Culture vs. Compliance — Bank Pertiwi's Conduct Crisis

A four-round, advanced governance and conduct-risk simulation set inside Bank Pertiwi Berhad, a RM 92 billion Kuala Lumpur commercial bank regulated by Bank Negara Malaysia (BNM). Three years ago the bank lifted fee income 28% with steep individual sales incentives and a public league table — and, unnoticed, rebuilt the exact conditions that produce mis-selling scandals. On 16 March 2026 internal audit flags the early signature of systematic mis-selling at 18 top-of-league-table branches: ~2,400 customers possibly sold credit-protection insurance without consent, RM 14–22M remediation exposure, 41% of sellers reporting target pressure (up from 19%) and an 8% speak-up rate. The board meets in two weeks; BNM has not been told. Playing the Chief Governance Officer, you steer the response through Elsa Satkunasingam's lens — that controls alone do not prevent misconduct, and rules layered on a toxic culture push it underground rather than ending it. Round 1: diagnose symptom or system — bad apples, a control gap, or a bad barrel — read the 8% speak-up rate (suppressed signal, not reassurance), and estimate how many of the 192 un-flagged branches share the risk. Round 2: design the response across two levers, controls and culture, and decide the sequencing — the rules-only trap leaves the misconduct-risk index high. Round 3 (the core): commit four decisions — keep, scrap or redesign the incentive scheme (scrapping costs 8–10 points of fee growth); self-report, investigate-then-report, or hold disclosure to BNM (concealment turns a RM 14M remediation into a RM 30M enforcement action when BNM discovers it independently); hold the frontline only or the whole system accountable; and provision customer remediation. Round 4: a complication lands — a journalist, a BNM thematic review and a whistleblower emailing the board chair — and you brief the board, where the honest one-sentence diagnosis must name the incentive culture rather than 'a few bad apples'. The math wires the concept's five common errors as sticky, run-defining penalties: bad-apples framing caps culture health, rules-only floors the misconduct-risk index near 78, concealment collapses compliance and board confidence, wholesale over-correction caps fee growth, and a sanitised brief caps board confidence — so no single good round can wash out a headline anti-pattern, and a blind click-through of the error-leaning defaults cannot win. Final KPIs track the misconduct-risk index (lower is safer), compliance standing, board confidence and culture health.