Chapter 05

Failures of corporate governance

Introduction

1. The principles of good corporate governance, including a discussion about two aspects, risk management and culture, can be found in Chapter 4.
2. This chapter will identify inadequacies in Crown’s risk management framework and culture. It will assess the sufficiency of Crown’s remediation plan, which is designed to improve its culture.
3. For the most part, the discussion will concentrate on the Crown group, because the risk management framework and culture programs are group wide. Where relevant, Crown Melbourne will be singled out.

Crown’s risk management framework

4. Effective risk management is particularly important for casino operators. Significant risk and compliance requirements are inherently associated with licensed gambling operations. It has long been recognised that casinos are vulnerable to money laundering, criminal influence and exploitation and have the potential to inflict much harm. For those and other reasons, casinos are heavily regulated and rely on a social licence to operate.¹
5. The Bergin Inquiry identified significant failures of risk management at Crown.²
6. The failures included:
   • the failure of the board in its fundamental responsibility to set, monitor and communicate Crown’s risk appetite³
   • risk decisions by senior executives being dominated by a pursuit of profit over the welfare of Crown employees and compliance with the object of the Casino Control Act 1992 (NSW) of protecting the casino from criminal exploitation⁴
   • demands by the board of the VIP International business unit and the incentivisation and encouragement of management to take inappropriate risks in the pursuit of the success of that business⁵
   • the ineffectiveness and underutilisation of Crown’s risk management and compliance structures⁶
   • deficiencies in the various documents designed to capture risks.⁷
7. Crown has conceded that the deficiencies in its corporate governance and risk management framework contributed to the failures identified by the Bergin Inquiry.⁸
8. For example:
   • Ms Antonia Korsanos, a non-executive director of Crown Resorts, Chair of Crown Melbourne and member of the Crown RMC, identified failures to escalate risk to the board, blurred reporting lines, a commercially driven culture over risk management and compliance, and the risk appetite for Crown’s operations in China not being appropriately set or monitored.⁹
   • Ms Jane Halton, a non-executive director of Crown Resorts and chair of the RMC, acknowledged that ‘[a] number of specific failures including in reporting, escalation, skill, knowledge, culture, appropriate diligence and care and lack of questioning’ were identified in the Bergin Report and that in some instances these went to the operation of the risk management framework.¹⁰
9. The Bergin Inquiry made or endorsed various recommendations, the purpose of which were to improve Crown’s risk management framework.
10. Key recommendations included that Crown:
    • articulate an appropriate risk appetite¹¹
    • address deficiencies in the drafting of various policy documents designed to capture risk¹²
    • minimise ‘management speak’¹³
    • conduct a proper analysis of the failings that led to the arrests of 19 Crown employees in China in October 2016, known as the ‘China arrests’.¹⁴
11. This Commission has uncovered further and more recent examples of inappropriate and illegal conduct, especially by Crown Melbourne, in part caused by failures in risk management. There is the tax treatment of Bonus Jackpots,¹⁵ the China Union Pay (CUP) issue,¹⁶ the foreign marketing practices,¹⁷ and the approach to responsible gambling.¹⁸
12. Critical to effective risk management is ensuring that the risks taken by management are consistent with the corporation’s risk appetite.¹⁹ The recently identified failures are inconsistent with Crown’s current risk appetite that it has ‘zero appetite for breaking the law’;²⁰ and its risk appetite statement that it has no appetite to accept material risk related to regulatory, legal or statutory requirements or any activity that would be inconsistent with its social licence to operate.²¹
13. The identified misconduct suggests, despite the reforms to Crown’s risk management framework, risks are still not being identified and escalated when Crown is operating outside its risk appetite.

Reforms to Crown’s risk management framework

14. Following the China arrests, Crown introduced a series of reforms to its risk management program.
15. At the time of the China arrests, Crown’s businesses were operating under a Risk Management Policy adopted in February 2008 (2008 Policy).²² Most risk issues were managed at the level of the individual properties,²³ which had their own RMCs.²⁴
16. The 2008 Policy had a number of deficiencies. First, it made no mention of the ‘risk appetite’ of the Crown Resorts board. Second, it did not specify how the risk management framework worked to ensure that Crown was operating within its risk appetite.²⁵ Third, there was no risk management plan specifically in respect of VIP International.²⁶
17. Ms Halton acknowledged problems with Crown’s system of risk management as it existed before the China arrests. She described the problems in the following way:

    Documentation, escalation and reporting of risks prior to 2018 was not systematic … Some risk areas were more mature than others … The actual risk appetite of the business was understood by some but not all staff. There was a misalignment between the documented elements of the risk appetite and the actual risk appetite of the company … The balance between financial, risk and compliance issues was heavily weighted towards the former … This was not documented in a formal risk appetite statement and there was a lack of formalisation of the risk expectations of the Board … Risk reporting and the escalation of reporting in respect of some risks that had materialised appears to have been ad hoc and limited to some individuals rather than always through a structured process.²⁷

