On 25th June Ofwat announced that it was seeking to impose its largest ever penalty on Southern Water after a series of failings related to the operational management of a number of its UK wastewater treatment works. In addition to deliberately misreporting data to Ofwat, the regulator concluded, inter alia, that the utility company had not made appropriate provision for effectually dealing with and treating wastewater, and had failed to put in place adequate systems of planning, governance and internal controls.
Whilst the size of the penalty grabbed the headlines3 , this Paper focuses on the apparent failings in the compliance systems, management oversight and culture that contributed in such a significant way to the breach of Southern Water’s licence conditions and statutory duties. Many of the themes highlighted by the investigation will be of interest to businesses which operate within a framework of environmental controls. The investigation also comes at a time when there is heightened focus on business compliance behaviours and corporate transparency, whilst it has further added fuel to the political debate in the UK over whether major utilities should be brought back into public ownership.
In December 2016, the Environment Agency (the EA) alerted Ofwat to the fact that it was investigating Southern Water (the Company) in connection with certain data submitted by the Company that related to the performance of its wastewater treatment works. The Company itself then notified Ofwat of the EA’s investigation in early 2017. Ofwat launched its own investigation in June 2017 which focused on whether the Company had breached any of the statutory duties and licence-related obligations applicable to it for which Ofwat had regulatory jurisdiction. Ofwat’s investigation was focussed, in particular, on various performance-related aspects of the Company’s wastewater treatment works and its reporting of compliance-related information. Ofwat’s findings and proposed enforcement action were published on 25 June 2019 (in the form of a Notice of Ofwat’s proposed penalty). As required under law, Ofwat must allow representations on the proposed penalty (which can be made up until 19 July 2019). The EA’s own criminal investigation, which is entirely separate to the Ofwat action, is on-going.
Ofwat’s Notice commented extensively on issues connected to the Company’s corporate governance and compliance processes. There are clearly some interesting lessons to be learnt.
ROLE AND OVERSIGHT OF THE BOARD
One of the most interesting aspects of the investigation was the question of whether the Company’s Board had sufficient operational oversight. The investigation found that failures in the performance of the Company’s wastewater treatments works were not, for a number of years, fully brought to the Board’s attention. Instead, the Board was more typically presented with a picture of improving performance in relation to environmental matters. Although Ofwat concluded that members of the Board were, therefore, potentially unaware of the Company’s actual wastewater treatment performance and the practices that were occurring on the ground, the regulator did highlight a number of issues with the Board’s performance on this issue. In particular, it noted that it was the responsibility of the Board to secure the reliability of the information that was reported to it, and to create a culture in which that was the expectation. Ofwat concluded that the Company’s Board had not done this. Ofwat also indicated its expectation that boards generally should be diligent in ensuring that their companies meet certain core obligations and must, in particular, ask for the necessary evidence to ensure that their businesses have appropriate systems and resources in place to undertake any regulated activities. It suggested that boards should: (a) have appropriate lines of sight into the performance of their business operations (which, in the Company’s case, had been hindered by a lack of investment in IT systems and a failure to integrate end-to-end processes); and (b) ensure that appropriate assurance functions (both internal and external) are put in place in respect of any material parts of the business, allowing for departments, directorates and business units to be appropriately and independently scrutinised and challenged as necessary.
Ofwat also singled out the Company’s Board for (i) not always providing appropriate oversight over the “values and culture” of the company to satisfy itself that behaviours throughout the business were aligned with the Company’s purpose; and (ii) failing to otherwise create a robust compliance culture where staff felt supported to “do the right thing”.
