Independence Undermined at a State-Owned Utility
Meridian Water Authority is a state-owned utility with 2,400 employees and an annual capital budget of AUD 900 million. Its compliance unit of three people sits within the finance division; the head of compliance reports to the CFO, who also chairs the tender committee that approves all contracts above AUD 5 million. In March the compliance unit flagged that a AUD 12 million maintenance contract had been awarded to a company part-owned by the CFO's brother-in-law; the CFO told the compliance head to 'leave it to the probity team' and the matter was not escalated. The audit and risk committee has not met since November, and the board's charter says compliance is 'a management matter'. Staff surveys show 55% would not report a concern because 'nothing happens'.
1. Assess which principles of compliance are most directly compromised and why.
Read the worked answer
The most directly compromised principles are accountability, good governance, transparency and integrity. Accountability requires clear responsibility for compliance decisions and consequences; here the CFO both approves the contract and controls the compliance escalation route, so no one independent can hold the decision to account. Good governance requires proper oversight, segregation of duties and a functioning audit and risk committee; the committee has not met since November and the board charter treats compliance as purely managerial. Transparency is compromised because the conflict of interest was not disclosed or recorded, and the instruction to leave the matter to the probity team suppresses escalation. Integrity is compromised if a suspected related-party transaction is not examined. The design issue is structural - the compliance unit sits inside finance and reports to the CFO - but the behaviour issue is more serious: a senior executive used his position to stop a compliance escalation. ISO 37301 expects top management to promote a culture in which concerns can be raised without fear. The 55% survey result is evidence that the culture is not supporting the principle.
2. What changes to roles, responsibilities and authorities would you recommend under ISO 37301 Clause 5?
Read the worked answer
Under Clause 5.3, roles, responsibilities and authorities must be assigned and communicated. The compliance function needs a reporting line and access that allow it to escalate independently. I would recommend: the head of compliance has a direct reporting line to the audit and risk committee, with a dotted line to the CEO for administration; the committee meets at least quarterly and receives a standing compliance report; the CFO is removed from any decision on the maintenance contract and any matter involving his relative; a conflicts-of-interest register is established and reviewed; the compliance function has authority to investigate and to require information, and cannot be overruled by the CFO on escalation. Clause 5.1 requires top management to demonstrate leadership and commitment, so the CEO and board must visibly endorse the new arrangements. The probity team can handle procurement process questions, but it cannot replace compliance escalation. These changes should be documented, communicated and tested, not merely written into a charter.
3. Is the CFO's instruction to 'leave it to the probity team' consistent with ISO 37301? Justify your answer.
Read the worked answer
No. The instruction is inconsistent with ISO 37301 for three reasons. First, Clause 5.1 requires top management to demonstrate leadership and commitment to the CMS; directing that a suspected conflict of interest not be escalated undermines that commitment. Second, Clause 8.1 requires operational controls to be implemented, including controls over related-party transactions and procurement; referring the matter to a probity team does not establish that the conflict was identified, assessed and managed. Third, Clause 10.2 requires nonconformities to be reacted to, evaluated and corrected; suppressing the report prevents that. The probity team may have a legitimate role in reviewing the tender process, but it is not a substitute for compliance investigation, and it may itself be compromised if it reports to the same CFO. The compliance head should document the instruction, escalate to the audit and risk committee or board chair, and open a corrective action. The underlying contract award should be reviewed independently, and the outcome recorded. If the CFO's involvement is confirmed, the matter may also trigger external reporting obligations, which the compliance function must assess.