18. In December 2017, following the China arrests, Crown Resorts appointed Ms Anne Siegers as Group General Manager for Risk and Audit to overhaul Crown’s risk management system.²⁸
19. Ms Siegers introduced a series of reforms. They included:
    • introducing a group function to manage risk across Crown’s properties²⁹
    • setting Crown’s risk appetite³⁰
    • developing a risk management strategy³¹
    • formalising the second and third line roles of the Risk and Audit Teams (see discussion of the three lines model in Chapter 4).³²
20. Looking at these changes in more detail, in August 2018, Crown Resorts adopted an updated Risk Management Policy.³³ Under this policy, the Crown Resorts board delegated oversight responsibility for risk management to the RMC.³⁴ Each of Crown’s businesses had its own risk management framework; however, the policy removed the business’s RMCs. Each business then became responsible for reviewing its own risk profile and reporting to the RMC at least four times a year.³⁵
21. In June 2019, Crown Resorts approved a Risk Management Strategy.³⁶ The Risk Management Strategy set the risk appetite for Crown Resorts and Crown Melbourne (which was the same for both entities).³⁷ The risk appetite comprised an overarching risk appetite statement, seven ‘impact categories’, and metrics such as risk tolerances and reporting triggers. The Risk Management Strategy, together with the Risk Management Policy, constitutes the current risk management framework for Crown.³⁸
22. This framework adopted the ‘three lines model’ for risk governance. The three lines model is a recognised, although not universally accepted, model for risk governance.³⁹ The front line team consisting of customer-facing staff (unusually including senior executives) form the first line of defence and assume ownership of, and accountability for, managing material risks. Crown’s Chief Risk Officer (a new role created in December 2020) along with Compliance, Financial Crime and legal functions, form the second line of defence and have no operational business reporting line or revenue-generating responsibilities. The independent internal audit function forms the third line of defence.⁴⁰
23. In February 2020, the Risk Management Policy was revised. The revised policy required the risk management framework of each business to align with Crown’s Risk Management Strategy and its risk appetite. The policy also retained the responsibility of each business to review its own risk profile and report to the RMC at least four times a year.⁴¹ In June 2020, the June 2019 Risk Management Strategy was amended. A new Part 4 was introduced. It recorded that management was required to monitor ‘Risk Culture’. This was defined as:

    [T]he system of values and behaviours present in an organisation that shapes the decisions and actions of staff in relation to risk taking. It determines the collective ability of all staff to:

    • Identify, understand, openly discuss and act on both current and future risks to the organisation; and
    • Operate consistently within the Risk Appetite.⁴²

24. In December 2020, the audit and risk functions were separated, prompting the creation of the Chief Risk Officer role (Ms Siegers’ current role) and the role of Group General Manager, Internal Audit.⁴³ The separation is consistent with the operation of the three lines of defence model, and entrenches the independence of the second and third lines (risk and audit).
25. In April 2021, an updated Risk Management Strategy was adopted, with a plain English risk appetite statement.⁴⁴ That statement reads:

    In general, Crown’s risk appetite is a balanced one that allows taking measured commercial risk as it pursues strategic objectives whilst aiming to manage and minimise risk in its operations. Crown’s Risk Management Framework is designed to manage, rather than eliminate the risk of failure to achieve business objectives and can only provide reasonable and not absolute assurance against breaches of risk appetite. In this balanced stance, Crown is willing to accept, in some circumstances, material commercial risks that may result in impacts to our finances, services to our customers or infrastructure, but only within pre-defined limits and parameters.

    There are a number of areas of the business where Crown does not have appetite to accept material risks. Specifically:

    • Crown does not have appetite to accept material risk related to regulatory, legal or statutory requirements, including in respect of financial crime. Crown’s relationships with its regulators and licensors are foundational and paramount to how it does business.
    • Crown does not have appetite to accept material risk related to any association with or influence from criminal elements.
    • Crown does not have appetite to accept material risk related to any activity that would be inconsistent with its social licence to operate, which includes, in addition to meeting its regulatory obligations, material risk related to its reputation and brand. Crown takes very seriously its stance on ‘doing the right thing’ by all its stakeholders.
    • Crown does not have appetite to accept material risks related to employee health and safety, the maintenance of appropriate security and surveillance across its properties or loss of, or otherwise unauthorized or accidental disclosure of, customer or other sensitive information or data (emphasis added).⁴⁵

26. Ms Halton acknowledged that there may be ‘residual risks’ from previous ‘more liberal’ risk appetites, which would need to be identified and, where inconsistent with the current risk appetite, remediated.⁴⁶ That observation is hardly surprising given the recent wrongdoing uncovered by this Commission.
27. Other recent reforms to Crown’s risk management framework include:
    • the introduction of an Enterprise Risk Management system in Melbourne to collate risk information and facilitate reporting⁴⁷
    • improved reporting lines. Since December 2020, the Chief Risk Officer has reported directly to the CEO of Crown Resorts and the boards of Crown’s other subsidiaries. The Chief Risk Officer also reports to the Chairs of the RMC and the Crown Melbourne Audit Committee⁴⁸
    • an increase in the frequency and duration of RMC meetings⁴⁹
    • the introduction of the Executive Risk and Compliance Committee across Perth and Melbourne⁵⁰
    • the introduction of monthly meetings of compliance officers, including the Chief Risk Officer⁵¹
    • the allocation of more resources to risk management.⁵²
28. Crown intends to continue to improve its risk management systems.⁵³ Ms Siegers’ evidence was that Crown’s risk management framework is under continuous enhancement and review.⁵⁴

VCGLR Recommendation 3

29. Before leaving the description of Crown’s risk management framework, it is necessary to refer to the interaction between Crown Melbourne and the VCGLR in relation to the external review of Crown Melbourne’s risk management framework. This topic is dealt with in Chapter 10. Some aspects need to be repeated.
30. Shortly after the appointment of Ms Siegers, Crown Melbourne’s risk management framework was subject to two external reviews:
    • In May 2018, the VCGLR engaged PwC Australia to provide it with advice on Crown Melbourne’s risk management framework. PwC concluded that Crown Melbourne’s risk management framework and approach was documented, and that processes were in place to support its implementation, but a potential area for improvement was for Crown Melbourne to establish ‘risk appetite’ for material risks.⁵⁵
    • In June 2018, the VCGLR published the Report of its Sixth Review. That Report noted that Crown Melbourne had experienced risk failings relevant to its primary licence and recommended that Crown Melbourne obtain external advice in relation to its risk framework.⁵⁶ Recommendation 3 provided ‘[t]he VCGLR recommends that, by 1 July 2019, Crown assess the robustness and effectiveness of its risk frameworks and systems, including reporting lines in the chain of command, and upgrade them where required. This assessment should be assisted by external advice’ (emphasis added).⁵⁷
31. In February 2019, Crown Melbourne engaged Deloitte to conduct an assessment of its risk management framework.⁵⁸
32. Ms Siegers was involved in instructing Deloitte. Deloitte’s review had a very limited scope. Ms Cara Hartnett, the partner at Deloitte charged with the review, described the instructions:

    In December 2018, Stephen Roche, Partner, Deloitte received a request from Alan McGregor, CFO, Crown Resorts Australia, to assist CML [Crown Melbourne Limited] with a risk management review … [Alan McGregor] also noted that the brief from Crown’s Group GM of Risk & Audit, Anne Siegers, had outlined that the review was to be ‘high level, desktop advice and challenge on the design of the risk management framework’ and that they did not want ‘an exhaustive or highly sophisticated review identifying what best practice is and all the gaps that they could have against that’ (emphasis added).⁵⁹

33. Both Ms Siegers and Ms Hartnett accepted that the Deloitte review was not an assessment of the ‘robustness and effectiveness of [Crown Melbourne’s] risk frameworks and systems’ as required by Recommendation 3.⁶⁰ Further, each agreed that the review did not assess whether the frameworks and systems were ‘embedded’ within the organisation.⁶¹
34. There was one difference of opinion between Ms Hartnett and Ms Siegers. Ms Hartnett said Deloitte did not assess whether the risk management framework was appropriate for a casino.⁶² Ms Siegers maintained that Deloitte had assessed Crown Melbourne’s risk management framework and indicated that the design was specifically appropriate for Crown Melbourne’s business.⁶³ Ms Hartnett’s evidence must be preferred given her involvement in the Deloitte review.
35. Deloitte’s Final Report was completed in June 2019.⁶⁴ The Report made various recommendations and Crown, which at the time was developing a revised group wide approach to risk management, implemented most of them.⁶⁵
36. Notwithstanding the limited scope of the Deloitte review, on 1 July 2019 Mr Barry Felstead, then CEO of Crown Australian Resorts, wrote to the VCGLR about Crown Melbourne’s compliance with Recommendation 3.⁶⁶ The letter stated that an assessment of the robustness and effectiveness of Crown Melbourne’s risk management framework and systems ‘has been completed in satisfaction of Recommendation 3’.⁶⁷ Ms Siegers assisted with drafting the letter.⁶⁸
37. Contrary to Crown Melbourne’s letter to the VCGLR, Crown Melbourne had not satisfied Recommendation 3. Deloitte’s review was merely a desktop review and was limited in scope and utility. Ms Siegers agreed that it was not an assessment of the robustness and effectiveness of Crown Melbourne’s risk management systems.⁶⁹
38. Ms Siegers explained that Deloitte could not conduct an assessment of the robustness and effectiveness of Crown Melbourne’s risk management framework because ‘a lot of the elements [of the revised and group wide risk management system] were not in place yet, so doing an assessment of how well it was implemented would not have been done-able [sic] at that stage’.⁷⁰ Ms Siegers said that she completed the remainder of the review herself,⁷¹ and considered that the requirements of Recommendation 3 had been met, because (according to Ms Siegers), it required that ‘Crown conduct that review with the assistance of external advice’ (emphasis added).⁷²
39. Ms Siegers did not explain what work she had undertaken to complete the review. Nor did she keep a written record of any work she may have done.⁷³ Nor did she explain how she conducted a robust review when it was not possible for Deloitte to do so.⁷⁴
40. When this is taken into account, it is unlikely that Ms Siegers conducted the review required by the terms of Recommendation 3. Even if she had conducted that review, the foregoing discussion highlights that, prior to the VCGLR inquiry, there had not been an external assessment of the robustness and effectiveness of Crown Melbourne’s risk management framework and systems. Nor had there been an external assessment of whether those risk management frameworks and systems were appropriate for a casino business.

Evaluation of Crown’s risk management framework

41. Mr Peter Deans is a risk and strategy consultant retained by the Commission. Mr Deans was the Chief Risk Officer at a major bank. He prepared a report outlining his opinion on the effectiveness and robustness of Crown’s risk management framework and systems. His report considered risk management practices at Crown between January 2019 and March 2021.⁷⁵
42. Mr Deans assessed that the core fundamentals of a risk management framework were in place. He considered there were documented frameworks and practices that could enable Crown to identify, assess, manage, report and (if possible) mitigate risk.⁷⁶
43. Mr Deans noted:
    • The RMC Charter had the ‘key foundational elements’ to enable Crown to establish and maintain risk management frameworks, governance and processes.⁷⁷
    • The length and content of the Risk Management Strategy was consistent with what would be expected of an Australian publicly listed group of the same size and nature as the Crown group.⁷⁸
    • The frameworks and the group’s approach to risk management were supported by an established risk management function.⁷⁹
    • There was evidence of Crown identifying key business risks and elevating those risks for discussion within its governance structures.⁸⁰
    • Processes were in place for the RMC to reasonably identify areas of significant business risk or exposure, and new and emerging risks.⁸¹
44. Mr Deans also identified several areas that needed improvement. He said:
    • The role of the RMC in overseeing the resourcing, operation and effectiveness of the risk management function and with respect to risk culture should be outlined in its Charter.⁸²
    • There should be a rolling agenda for the RMC to ensure in-depth discussion at regular intervals of specific risk categories such as AML and CTF and the external regulatory environment.⁸³
    • A larger set of risks should be reported to the RMC.⁸⁴
    • The RMC and management should develop and agree on a suite of qualitative measures to better monitor and report on whether Crown was operating within or outside its risk appetite.⁸⁵
    • Where Crown was operating outside its risk appetite, the RMC should monitor management’s progress in bringing the relevant risk issue within appetite.⁸⁶
    • The Risk Management Strategy should be improved, including through the inclusion of a standalone risk appetite statement that documented business risks in greater detail,⁸⁷ and through confirming the roles and responsibilities of subsidiary boards.⁸⁸
45. Ms Halton accepted that Mr Deans’ report was a considered report and indicated that it would be treated ‘very seriously’.⁸⁹ She said the report would be considered carefully by the RMC at its August 2021 meeting.⁹⁰
46. Ms Siegers, on the other hand, was sceptical about the value of the report. She recorded in a memorandum to the RMC that it was ‘based on the premise that the practices employed in the financial sector are relevant to Crown Resorts’. She wrote that Crown Resorts had certain risks different to financial risks that required a ‘different risk management response’.⁹¹ She rejected certain recommendations.
47. This is a matter of concern. Ms Siegers’ attitude suggests there may be some impediments to real reform.
48. There are other concerns about the proper functioning of Crown’s risk management framework and systems:
    • There has not been a root cause analysis in relation to the China arrests. The importance of such an analysis has been explained. The Bergin Inquiry and Ms Helen Coonan, former Chairman of Crown Resorts, expressed support for such a review.⁹² Ms Siegers gave evidence that ‘to get an effective root cause assessment, you need to do it very quickly after the events’ and that it was essentially too late.⁹³ No further explanation was given.
    • Documents comprising Crown’s risk management framework remain replete with management speak.

