CBA has released Promontory Australasia's first independent report into the progress of its remedial action plan. This follows on from APRA's prudential inquiry into the bank, released on 1 May 2018, with the stated goal of "strengthening governance, culture, accountability and customer outcomes" at CBA - areas of weakness that may in the past "have contributed to a series of incidents that led to adverse publicity and regulatory scrutiny".The Promontory report, dated 28 September 2018, provides an update on actions CBA has taken as part of its remedial action plan  up until 31 August.Promontory Australasia, an IBM company, was appointed as the independent reviewer to provide regular reviews of progress against committed milestones with APRA.There are 153 milestones outline in the remedial action plan, the first of which are for design, and these are due for completion by March 2019.The reports notes that, although progress has been made in laying a solid foundation for an effective program, the sheer size of CBA, the extent to which existing processes and sub-cultures are embedded, and the complexity of the program are likely, in Promontory's view, "to pose ongoing execution challenges".To ensure that CBA remains focused on making these changes, all senior leaders - defined as general manager and above - have had 20 to 30 per cent of their performance metrics tied to the successful delivery of the remedial action plan milestones for the current financial year.Commentary within the report reiterates that APRA's recommendations for CBA call for the bank to "embark on a process of deep and fundamental change across the organisation". While concerned at the size of the task, Promontory is impressed by the level of executive support behind the plans, which it says will "provide a basis for turning planned changes from ideas into day-to-day practices across the business".The key risks identified relate to the need to ensure access to skilled personnel to support the program, particularly in the human resources and risk management areas. Systems, data, and analytics staffing and resource allocation have also been identified as delivery risks that require close management as the program evolves. "While initial resourcing plans and a program budget for the current financial year have been established, we would expect to see evidence of more comprehensive resource planning and committed multi-year budgets going forward," Promontory says.Its next report is due at the end of December.