Major losses at Allfirst and Lehman have prompted serious concern about control and oversight at financial-services firms.
"It could never happen here."
Famous last words, but words that could end up costing financial-services firms millions of dollars and serious damage if taken lightly. This obviously flawed line of reasoning will not suffice any longer in the wake of major trading losses, fraud and theft at Allfirst Financial, with rogue currency trader John Rusnak, and Lehman Brothers, where branch manager Frank Gruttadauria siphoned millions from customer accounts.
Proper risk management, particularly operational risk management - including losses resulting from inadequate or failed internal processes or external events - should have prevented the two firms from being duped by schemes that went undetected for years.
The most recent losses bring back memories from the infamous collapse of Barings Bank in 1995, brought on by Nick Leeson's rogue trading losses. But as years go by, budgets get tight and executives get comfortable. So, while external threats have been getting more attention these days, internal threats remain and have become harder to uncover, or possibly just easier to conceal.
Either way, complacency won't cut it and financial-services firms can't risk turning a blind eye, or even a half-open eye, towards trading activities. Firms should be readily aware of not only the technology and systems they have in place to deter theft and fraud from within, but also the people, processes and procedures throughout the firm - especially in higher-risk trading areas. But why, in the first place, do brokers and traders cheat? And how do they get away with it?
These are complicated questions, but they are also questions that every firm should be thinking about right now, while headline-grabbing losses are fresh on everyone's minds. Deborah Williams, research director at Meridien Research, says a good place to start when looking internally at these types of operational risks is to simply, "Sit down and think of all the ways someone can cheat." She says executives should ask themselves, "If that were here, how would we have known it was going on?"
Checks and balances are key, she adds. Although every control and checkpoint won't stop the occasional fraud, it will limit their time and scope, and help prevent serious losses.
Allfirst gets hit hard
And serious losses were definitely the case at Allfirst Financial, as the firm, which is a unit of Allied Irish Banks of Dublin (AIB), discovered earlier this year that currency trader John Rusnak was able to rack up losses totaling $691 million. And just as surprising was the fact that he was able to cover it up for about five years. According to an internal investigation and joint report by Eugene Ludwig, managing partner at the Promontory Financial Group and former comptroller of the currency, and N.Y. law firm Wachtell, Lipton, Rosen & Katz, the failure of Allfirst to detect Rusnak's fraud was due to a lengthy list of controls, oversight and processes, all gone seriously wrong.
The report traces Rusnak's losses back to 1997, when he used currency forwards to buy a large amount of yen for future delivery. But when the value of the yen fell, his forward positions declined and Rusnak began to hide the losses and the size of his positions with fake options. This made it look like he was hedging his real positions and created a web of fake positions and cover ups.
All the while, Rusnak was able to manipulate his Value-at-Risk calculations, which estimate the maximum range of losses to be suffered in a certain portfolio, and keep his trading going, as his losses mounted. He was able to get around his typical $1.55 million VaR limits with the fake options entries, which appeared to hedge his real options and reduced the limit numbers. Rusnak also was able to manipulate the VaR calculations by changing the currency rates coming into the trading system.
The Snowball Effect
The laundry list of deficiencies and lax controls compounded to open the door, and keep it open, for Rusnak's scheme. One major problem area was an unusual reporting structure, in which Allfirst's treasurer David Cronin was charged with overseeing trading profits, as well as the controls on the trading area.
In addition, both the local Allfirst branch and the home AIB office relied too heavily on Cronin, who had come into the branch with a respectable reputation, but was not functioning properly in his role as treasurer. "It was a dysfunctional relationship," says Ludwig. "Because (Cronin) really reported to both the home office and the local office and didn't have a real clear line and nobody had a clear sense of what his responsibility was."
To avoid this type of ambiguous structure, Ludwig advises that firms, "simply should not rely on any one person." He says that, in the banking world, managers have the responsibility to be skeptical of employees. "You can't rely on whoever it is 100 percent, you have to verify," Ludwig says. "However much they liked Cronin, they should have done a huge operational scrubbing (or audit) of his areas, at least once every two or three years."