Conclusions

49. Crown Melbourne’s existing risk management framework, systems and processes would benefit from:
    • a root cause analysis into the failures outlined in the Bergin Report and this Commission’s Report
    • implementing the recommendations made by Mr Deans
    • external reviews of the robustness and effectiveness of the risk management framework, systems and processes and their appropriateness to Crown Melbourne as a casino operator. This should happen every three years, noting the first external review is currently scheduled for 2022
    • the Chair of the RMC, currently Ms Halton, being personally responsible for overseeing Crown’s implementation of the recommendations made by Mr Deans and the external review.⁹⁴
50. The Commission understands that Crown Melbourne will carry out these steps. Given Ms Siegers’ resistance to external review and feedback into Crown Melbourne’s risk management frameworks and systems, it is appropriate that Ms Halton (or the Chair of the RMC) has a supervisory role.
51. The Commission also suggests that Crown Melbourne rewrite its documents in plain English.

Crown’s corporate culture

52. Crown accepts, as it must, that its past misconduct exposed by the Bergin Inquiry and by this Commission reflects a deficient corporate culture. It understands that its corporate culture needs to change.⁹⁵
53. To assess the extent of cultural reform required and the challenges Crown faces in achieving that change, it is instructive to reflect on the evidence before this Commission regarding Crown’s culture, both past and present.
54. First, Crown has acknowledged that the failures identified in the Bergin Report reflected a culture motivated by profit at any cost.
55. Ms Korsanos, for example, identified ‘poor culture underpinned by a drive for profits’ as contributing to the failures identified in the Bergin Report.⁹⁶ Ms Korsanos also referred to the China arrests and decision making in relation to junkets as having been influenced by a culture focused on returns over risk and compliance. She said that the failures associated with the Riverbank and Southbank accounts may also have been influenced by similar cultural failings.⁹⁷
56. Mr Nick Weeks, the newly appointed Executive General Manager, Transformation and Regulatory Response, identified the following cultural issues as driving the unacceptable behaviour identified in the Bergin Report:

    Well, I think that overriding cultural issue was the company prioritised profit over all those other considerations that a company with a good culture would balance more evenly. So I think that was a fundamental failing. It seemed to me that there were people in the organisation in positions of influence and power that were exercising very poor judgment in terms of some of the decision-making that occurred, and my sense was from reading that report that the level of reporting, the quality of reporting and the escalation of issues in the organisation wasn’t occurring in a way that it ought to be (emphasis added).⁹⁸

57. Second, an interrelated issue that emerged before the Bergin Inquiry and this Commission was Crown’s methodical exploitation of ‘grey areas’ in service of profit. Ms Halton described this way of operating in her evidence:

    So how I would characterise this is … if you think about things that are black and things that are white, and things that are grey, it strikes me that very often people operated in the grey until someone told them they couldn’t. And I think that is a fair characterisation. I’ve talked to staff about this issue. The truth of the matter is if it’s white, fine, if it’s black, fine, and, frankly, if it’s grey, unless you get it ticked that it’s white, you don’t do it.⁹⁹

58. Third, Ms Halton gave evidence of a lack of psychological safety of staff. For example, regarding the China arrests, she agreed that staff were not comfortable and did not feel as though they could speak up.¹⁰⁰
59. This has been and remains an ongoing issue. In 2018, Crown commissioned an employee experience survey. The responses suggested psychological safety of employees was a significant issue.¹⁰¹ Notwithstanding the survey results, there is no evidence the issue was ever discussed at board level.¹⁰²