The regulator was, however, able to take comfort from the fact that an action plan had been designed by the Company to ensure that similar issues would not arise again moving forward. In particular, the regulator commented positively on the plan’s proposals to: (i) see a “Director of Risk and Compliance” appointed to lead a new Compliance Directorate (aimed at strengthening internal independence assurance capabilities); (ii) introduce a new Compliance and Risk Committee of the Company’s Executive Leadership Team, tasked with providing regular compliance updates to the Company’s Board; and (iii) give operational front line teams greater responsibility for reporting their performance, and to make them subject to further controls highlighting the accuracy of their reported performance. The importance of these issues should not be underestimated. Ofwat confirmed that it considered the Board’s failure to ensure that it had clear lines of sight and establish robust challenge and assurance functions to be aggravating factors when it came to calculating the proposed penalty (notwithstanding the fact that the Board’s members were potentially kept in the dark around the operational shortcomings of the Company).
ASSET MANAGEMENT AND INVESTMENT
Ofwat observed that there had been various management-related issues around how the Company’s wastewater treatment assets had been operated. Three stand out in particular: (a) there was a lack of clarity around the condition of the Company’s wastewater treatment assets: Ofwat suggested that the Company had not, until very recently, had a clear enough idea about the general condition of its assets and/or the extent of work needed to make them compliant with requisite standards; (b) there had been a general lack of investment: Ofwat indicated that a back-catalogue of maintenance works covering some 991 issues (with some 341 still open as at January 2019), with an estimated investment cost of £26 million still needed to remediate the same, was strongly indicative that historical levels of investment by the Company had not been sufficient to keep pace with the inevitable deterioration of the Company’s assets. It also noted that, where investment needs had been identified by the utility provider, the same were often not progressed for long periods of time; and (c) management’s approach was reactive rather than proactive: Ofwat’s review concluded that the approach taken by the Company to the management of its assets tended to be reactive rather than proactive and, whilst there was evidence of an operational and maintenance focus on failing assets, capital investment was sometimes slow to materialise (even after multiple operating permit breaches). In light of these issues, Ofwat noted that there had been a systemic failure by the Company to properly manage and operate its wastewater treatment assets which, in turn, allowed it to conclude that the Company had breached its statutory obligations.
PROCESS CONTROLS: LACK OF RIGOROUS SAMPLING AND TESTING
Environmental permits and licences typically require for on-going sampling and testing to be undertaken to confirm that emissions from regulated facilities are within prescribed limits. Ofwat highlighted various deficiencies with the way that these exercises were conducted by the Company. In particular, it noted that the Company’s: (a) sampling visits were co-ordinated, and so could be easily predicted; and (b) staff involved in the scheduling of the sample visits were not sufficiently separate from the operational teams, did not hold information confidentially, and openly discussed the predicted dates of when samples would be taken. These factors, in turn, resulted in the relevant operational teams having sufficient confidence in the expected sampling dates that they could effectively plan for when the samples/tests would be undertaken, allowing for them to manipulate the assets (and therefore the results) as they deemed necessary. Ofwat concluded that the effective operation of the sampling regime was critically important to securing the Company’s compliance with relevant regulatory reporting requirements. It also concluded that there should have been more robust planning and control systems, and management resources, put in place to ensure proper oversight of the Company’s sampling regime. Ofwat suggested that the Company would have benefited from having a more randomised set of sampling events, and a more confidential system (particularly around the management of sampling schedules). Many entities conducting regulated environmental activities will be very familiar with the need to undertake sampling and testing exercises, and will have established their own processes for this. However, this case highlights the need to be vigorous in ensuring sufficient safeguards are built into the testing regime so as to guarantee the veracity of the results and to ensure appropriate levels of oversight.
