much the person, it's the story. It's that, you know, he had a higher purpose, he had a goal, and he wasn't going to let— anything get him down. And it reminds me, as I said, you know, my dad gave it to me and he passed away earlier this year. So I often think about him when I think about that book. It reminds me of my youngest son who has a condition called albinism. And so he's legally blind and he does not let anything get in his way. He's finished school, he's a commerce graduate. You know, he is that young man that it doesn't matter that he walks into a wall or can't see something, but he hasn't let that stop him. he hasn't let it stop him having ambition or seeking to extend himself. And I just really admire people who, despite their challenges, whether they be any form of disability or any form of discrimination, rise above it. And I think it's a tremendous lesson for us all.

Fantastic. Thank you for sharing that. Um, okay, now we're going to move into some Rapid-fire questions. I'm just going to set my, uh, my stopwatch here for 1 minute, so I've got 60 seconds to try and ask you as many questions as I possibly can. So it's one or the other. Um, ready to go? Okay, first one: avoiding discomfort or embracing risk?

Uh, embracing risk.

Politicians or public opinion?

Public opinion.

Breakdown of trust or free market?

Breakdown of trust.

Market self-regulation or government intervention?

Self-regulation.

Ethical behavior or compliance with rules?

Ethical.

Responsibility to society or responsibility to shareholders?

Society.

Public trust or corporate success?

Trust.

Top-down governance or bottom-up feedback?

Oh, I wanted to do both. Um, bottom-up feedback.

Intuition or analysis?

Intuition.

Creativity or pragmatism?

Creativity.

Opportunity or risk?

Risk.

Proactive or reactive?

Proactive.

Soft skills, hard skills?

Soft skills.

Brainstorming, structured planning?

Brainstorming.

Incremental improvements or destructive— disruptive breakthroughs?

Incremental.

Risk-taking or risk management?

Risk management.

Diversity of thought or consistency of vision?

Diversity of thought.

Long-term vision, short-term wins?

Long-term vision.

Autonomy or guidance?

Autonomy.

Technology-driven or human-centered?

Human-centered.

There we go. Thank you. All right.

And the result is you're a freak.

Oh, thank you, Sean. So it's been so, um, fascinating to just get your perspective, and I'm really, um, really happy that you've come in to sort of share because I think Regulators, as you mentioned before, are effectively humans.

Almost.

Well, I think you've done a great job at humanising who the individuals are, sort of, you know, because if we think, oh, the HRC is, uh, you know, doing this or doing that, there's a lot of— there's— it's never really a personalised thing. And I think it's great to sort of get your perspective around some of the challenges, um, you know, what that environment's like. And I might just sort of throw to you if there's any sort of closing comments, uh, to round out today's conversation.

Yeah, and look, thank you for the opportunity, obviously, because I wasn't quite sure where it was going to go. But the, the thing about regulators is, you know, no one's sort of forced to be a regulator, and, and so far there's sort of no certified professional qualification of as being a regulator. So we're all just trying to do our best, um, and, and absolutely we get it wrong. One of the things that I've taken away from my experience, because know, I know that, that, that was the last regulatory role I'll have, is that, you know, humility goes a long way in breaking down barriers. And something that I tried to do when I was interacting with, you know, senior financial services leaders, uh, in, in my role as a commissioner is ask them what's working and what's not working for you. There's a bit of a tendency I find for regulators to walk into a room and start talking at their audience and telling them what they need to hear. Because you've been given your talk track, you've been told these are the key messages to get across. And this is not a pointed criticism at anyone, but I think regulators could do much more in terms of listening, right? Because at the end of the day, the people that pay the levies which fund the regulators are the ones they're talking to.

What a great perspective to end on. Well, uh, yeah, thank you again for your time today. And I know you're just across the, uh, the courtyard there, and thank you for walking over and allowing us to, to capture this and share it with the audience. So thank you very much.

Thank you. Thanks for your time.