Poor culture causing poor conduct

60. This Commission has uncovered other recent failings by Crown that strongly suggest that the same cultural problems remain.
61. First, there is the issue of Crown Melbourne’s improper deductions in the calculation of casino tax, particularly the Bonus Jackpot deductions. Crown Melbourne’s treatment of the Bonus Jackpot deductions speaks to the same culture of profit over compliance.
62. Ms Halton conceded that Crown Melbourne’s practice with respect to the Bonus Jackpot deductions has ‘all the hallmarks’ of the same ‘grey area’ way of operating.¹⁰³ Mr Xavier Walsh, former CEO of Crown Melbourne, made the same point about the failure by anyone at Crown Melbourne to raise the issue with the regulator and ‘come clean’.¹⁰⁴ The problem is that Mr Walsh’s inability to ‘come clean’ suggests that he, too, did not feel safe to speak up.
63. Second, there is the CUP issue. This practice reflects the same tendency of Crown Melbourne to operate ‘in the grey’. The CUP process involved practices that allowed wealthy patrons to defeat Chinese currency regulations as well as open the door to money laundering.¹⁰⁵
64. A Crown Melbourne employee raised this practice at a March 2021 training session. He told those present that the practice involved money laundering. He said that ‘hosting staff were given instructions from “higher ups” to identify, implement or create new methods of circumventing government laws’.¹⁰⁶ Despite the serious nature of the allegations raised at this meeting, only one of the 14 employees present reported the discussion.¹⁰⁷
65. Their silence also suggests that issues of psychological safety around reporting of wrongdoing remain. Mr Steven Blackburn, Chief Compliance and Financial Crime Officer, agreed that the individuals attending the meeting may have been scared to report the matters raised.¹⁰⁸ Another possibility accepted by Mr Blackburn was that the employees were concerned their career progression would be negatively affected if they did escalate the matter.¹⁰⁹
66. It is noted that the Crown directors relatively promptly notified the Commission of the allegations made in the training session, and disclosed the results of the legal investigation subsequently undertaken.
67. Third, Crown Melbourne’s relationship and dealings with the regulator suggest its cultural problems persist.
68. Many witnesses frankly acknowledged the problematic state of the relationship between Crown Melbourne and the regulator. Mr Blackburn described Crown Melbourne as taking a ‘fairly aggressive’ approach to the relationship.¹¹⁰ Ms Korsanos described Crown Melbourne’s culture in relation to the regulator as ‘defensive’.¹¹¹ Mr Nigel Morrison, director of Crown Resorts, said Crown Melbourne did not have an open and honest relationship with the regulator and described Crown Melbourne’s attitude as one where ‘if they didn’t think it was overly important and they could get away with it, they did’.¹¹²
69. Crown Melbourne’s aggressive attitude to the regulator is encapsulated in a most concerning exchange, in 2019, between the regulator and Ms Michelle Fielding, then Group Executive General Manager, Regulatory and Compliance. The exchange concerned Recommendation 17 in the Report of the VCGLR’s Sixth Review and a dispute with the VCGLR as to whether Crown Melbourne should seek input from AUSTRAC in reviewing its internal control statements.¹¹³ Ms Fielding, in rejecting the suggestion Crown Melbourne should seek AUSTRAC’s input, called Mr Jason Cremona, an employee of the VCGLR, and spoke to him in an aggressive manner, saying that Mr Joshua Preston, Crown’s then Chief Legal Officer, was ‘furious’ at the suggestion and would most probably ‘call the Minister’.¹¹⁴
70. Another example is Crown Melbourne’s lack of cooperation with the VCGLR investigation concerning the China arrests. Ms Coonan gave the following evidence on that issue:

    Q: It’s the old Crown taking every point, arguing every issue, not accepting basic propositions of fact that are clearly open; correct?

    A: I think that’s right. I mean, I hadn’t had a chance to refresh my memory of it, but I think that would be a fair way to characterise it.

    Q: And that’s only January this year, isn’t it?

    A: Yes, it is. It’s the old Crown, January this year.¹¹⁵

71. While the current directors and executives all agree that Crown Melbourne’s relationship with the regulator should be open, honest and cooperative, until recently nothing has been done to address this issue.

Deloitte review

72. Now that Crown has been forced to act, it has engaged Deloitte, led by organisational culture expert Ms Victoria Whitaker, to undertake a review of Crown’s culture.¹¹⁶ Ms Whitaker described the purpose of the Deloitte review (named Project Darwin) as being:

    to provide an assessment of the maturity of the existing approach to organisational culture, conduct a current state of Crown Resorts’ organisational culture (including risk culture), establish the target state culture, assess the gaps between the target state and current state organisational culture, and prepare a roadmap on how to close the gaps.¹¹⁷

73. The Deloitte review is being undertaken in four phases. Phase 1 is a desktop review and consultations to assess the company’s culture framework. Phase 2 involves the development and rollout of an organisation wide culture survey. Phase 3 involves detailed analysis and assessment of the data to support Phase 4. Phase 4 will focus on the development of a road map for change.¹¹⁸
74. At the time Ms Whitaker gave evidence to the Commission, Deloitte had substantially completed Phase 1. On 30 July 2021, Deloitte provided a report on the outcomes of Phases 2 and 3 of the program, which is Deloitte’s assessment of the current state of Crown’s organisational culture.¹¹⁹ Through Deloitte’s work, the Commission has a recent snapshot of Crown’s corporate culture.
75. Relevantly, in late 2020 and early 2021, Ms Whitaker conducted preliminary interviews with Mr Ken Barton (at the time CEO of Crown Resorts) and Ms Alicia Gleeson (Executive General Manager of Human Resources at Crown Melbourne) to gain insight into Crown’s culture.¹²⁰ The Commission has the records of the interviews.
76. There were similarities between the observations of Ms Gleeson and Mr Barton.¹²¹ According to Ms Whitaker, the comments of Ms Gleeson and Mr Barton painted a ‘pretty grim’ picture of the culture at Crown:

    Q: So to summarise, Ms Whitaker, in combination of the interview that you had with Mr Barton and Ms Gleeson, what was conveyed to you were perceptions from those individuals about Crown’s culture and the sorts of things that were conveyed as the perceptions were, just using some headings ‘psychological safety’; correct?

    A: Correct.

    Q: The Board not necessarily listening and providing feedback?

    A: I think it is more the feedback piece was what was conveyed, yes.

    Q: The Board not providing feedback. Permafrost in middle management?

    A: Potentially, yes, that was a perception.

    Q: People not being held to account?

    A: Yes.

    Q: Lack of clarity in escalating issues?

    A: Yes.

    Q: And problems not being investigated or being solved by people instead of being escalated?

    A: I think it was that people were trying to deal with the problems themselves without escalating, yes.

    Q: But there was also the issue about ‘If nothing happens I won’t report it’?

    A: A sense of complacency, yes.

    Q: … But all of those comments, I suggest to you, paint a pretty grim picture of how Crown’s culture is perceived by senior individuals within the organisation; would you agree with that?

    A: What you’ve just listed does paint a pretty grim picture, yes.¹²²

77. Some of the problems identified by Ms Gleeson and Mr Barton are not new.
78. Deloitte’s Phases 2 and 3 report contains an even more recent assessment of the current state of Crown’s culture.¹²³ Data collection was undertaken between March and July 2021, including an ‘all staff survey’; interviews with the board, executive leadership and external stakeholders; and focus groups with a cross-section of employees across Melbourne, Perth and Sydney.¹²⁴
79. The following is Deloitte’s summary of its findings:

    Whilst there is an awareness of the importance of compliance, it is not yet driving consistent behaviour. Staff perceive ongoing conflicts between appeasing customers, driving profit and adhering to policies and processes. Policies and processes were seen to be poor in places, due to being overly complex, poorly written or lacking applicability. Despite high levels of completion of mandatory training, staff did not always know where to access policies to do their job.

