You might have seen RACQ copped a blast last week from the Australian Prudential Authority for its “immature risk culture”.

“We expect APRA-regulated entities to have strong risk governance in place and we are disappointed with the current deficiencies identified within RACQ,” APRA Deputy Chair Helen Rowell said in a statement released last Wednesday.

That sounds serious, but just how serious?

Well, APRA has taken the rare step of requiring RACQ “to develop and implement a comprehensive APRA-approved, risk transformation program”.

This, I believe, is only the second time APRA has placed such a requirement on a financial institution in the wake of the Hayne Royal Commission into financial services – the first being Allianz in early 2021.

RACQ says it’s all to do with the company’s other big news during the year – that it was going to have to pay back more than $220 million to policy holders after discovering they hadn’t received eligible discounts going back to 2013.

Group CEO David Carter says in RACQ’s 2021-22 annual report that its review of the discount issue had resulted in “a risk transformation program across the business”.

But the annual report, released on 23 September, offers limited detail of what this might actually entail, which is where APRA steps in.

Just two weeks later, on Wednesday last week, APRA issued its own statement demanding RACQ implement an APRA-approved risk transformation program.

“This enforcement action comes after APRA identified significant weaknesses in RACQ’s risk governance during a prudential review undertaken this year.”

APRA’s statement suggests its concerns go well beyond RACQ’s insurance policy handling procedures.

“Areas of concern include RACQ’s risk and compliance framework and practices, capability and capacity challenges within the risk functions, unclear accountabilities and an immature risk culture,” it says.

APRA is also requiring RACQ to engage “a third party to provide independent assurance over the delivery of the risk transformation program and provide periodic reporting to APRA”.

RACQ must also assign “accountability under the Banking Executive Accountability Regime for successful delivery of the risk transformation program to an appropriate, named executive”.

APRA refused to elaborate when I asked for more information.

So, we don’t know if the timing of APRA’s announcement last week was purely coincidental or whether if the RACQ had been more forthcoming in its annual report APRA mightn’t have felt the need to weigh in so publicly.

For its part, RACQ says it wasn’t forewarned of APRA’s statement.

It did, however, release its own response just hours after APRA’s announcement.

“As previously outlined (in a media release in June) RACQ is making a significant investment in its systems and processes to deliver improved outcomes for our members, stronger risk management, simplified products, and easier processes for our people,” it said.

RACQ does appear to acknowledge it mightn’t have been moving quickly enough.

“The Club is accelerating its risk transformation program which is vital to support the organisation into the future,” it says.

It also says it has already engaged “an independent firm that has expertise in risk management to review RACQ’s activities and identify opportunities for improvement”.

“This review is underway, along with the development of an action plan that will outline RACQ’s roadmap for improving its risk management approach.

“This work will also be subject to approval and oversight by ASIC and APRA and will continue into FY24.”

So yes, it is serious but, according to RACQ, which insists it’s never tried to hide anything, it’s all in hand.

“While RACQ has faced an exceptionally tough year, I want to reassure members that we remain financially strong to deliver on our commitments and support ongoing operations well into the future,” CEO Carter tells members in the annual report.

That’s the good news.

The bad news is that three-and-a-half years after the Hayne Royal Commission which has prompted new standards of risk management for financial institutions, APRA has found RACQ wanting.