Governance and management systems

Effective governance is of vital importance for NAB. It is a fundamental part of our culture, policies and business practices and is undertaken with due regard to our stakeholders and our role in the community.

It is clear from recent experience, both our own and that of the wider business community, that good governance in both financial and non-financial areas is integral to managing a successful corporation and to ensuring its good reputation. This is also reflected by the growing interest of civil society, regulators and the investment community in our non-financial performance.

This section outlines our integrated approach to governance in general, including corporate governance, risk management, and key policies, management systems and business practices related to CSR. The ‘Progress on our promises’ highlighted below provides an update on our performance against the promises we made in our 2004 CSR Report in relation to our governance processes and management systems.

This year we completed our Board renewal program. A total of eight new directors have been appointed to the Board since September 2004. At the end of the financial year on 30 September 2005, the Board consisted of 13 directors (see photographs opposite), 10 of whom are independent non-executive directors, including the Chairman, Michael Chaney, who took over from Graham Kraehe on 28 September 2005. The three executive directors include the Managing Director and Group Chief Executive – John Stewart, the Director, Finance & Risk – Michael Ullmer, and the Chief Executive Officer, Australia – Ahmed Fahour. Our Board directors have a broad range of expertise, skills and experience from a diverse range of backgrounds (refer to our 2005 Annual Financial Reporton our Group website ). On 1 December 2005, Patricia Cross and Kerry McDonald took up their appointments on the Board, taking the total number of directors to 14.

The fundamental premise of the standards is that an independent director must be independent of management and free to exercise his or her unfettered and independent judgement. Directors are required to provide all relevant information to allow a regular assessment of independence. More detailed information on our standards and definition of independenceis available on our Group website .

• consider the interests of all stakeholders
• approve and monitor corporate strategy
• review business results, monitor budgetary control and necessary corrective actions and processes
• establish and monitor the risk management processes and compliance with prudential regulations and standards and other regulatory requirements
• approve key executive appointments and monitor executive succession planning
• monitor the performance of the Managing Director and Group Chief Executive and senior management
• approve executive remuneration
• monitor and influence the culture, reputation and ethical standards of the Group
• monitor Board composition, director selection, Board processes and performance.

Full details of the responsibilities of our Board are available in our 2005 Annual Financial Reporton our Group website .

The Board provides the highest level of governance and oversight for our CSR strategy.

• Risk Committee
• Audit Committee
• Nomination Committee
• Remuneration Committee.

This year, a number of the directors actively participated in a review of the Group’s corporate community investment strategy.

Over the past 12 months, the regional and Group Executive committees have considered CSR issues such as our corporate community investment strategy and the development of our customer charters. This change in structure will facilitate the ongoing evolution of the Group’s CSR strategy and the implementation of CSR policies and related programs.

The Corporate Centre and each regional business have personnel specifically dedicated to coordinating and facilitating engagement on CSR issues. We also establish Group-wide internal Technical Advisory Committees (TACs) on an ad hoc basis to support the development, implementation and review of specific CSR issues. The TACs consist of representatives from across the business, as relevant and appropriate to the CSR issue under consideration.

This year we had four operational TACs. One to conduct a review of our corporate community investment, another to assist in the development of Customer Chartersacross the Group and the third to develop our Commitment to Fair International Workforce Standards Policy.

In 2005, the new Group Operational Risk and Compliance Committee (GORCC) was given responsibility for oversight and review of CSR frameworks and policies. Matters raised by the GORCC in regard to CSR-related risk issues may in turn be brought to the attention of the Group Risk Management Committee and the Board Risk Committee, (refer to Figure 3).

Our Corporate Principles, Compliance Standards and Code of Conductare available on our Group website .

To facilitate this, NAB has had a Whistleblower Protection Program in place since 2003. This program incorporates a Confidential Alert Line for employees to raise concerns regarding undesirable business conduct. In addition, a protocol has been established whereby matters can be brought to the attention of the Board Audit Committee and, if the circumstances warrant, to the attention of the full Board. In the past year, following a review of our Whistleblower Program, we have:

• further educated senior management in regard to whistleblower concepts and implementation
• held workshops for our people leaders
• initiated a staff awareness campaign
• improved guidelines, training and reporting.

We also received assurance that our program complies with the Australian Standard AS 8004:2003 Whistleblower Protection Programs for Entities.

Our Board and Group Executive Committee have approved a wide range of policies that guide our day-to-day business processes, practices and behaviours. Some of these policies specifically address key aspects of our approach to the economic, social and environmental dimensions of CSR. The breadth of these policies is illustrated in Table 2. This list is not exhaustive but highlights some key CSR-related policies.

Our policies are reviewed, as appropriate, to consider best practice, emerging issues and the changing regulatory environment. In 2005, we reviewed our environmental policy, developed and published a new policy on Fair International Workforce Standards and commenced a review of our environmental procurement policy to incorporate considerations of our Commitment to Fair International Workforce Standards.