    …

    Less than half of Crown’s people perceived the Board to be living Crown’s values, with particularly low sentiment from mid-level managers. Just over half perceive their senior leaders living the values. The main stated reasons were related to the royal commissions and adverse media reporting. These views have influenced employees’ perceptions of Crown’s trustworthiness and whether it has the customer’s best interests at heart.

    …

    Crown has a hierarchical structure and managers are the first point of contact for staff raising concerns. Nearly half of the respondents did not hold a positive perception of the relationship they have with their manager. This is driven by perceptions of inconsistent reward and performance management and a perceived lack of coaching and feedback, which results in low confidence in to [sic] speak up and challenge others.

    …

    The majority of staff perceive the people they work with to be supportive, friendly and honest. These relationships influence inclusion and sharing lessons learnt. At times, there were perceptions that peers do not respond well to constructive challenge.¹²⁵

80. In relation to Crown Melbourne’s current values and behaviours, Deloitte’s findings were:

    We do the right thing

    The Crown Culture Review found weak support for the value of ‘we do the right thing’ being lived in the organisation. Despite strong awareness of compliance, barriers that enable compliance behaviours [sic] still exist.

    A majority of staff believe it is necessary to bend the rules and work around policies and procedures to get their job done, driven by a perception of customer centricity and a profit mandate.

    Some believed policy frameworks were weak and difficult to implement. While around half were not confident to provide constructive challenge, driven by fear of consequences and being punished, or complacency that no action would be taken.

    Personal relationships with managers were key to this sentiment, with some managers perceived to misuse their authority, being dismissive or demanding.

    …

    We work together

    The Crown Culture Review found mixed support for the value of ‘we work together’ being lived in the organisation. While there is high collaboration and team work within business units, silos exist across business units and properties, driven by poor communication, combined with a lack of shared objectives, as well as underlying structural and systems based deficiencies. Perceptions of inconsistent performance management and reward also contributed to this sentiment.

    …

    We act respectfully

    The Crown Culture Review found some support for the value of ‘we act respectfully’ being lived in the organisation.

    Just over half trusted Crown, largely driven by low perceptions that the Board and Executive were living Crown’s values. One in three did not agree that Crown had the customer’s best interests at heart.

    The majority of people had a positive experience at Crown, felt respected at work and are committed to the purpose and values of Crown. Diversity was celebrated, but feelings of inclusion were lower, typically driven by manager/employee relationships.

    …

    We are passionate

    The Crown Culture Review found some support for the value ‘we are passionate’ being lived in the organisation.

    Crown’s people are committed to Crown’s success, but low motivation stems from regulatory scrutiny, lack of empowerment, poor career path management and a low appetite for innovation.

    A mindset of ‘this is the way we’ve always done things’ is perceived to be stifling innovation, and many do not feel empowered to make decisions.¹²⁶

81. Given the interest of this Commission in Crown Melbourne’s culture of compliance, the following finding by Deloitte is most concerning:

    Barriers exist preventing an effective risk culture

    Whilst awareness of the importance of compliance appears to be strong, it is not yet driving consistent behaviour or an effective risk culture. There is a need to remove the barriers to constructive challenge across the business. Staff don’t always feel empowered or involved in the decisions that affect them. There are also low levels of agreement that unacceptable risk taking is consistently penalised. There is a need for improvements in communication and role modelling, including sharing mistakes and lessons learned. Furthermore, some leaders recognised the lack of ‘outside in’ thinking. While risk literacy is emerging, it needs to be further strengthened especially across Line One in the organisation.¹²⁷

82. It is clear that many cultural problems still exist. It is equally clear that many of them may be difficult to overcome.

Cultural reform plan

83. Crown accepts the need to improve its culture. Many Crown witnesses frankly conceded that reform is necessary and emphasised Crown’s commitment to its culture reform program.¹²⁸
84. Crown’s concessions on the need for cultural change may be contrasted with Crown’s submissions before the Bergin Inquiry. There, Crown rejected as ‘incorrect at several levels’ the accusation that it had a ‘dysfunctional’ culture that included an ‘arrogant indifference to regulatory and compliance risk’, a ‘culture of denial and unwillingness to examine and address past failings’ and ‘a culture which prioritised the pursuit of profit above all else’.¹²⁹ The change of attitude is overdue, but welcome.
85. In her statement, Ms Coonan describes the ‘cultural uplift program’ as a ‘key component’ of Crown’s wider reform program.¹³⁰ Crown’s cultural reform plan is under the direction of Mr Stephen McCann, the CEO of Crown Melbourne and Crown Resorts, and Mr Tony Weston, Chief People and Culture Officer (who commenced on 7 June 2021). It is to be assisted by the review currently being conducted by Deloitte.¹³¹
86. The remediation plan Crown has provided to regulators post the Bergin Inquiry provides a useful summary of steps Crown is taking to alter its culture.¹³² It has already taken the following steps, among others:
    • In July 2020, it rolled out its new values, which include: (a) we do the right thing; (b) we act respectfully; (c) we are passionate; and (d) we work together.¹³³ These values have been incorporated into relevant policies and documents, including the Code of Conduct, and Risk and Compliance Culture Framework.¹³⁴
    • In December 2020, it implemented an overarching culture reform program (also referred to as the ‘cultural uplift program’).¹³⁵
    • It commissioned the culture review by Deloitte.¹³⁶
    • It made changes to short-term incentives for key management personnel such as partial deferral and forfeiture in the event of adverse regulatory or compliance events; and introduced compliance and risk key performance objectives for salaried staff. Crown has also engaged an external expert to review and provide recommendations in relation to its remuneration framework.¹³⁷
    • It appointed a Chief People and Culture Officer (Mr Weston) as well as Mr Weeks, to facilitate cultural change. Mr Weeks is on a 12-month contract; however, Mr Weston’s engagement does not appear to be similarly limited.¹³⁸
    • It changed the ‘tone from the top’ approach by refreshing its board and management team.¹³⁹
87. In relation to the focus at Crown on changing the ‘tone from the top’:
    • Ms Halton said that ‘informal soundings’ taken by herself and other members of the current board showed that ‘people detect very clearly the change in tone from the top’.¹⁴⁰
    • Ms Korsanos said that there was a need to break down Crown’s ‘defensive’ culture but she believed ‘we’ve had more traction post the leadership changes … both at board level and executive level’ and that had been driven by changes at the board and management levels.¹⁴¹ Ms Korsanos emphasised the engagement by the Crown Resorts board and Crown Melbourne board in the reform agenda.¹⁴² Her evidence was that ‘[a]ny change in culture must be driven by leadership. The new board and executive leadership team will be critical to this change’.¹⁴³
    • Mr McCann said he told staff to speak up if they see behaviour that is inappropriate and to not do anything that they feel uncomfortable doing or that is ‘inconsistent with their values’.¹⁴⁴
    • Mr Weston underscored that Crown’s leadership is ‘very invested’ in the culture change program and that the Crown Resorts board has prioritised the culture change program as part of Crown’s broader reform program.¹⁴⁵ He said that although the Deloitte assessment is ongoing, the Crown Resorts board and senior management throughout Crown are already looking for ways to improve culture. Mr Weston noted as an example that the Chairman has been encouraging staff through weekly communications to speak up ‘when something does not feel right’.¹⁴⁶