DELAYS IN TRAINING
Ofwat’s Notice highlighted that an internal audit and risk document presented to the Company’s Executive Management Team in September 2015 had stated that there had been a lack of training provided to operators and technicians at its waste water treatment works, and that no training had been provided since 2011. The regulator had particular concerns as to why it ultimately took five years to implement this training and why there were no questions raised about it earlier. It also made clear its expectation that, for employees operating in a complex and technical environment, management should provide appropriate and regular training to ensure that such personnel are properly equipped to carry out their jobs in an effective manner. However, it welcomed the plans put forward by the Company to develop both public health and environmental compliance training programmes, and to appoint “environmental advisors” to increase general awareness of environmental issues. Ofwat’s comments are a useful reminder of the importance of training for all levels of employees (and the board) within a business whether it concerns environmental, health and safety or wider compliance issues such as anti-bribery measures or export controls. Regulators will look closely at the level of training (and supervision) employees were given in the event that an incident arises. It is therefore important that senior management (and most logically either the head of compliance or HR) has clear oversight and responsibility for all aspects of training for employees. This is something that can be easily over-looked given the day-to-day operational pressures of a business.
TRANSPARENCY AND WHISTLEBLOWING
The Company acknowledged that there had been deficiencies in its organisational culture historically which had prevented employees from being comfortable with speaking out about inappropriate or non-compliant behaviours. This was attributed, in part, to the Company having put in place ineffective whistleblowing policies. The result was that no staff came forward to report their concerns, despite being uncomfortable with how parts of the business were conducted, with some personnel also feeling generally pressured to act in an improper manner.
In addition to criticising the Board for failing to otherwise create a robust compliance culture (as discussed above), Ofwat also took particular aim at the utility provider’s historical whistleblowing structures. By way of example, it cited a statement in a version of the Company’s old whistleblowing policy, placed in bold on the front page, which stated that, should any investigation conclude that any disclosure was designed to discredit another individual or group, or prove to be malicious or misleading, then the worker concerned would themselves become the subject of a disciplinary procedure or even action from the aggrieved individual. The regulator was, however, reassured by the fact that the Company had taken, and was taking, a number of remedial actions around these points, including the: (a) updating of the aforementioned whistleblower policy and introduction of a new code of ethics; (b) allowing of anonymised reporting, both by way of telephone and/or online portal; and (c) putting in place of a two year “cultural transformation program”, set to include ethical business practice training. This reinforces the need to ensure that reporting systems for employees and third parties are sufficiently robust and do not lead to whistleblowers being adversely treated. It also demonstrates that a working environment not underpinned by a clear and positive “tone from the top” that promotes ethical business practices, and a “challenge” culture at all levels, can result in issues remaining hidden for prolonged periods of time and/or repeat violations arising. In the Company’s case, the underlying issues existed for a period of at least five years, while repeated contraventions also arose. These were two of the four aggravating factors cited by Ofwat when it proposed its penalty.
USE OF INCENTIVES
The Company reportedly acknowledged that its operational teams had unduly prioritised meeting targets connected to financial incentives over other non-financial outcomes. Ofwat reported that, whilst there was limited direct evidence of front line staff incentives or rewards being linked to improper actions, there was at least a potential that the Company’s incentive schemes for senior management could have led to inappropriate behaviours. The utility provider has, subsequently, stated that this risk will be addressed by reviewing its current incentives and otherwise committing to operate in line with best practice in relation to the issue of executive pay
Conclusions Regulatory compliance is underpinned by the balance between a number of key principles, in particular (i) the discharge of statutory duties; (ii) on-going operational risk assessments; (iii) a calibrated programme of operational expenditure and capital investment; (iv) the implementation and maintenance of compliance policies and procedures; and (v) the establishment of positive cultural values. Ultimately, every operator has to find a way to balance each of these and it is naive to think that businesses get it right all of the time. That said, ensuring that the written compliance procedures within a business are fixed in the right way is an essential foundation – policies should be well written, implemented and followed; training regularly given across a range of compliance areas; whistleblowing channels established that are easily accessible and in which employees have confidence; and safeguards established that catch wrongdoing. The harder piece is behavioural. Ensuring that employees and senior management behave in the right way, and make the right decisions for the business and its reputation, is essential. Whilst often talked about, and harder to pin down, the tone from the board of a business across all these issues is key. Get all of these elements right, and compliance will add value to a business and be a brand enhancer particularly at a time when investors are increasingly looking at businesses through an ESG4 lens.