A familiar dilemma
A services business adds features to win customers, prices them to stay competitive, plans capacity within budgetary appetite, and relies on operational capability built for a simpler offering. Each decision has a rationale, yet together they leave too little capability to do the work properly. People close the gap through behaviour: workarounds, data manipulation, issues and alerts cleared too quickly, and due diligence cut short when service or revenue pressures collide. The resulting breaches are often systemic.
Remediation then targets the behaviour, while the decisions and conditions that sustain it remain in force. This is how problems survive remediation.
The same pattern appears in recent reviews of Bendigo and Adelaide Bank, Westpac and KPMG Australia, and in the ANZ findings we wrote about in 2025. Each had remediated before, so the recurrence raises questions about whether remediation reached the underlying causes and whether the changes held.
Culture and the organisational system
To see what remediation leaves untouched, it helps to think of an organisation as a system. Oversight, strategy, structure, priorities, targets, resources, processes, controls and incentives work together to produce outcomes, and most of the time people behave as the organisational system expects. When behaviour it was never meant to produce repeats or spreads, it is rarely just a people problem. It tells you something about what the system rewards, tolerates, can't see or fails to address.
This is how culture forms. Culture is how work gets done, and people take their cues from how the organisation is run. What do leaders prioritise, and what are people held accountable for? Do they have the skills, time and tools to do the work properly? Who is promoted, rewarded and sanctioned? The answers tell people what really matters, so culture is learned from how the organisation operates, and remediation that does not change the organisational system tends to produce the same findings again.
Schein's model places both behaviour and the formal systems people work within at the most visible level of culture, yet many programs concentrate on behaviour and leave the formal systems and their settings untouched. This is where the problems we see across industries often sit: accountability without end-to-end control, breakdowns at hand-offs between teams, risk practices overlaid on low operational maturity, and misaligned goals across different organisational accountabilities.
Where pressure mounts: strategy vs. organisational capability
These design weaknesses matter most when the organisational load rises, and strategy sets that load. When the market tightens and strategic targets, pricing and capacity are not realigned, pressure moves down into practice.
Westpac's small business lending illustrates it. The Australian Financial Review reports that APRA was concerned a race to win small business lending could weaken standards, and that an internal audit in April found breaches of credit approval limits, months after APRA lifted a $500 million capital add-on for risk-related concerns. The question is whether credit controls, capacity and oversight have grown with lending volumes.
If strategy and the organisational system do not adapt together, the culture can close the gap through assumptions, workarounds and creeping lines of acceptable conduct that, over time, become normalised.
How pressure becomes breach: decisions that do not fit together
Pressure lands on many decisions at once, and risk, compliance and conduct failures often come not from one bad decision, but from several that seem reasonable on their own but do not support each other. Decisions on features, pricing, capacity and delivery capability sit with different people, though some people cover more than one. Each decision is made on its own assumptions, and the results roll up to an accountable executive who may not see the trade-offs made along the way.
Each decision serves its own goal: win the business, stay competitive, keep the cost lean, keep people busy. This is sub-optimisation: local goals are met without enough coordination of the overall outcome. When the combination leaves too little capability, the options that keep the problem visible are to escalate, record the shortfall or accept the loss, and each carries a personal cost to the people who choose it. Because profitability or enduring client relationships matter most, internal processes and controls are sacrificed first.
In KPMG Australia's recent ethics review, commissioned after a whistleblower matter, participants described this pattern, which any services business that prices to win and staffs to a target can create: proposals priced below the work needed to deliver them, and staff feeling pressure not to record all the hours they worked. Yet reviews tend to record the choices people make rather than the decisions that set the conditions for them, so remediation focuses on individual choices and behaviour.
The overlay reflex
When something goes wrong, organisations reach for more controls: the overlay reflex. Overlays are quick, protective and easy to audit, but they leave the commercial engine and senior decision-making untouched, which is often where the root cause lies. KPMG shows the reflex at work. After a 2021 sanction for exam cheating, the firm built a comprehensive ethics program. Its latest ethics review describes a paradox: real investment in ethics, and failure. The program competed with the business for time and reward, and the business won. The review's recommendations lean again on whistleblowing and consequences, which act after the decision rather than shaping it, though KPMG's updated action plan proposes structural reform.
The overlay reflex
When something goes wrong, organisations reach for more controls: the overlay reflex. Overlays are quick, protective and easy to audit, but they leave the commercial engine and senior decision-making untouched, which is often where the root cause lies.
KPMG shows the reflex at work. After a 2021 sanction for exam cheating, the firm built a comprehensive ethics program. Its latest ethics review describes a paradox: real investment in ethics, and failure. The program competed with the business for time and reward, and the business won. The review's recommendations lean again on whistleblowing and consequences, which act after the decision rather than shaping it, though KPMG's updated action plan proposes structural reform.
Breaking the cycle: root cause before remedy
The way out is to understand the cause before designing the fix. Containing harm should not wait for a completed causal analysis, but lasting remedies should. Bendigo and Adelaide Bank shows the cost of the reverse: it spent several years on risk transformation before APRA required an independent root cause analysis, which found key weaknesses had persisted. ANZ's April 2025 undertaking, which followed earlier remediation, required a Group-wide review of root causes and behavioural drivers before another remediation plan. Boards should require root cause analysis before approving lasting remedies, not after those remedies fail.
Internal audit's new standard points the same way. The IIA's Organizational Behavior Topical Requirement, effective from December 2026, and its user guide ask auditors to separate behaviour from its drivers and test whether remediation worked. The risk lies in application: a label such as 'ineffective tone at the top' can end the inquiry without explaining what keeps the condition in place.
Our working definition sets a higher bar. A root cause is the deepest actionable organisational, system, process, design or recurring individual factor that creates or perpetuates the observed behaviour or outcome. It is distinct from symptoms and isolated actions, and it is something management can reasonably change to prevent recurrence or reduce multiple downstream issues. Anything short of that is a finding, not a cause.
Three questions for the board
- For our most material products and services, who owns the outcome end to end, who can see how decisions by different teams combine, and who has agency to resolve conflicts between them?
- For each remediation action we approve, which root cause does it address, and what evidence will show it is working beyond the action being closed?
- Are our targets, pricing and capacity creating recurring pressure, and do we trace breaches and exceptions back to those decisions?
Fix the organisational system
Culture will not change while the organisation is built to deliver something else. Evidence of progress lies in changed decisions and choices, even under pressure: what the organisation funds, what it declines, what it stops, and what its leaders are prepared to change. Seeing that evidence starts with how culture is reviewed. Reviews must examine the formal systems behind behaviour, not only the behaviour itself. Anything less, and we will be reading the same findings again.
Our companion article, When compliance is balanced: the board's blind spot, focuses on the governing layer that determines how the organisational system operates, including under pressure