Can Crown change its culture?

88. It is positive that Crown has acknowledged problems with its culture, including ‘the magnitude of its governance and cultural failings’,¹⁴⁷ and is making attempts to change.
89. The importance of reforming its culture is acknowledged by Crown’s own Risk and Compliance Culture Framework.¹⁴⁸ The Framework records that risk and compliance culture—the system of values, beliefs and behaviours in an organisation—‘shapes the decisions and actions of employees in relation to compliance and risk taking’ (emphasis added).¹⁴⁹ Without meaningful cultural reform, there can be no remediation of the failures identified by this Commission and the Bergin Inquiry. Without cultural reform, changes to risk management frameworks will achieve little, because the choices and behaviour of employees and management at Crown, including at Crown Melbourne, will not change. This is in the context of the ‘extraordinary level of inherent risk’ in the casino sector.¹⁵⁰
90. Crown faces substantial challenges in effecting cultural reform and will need to overcome a number of barriers that currently exist. While the timeframe to embed self-sustained cultural change is difficult to estimate, the experts agree it might take years.
91. Ms Elizabeth Arzadon, an expert on corporate culture and its influence on conduct and risk outcomes, was retained by the Commission to prepare a report outlining her opinion about Crown Melbourne’s relationship with the regulator, how Crown’s culture could be changed, and how long it would take to effect that change.¹⁵¹
92. First, in considering Crown Melbourne’s relationship with the regulator, Ms Arzadon observed that the VCGLR employs a ‘risk based’ model. That model places substantial reliance on the integrity of internal control processes within supervised entities, preserving limited regulatory resources to examine issues of highest risk.¹⁵² Risk based regulators ‘rely heavily on a culture of transparency, responsiveness and collaboration with supervised institutions’.¹⁵³ Crown Melbourne has indicated its intention to improve its relationship with the regulator.¹⁵⁴ Ms Arzadon notes, however, that improvement will be ‘very difficult to achieve, requiring considerable energy, time and resources on both sides’.¹⁵⁵ To improve its relationship with the regulator, Crown Melbourne must find a joint purpose with the regulator and incentives to change.¹⁵⁶
93. Second, and more broadly, Ms Arzadon explained that it is not simple to change organisational culture. Crown’s culture is the product of a system of influences both within and outside its organisational ‘walls’. If Crown’s culture is to change, all these systemic influences must be considered.¹⁵⁷ Crown, like most organisations undertaking cultural transformation, will be attempting to ‘juggle the necessary activities alongside other critical business objectives required to sustain its survival’.¹⁵⁸ The most earnest attempts to enact culture change can trigger unexpected and problematic side effects.¹⁵⁹
94. Moreover, achieving behavioural change is not easy. As Ms Arzadon points out:

    Anyone who has tried to change their own eating or exercise habits knows that behavioural change is difficult. Leading an entire organisation through the behaviour change required for cultural transformation is exponentially more difficult. Success is far more likely when there is investment in appropriate guidance, objective analysis, empirically-based techniques and leadership coaching, at a level commensurate to the task.¹⁶⁰

95. In that regard, Ms Arzadon expressed concern that neither Mr Weeks nor Mr Weston are experts in cultural reform.¹⁶¹ She did accept that Ms Whitaker is an appropriate expert.¹⁶²
96. Third, assuming it is possible, cultural change takes time. While some changes can be achieved quickly, Ms Arzadon suggests that embedding sustained cultural change can take between three to five years.¹⁶³ Even if Crown achieves a swift turnaround in its culture, it may sometimes revert to its former position. Ms Arzadon put it this way:

    … [s]ay [in] about three or five years, the conditions will change, and this is what happens often with organisations that are placed into mandated culture change, that later on down the road when things go back to normal, then the usual pattern, which is that revenue generation is rewarded and compliance is less naturally rewarded, that’s when you have prioritisation of revenue over compliance and conduct.¹⁶⁴

97. Ms Arzadon also commented that Deloitte’s Phase 4 work is the kind of work that is really the beginning of a culture change program. Deloitte’s Phase 4 work involves defining the aspirational state and developing the road map for change, and establishing the frameworks that will support that change.¹⁶⁵ The activities that will constitute the road map for change will not be worked out until Deloitte’s Phase 4 work is complete.
98. Other witnesses, including Crown witnesses, agreed with Ms Arzadon that achieving cultural change will take some time. Mr McCann, speaking from his experience in leading a large cultural change project at Lendlease (a property development, construction and investment business), said that the change took two years.¹⁶⁶ Mr Weeks said that an organisation can achieve cultural change quickly, but acknowledged change takes time to embed.¹⁶⁷
99. Ms Whitaker also said that it can take years to effect sustained cultural change, and that it can be complex to measure:

    Q: All right. I just wanted to get an understanding of the time frame for the work that Deloitte is doing, but … That … the work that Deloitte is doing is effectively providing a roadmap. Once that roadmap is in place, and you have satisfied that you’ve got all the tools to effect the change that you want, is it not the case that it can take years for cultural change to occur, and years to know whether or not it’s worked?