NAB’s approach to risk management is based on an overriding principle that risk management capability must be embedded within front-line teams to be effective. This overriding principle embodies the following concepts:

• all business decisions include the consideration of risk
• business managers use our risk management framework to appropriately balance both risk and reward
• all employees are responsible for risk management in their day-to-day activities
• risk management is a core competency area for all employees.

The Group manages risk within a ‘three lines of defence’ framework. Control is exercised through clearly defined delegations of authority and clear communication channels. The first line of defence comprises the business units managing risks associated with their activities. The second line is our Group and regional risk functions, which are accountable for independent monitoring and oversight. The third line of defence is Internal Audit, which independently reviews, monitors and tests compliance with risk policies and procedures and regularly assesses the overall effectiveness of our risk management framework.

Consistent with our move to a regional model, we completed a review of our Risk Governance Framework and risk management function in January 2005. The new Risk Governance Framework is designed to identify, examine and escalate problem areas so appropriate action can be taken in a timely manner. Our risk management function is structured to align risk management with the new regional structure. This has provided clear accountabilities at both a regional and Group-level and improved risk management within the Group through benchmarking against best practice. The revised framework was approved by the Board in April 2005.

There are now four regional risk management teams: Australia, the UK, New Zealand, and IMS (managed on a global basis). Regional teams independently monitor and assess their business risk profiles against established risk appetite parameters. They also assist the ‘front line’ businesses in the design and implementation of appropriate risk management policies and strategies, and work with the businesses to promote awareness of risk management practices. Together with the Group risk management function, they are working to embed our Corporate Principles and behavioursinto organisational culture.

During the year, significant changes in key risk positions have occurred, with new risk professionals recruited to fill many positions. Our new risk leadership team has brought significant global perspective to the design of the revised Risk Management Framework and effective management of risk throughout the Group.

As part of the review of the risk management function, a new Group Risk Management Committee has been created. This Committee is composed of key senior executives, including the Managing Director and Group Chief Executive, the Director – Finance and Risk and Group Chief Financial Officer, the Group Chief Risk Officer, each of the regional Chief Executive Officers, and the Executive General Manager, IMS. It serves as the principal risk strategy and policy decision-making body within the Group.

This committee is supported by the following four sub-committees, each with a specialised focus:

• Group Credit Risk Committee
• Group Market Risk Committee
• Group Operational Risk and Compliance Committee
• Group Asset and Liability Committee.

The Group risk management function supports the regions, executive management, and the Board through the creation of Group-wide risk principles and policies, and provides aggregated reporting of risk issues, mitigation strategies and policy changes to Group Risk Committees, the Board Risk Committee and ultimately the Board.

Figure 3 illustrates our new Group risk governance framework, its delegations and reporting lines.

The Risk Committee of the Board reviews the Group’s risk appetite and oversees the overall Risk Management Framework. This Committee focuses on key elements of risk, including regulatory compliance risk, market risk, credit risk, balance sheet management, interest rate risk, and operational risk. CSR issues are included as part of operational risk.

For further information on our Board Risk Committee including its members, responsibilities and charter, refer to our 2005 Annual Financial Reporton our Group website .

This year, Internal Audit played a key role in the review of this Report. Table 3 shows the number of internal and CSR-related audits completed by internal and external auditors in 2005.

The work undertaken during 2005 in preparation for NAB’s accreditation application in September 2005 underpins efforts to enhance our internal risk processes. The Group continues to monitor developments and is working with its key regulators in Australia and overseas to ensure that the Group’s Basel II program aligns with regulatory requirements.

We have made significant progress in response to the March 2004 APRA report in respect of the unauthorised foreign currency options trading losses. This Report identified deficiencies in our market risk systems, governance processes, and organisational culture. We continue to implement actions regarding our risk systems and procedures in accordance with the remedial actions specified by APRA and the ASIC enforceable undertaking. A key outcome of this work was the re-opening in May 2005 of our foreign currency options trading desk. The group is also progressing with its internal market risk model re-accreditation. The business continues to focus on a proactive approach to risk management and regulatory compliance. For further information refer to the ‘report of the directors’ on page 101 and information on risk pages 58 to 64 and the changing regulatory environment pages 16 to 17 of the 2005 Annual Financial Reporton our Group website .

Anti-money laundering In most countries in which the Group operates, measures have been adopted to combat use of the financial system for money laundering, as well as to restrict the financing capacity of terrorists and their organisations. The Group continues to develop its business practices and systems for the detection and prevention of transactions that may involve prescribed terrorists or money laundering. We have also been involved in discussions with the Australian Government around the content of its draft regulations.

Moving forward

Planned actions for 2006 include:

• streamlining CSR governance processes to reflect our regional model
• aligning the CSR Report with the annual financial reporting process.