But when it came down to those operational scrubbings and internal audits, Ludwig's report found that, "Allfirst's internal audit appears to have suffered from inadequate staffing, lack of experience and too little focus on foreign-exchange trading as a risk area."
More specifically, at the most, two full-time auditors were responsible for all of treasury, with neither of the two having a background in foreign exchange or trading activities. The report also states that only two people were responsible for company-wide risk and only one full-time employee from treasury-risk control was devoted to measuring trading risk in the foreign-exchange portfolio. The report says this person, "was extremely inexperienced and appears to have received little support or supervision from others in treasury-risk control."
As an example of the lax controls that enabled Rusnak to get away with his fraud, in 1999, treasury operations took no sampling of his transactions to find if they had been properly confirmed. When an August 2000 internal audit sampled 25 transactions to check confirmations, only one of those was a foreign-exchange option while the majority of those sampled were exchange-traded products, with relatively low confirmation risk. And by chance, the one FX option sampled at the time was a genuine one, while about 50 percent of the 63 FX options on the books at the time were not genuine. Ludwig's report states, "Had the auditors included even just a few additional options in their sample of transactions, the overall probability of detecting a bogus one would have increased dramatically."
Furthermore, Ludwig's report found that Rusnak was able to manipulate and, in a way, coerce back-office and operations people. "When anybody asked questions, or something didn't look quite right to them, he manipulated people in terms of their personalities, so that everything looked fine," says Ludwig. For example, Allfirst policy required that all trades be confirmed by the back office, but Ludwig's report says that Rusnak was baically able to bully or cajole the operations staffer responsible for confirming his trades into not confirming all of them.
These circumstances combined with the culture in financial-services firms where the control and operations personnel are usually not compensated as well as traders and managers, and are often treated differently. John Owen, chief operating officer and founding partner at Capco, a financial-services consultancy, explains, "People ebb and flow in this area and smart people in back offices don't usually last too long because the back office, in investment banks, isn't treated so well. There's a big skill/compensation issue in the way front offices treat operations and technology."
While having a stellar back-office staff in place might not have completely prevented Rusnak's fraud, Williams says that he might have been caught sooner. "Operations is a cost center and the traders are a profit center and get listened to and have clout, they're always going to be the profit center," she adds.
Part of the problem could also be the profit incentives that traders are faced with. "These are people with egos, who are incented to take risk and who think they know better than the market, that's how traders make money," says Williams. "These people are paid to think they know more than people around them." She adds that traders are compensated based on profits and losses, so showing a gain on a position is an advantage in getting paid but also could be an incentive to cheat.
"Banks should be aware of how they compensate people and how that compensation scheme might lead people to behave," says Williams. She points out that some banks have instituted lagged bonus schemes, where traders see bonus money spread out over quarters or 12-month periods, rather than everything in one month. "This makes it harder for people to benefit short term, or have a quick-cash gain from something - that quick-hit fraud and those kinds of things," says Williams.
Ludwig also faults Allfirst's "mediocre systems" as a major factor in Rusnak's ability to cover up his losses. Allfirst was using an older version of The Devon Trading System, which allowed Rusnak to get into the system and manipulate numbers coming in from Reuters feeds.
Ludwig's report also found that in 2000, an Allfirst risk-assessment analyst raised concerns to a treasury-risk-control analyst that the daily valuation of FX trades was not being obtained from an independent source. The treasury-risk analyst proposed using a spreadsheet that would take a direct-data drop from Reuters, but Rusnak said that he needed access to the rates in order to monitor his Value-at-Risk levels. So Rusnak suggested creating a feed into the database from one of his files. The treasury analyst then developed a system in which the rates were downloaded from Rusnak's Reuters terminal to his personal computer's hard drive and fed into a database on the shared network. From there, the front, back and middle offices had access.