    A: It can take years for sustained culture change to occur. I think we will start to see early indications of change. It also requires multiple measurements in order to know that that change has been affected long-term. So that is part of the reason that is given to why culture change takes a long time.¹⁶⁸

100. Fourth, while Crown points to changes ‘at the top’ (at board and executive level), those changes will not necessarily solve the serious cultural problems that exist.
101. Ms Arzadon explained that although she had seen a lot of evidence of Crown telling staff: ‘[Y]ou should speak up’, that was not the same as ‘trying to understand why they might not speak up’.¹⁶⁹ This is because:

     even if leaders display a genuine desire for change and begin to shift their personal mindsets and behaviour, there are many reasons why broader organisational change may be resisted, especially at middle and lower levels where tangible change is often critical.¹⁷⁰

102. Ms Whitaker agreed that changing the tone from the top was insufficient:

     Q: [I want you to assume a series of propositions.] Just assume them to be true, they may or may not be true, but assume you have a firm who is engaged in the following types of conduct. Systematic, long-term breaches of the law, both statute law and other legal obligations—second. Systematically and over a period of time facilitated illegal conduct by third parties. Four, in dealings with government, lax [sic] candour, doesn’t make full disclosure. Five, deals with lots of vulnerable people and takes advantage of them. And each of those types of conduct is explicable by a profit motive; that is, if I engage in all of those things, I will make more money than I otherwise would. My question to you is: what would that tell you about the culture of the firm?

     A: What would it tell me about the culture of the firm. I think it would give rise to a number of questions in relation to the culture that I would ask, such as, what is the tone being set by the leaders, what processes do they have in place to manage risk and conduct. What attitudes do they have to those that they impact upon, what processes are in place to draw out mistakes or poor conduct, like speak-up processes.

     …

     Q: [Go back to my question, and assume this is a long-term behaviour] … 5 years, 10 years, 15 years, pick whatever meaning you like to the word ‘long-term’, what does it tell you about the culture of the firm?

     A: I think it would tell me that, given those hypothetical situations you gave me, that it is an organisation that is driven towards a self-orientation of … looking after oneself.

     …

     Q: [And if I had a scale for measuring culture] … and it was from one to ten, ten being the best and one being the worst, good, now you know my question, don’t you?

     A: Yes, where …

     Q: If you make the assumptions I’ve asked you to make, where on the scale would you put the firm?

     A: Commissioner, can I clarify, what I think you are getting at, which is to what extent is it [an] ethical culture, a responsible culture, those sorts of aspects, is that what you are asking, because I need a goal in mind?

     Q: Yes, that’s exactly what I’m after.

     A: I would say that it is sitting on the end of looking after oneself and being oriented towards 1, that is the lower end of that scale.

     …

     Q: Assume the behaviours I’ve described are endemic throughout the organisation: top, middle management, lower management, floor staff. In other words, it is cemented into the operation of the firm itself, that’s how most people who relevantly can engage in this conduct … that’s a bad way of putting it. It is across the board in the firm. Make that assumption. Would you accept this proposition that simply changing the top will get you nowhere?

     A: I agree that simply changing the top will only get you part of the way. There are other activities that would drive that change that you are looking for.¹⁷¹

103. Fifth and finally, Ms Arzadon critically identified that Crown requires a purpose-driven culture rather than a compliance culture.¹⁷² That is, Crown needs to engage in ‘new thinking about [its] purpose, strategy, operations and financial model, and solutions that can somehow deliver financial results within a frame of good conduct—not simply without breaking the law’.¹⁷³ In Ms Arzadon’s view, Crown must ‘bring together the purpose of compliance and conduct with revenue generation’.¹⁷⁴ Ms Arzadon made a similar observation in the context of discussing the need for Crown Melbourne to have an aligned purpose with the regulator if it is to achieve genuine change in the relationship.¹⁷⁵
104. The problems that can arise when the purpose of compliance conflicts with revenue generation were explored at length through the Bergin Inquiry and also during the Commission hearings. The Bonus Jackpots tax issue is one example (see Chapter 12). The CUP issue is another (see Chapter 13).
105. Ms Arzadon was unable to identify any evidence to suggest that Crown is taking or contemplating taking the step of aligning the purpose of compliance and conduct with revenue generation; she had only seen reinforcement of the need to be compliant.¹⁷⁶
106. This is something that Crown must urgently and closely consider, along with the question why staff have a fear of speaking up.

Conclusions

107. Crown appreciates that Deloitte’s Phases 2 and 3 report confirms that significant work is required for it to ‘embed the sustainable cultural change to which it aspires’.¹⁷⁷
108. Deloitte’s Phase 4 work will involve defining Crown’s aspirational culture and developing the road map for change, along with the governance, measurement and reporting frameworks that will support that change.¹⁷⁸ Deloitte’s Phase 4 work has not been completed. Accordingly, the road map and specific activities to achieve Crown’s desired culture state have not yet been identified.
109. Other activities Crown expects to undertake to achieve cultural reform include:
     • reviewing and refining its strategic intent
     • engaging with key stakeholders, including the regulator
     • developing and implementing a measurement process
     • audit and information sharing.¹⁷⁹
110. There is no evidence concerning the timeframe for achieving these steps.
111. The Commission has two concerns. The first is that in order to change, Crown must review its strategic intent to align the purpose of compliance and conduct with revenue generation. There is no evidence this has occurred.
112. The second is that Crown might revert to its ‘old ways’ once the glare of the public inquiries becomes part of history. That indicates that Crown’s cultural reform program will need to be closely monitored, potentially for years to come.
113. Nonetheless, it is acknowledged that the culture of an organisation can change for the better. How long that will take, and how successful it will be, are unknowns.