Internal Audit, Rogue Trader Presentation AIBA Sept. 22, Presented by: Brent Camery, CPA

Transcription

1 Internal Audit, Rogue Trader Presentation AIBA Sept. 22, 2010 Presented by: Brent Camery, CPA

2 Disclaimer & Copyright Notice The views expressed herein may not necessarily reflect those of the Crowe Horwath LLP. All materials including but not limited to graphics, photographs, and text appearing in this presentation are protected by Copyright. Reproduction or redistribution in any form is prohibited. 2

3 Agenda History Socgen Weaknesses Exploited Control Deficiencies 2010 Control Deficiency Mitigation What can Internal Audit Do? Conclusion/Q&A 3

4 Top Rogue Trading Losses Year Company Individual Market In US$ Billions 2008 Societe Generale Jerome Kerviel European Equity Index Futures Sumitomo Corp. Yasuo Hamanaka Copper Futures Barings Nick Leeson Nikkei Index Futures Resona Holdings (Daiwa) Toshihide Iguchi Sold Custodial US Treasuries Groupe Caisse d'epargne Boris Picano-Nacci Derivatives Allied Irish Banks John Rusnak FX Options China Aviation Oil Chen Jiulin Jet Fuel Futures Kidder Peabody Joe Jett Forward Dated US Treasury Strips National Australia Bank Luke Duffy FX Options Merrill Lynch Howard Rubin Mortgage IOs & POs

5 Culture of Ethics According to a poll of Who's Who Among American High School Students, 80% of the country's best students said it was common for their peers to cheat and 66% admitted to cheating. More than half the students surveyed said they don t think cheating is a big deal. 95% of academic cheaters say they were not caught. 73% of all test takers, including prospective graduate students and teachers agree that most students do cheat at some point. 86% of high school students agreed. Historically, fraud is statistically higher in banks than non-bank entities. 5

6 Societe Generale Authorized to do low risk Arbitrage (i.e. hedged) trading Began unauthorized trades in 2005 (up to 50 Billion Euro positions) Hid directional (i.e. unhedged) positions using fictitious forward trades January 2008 SocGen announced $7 Billion Rogue trading loss 6

7 Societe Generale - Weaknesses Exploited 1. Adequacy of Trading Desk Supervision-1 st Line of Defense Lack of adequate direct supervision for two and a half months between resignation of former desk manager and hiring of new manager New direct supervisor lacked experience as a desk manager New manager did not perform detailed analysis of trading activities (example: manager did not regularly analyze profits/losses and the trades in the database to monitor traders activity) SG s departmental staffing fluctuated rapidly between 2005 and Responsiveness to Alerts Items discovered through various reviews and analysis were not investigated properly by SG personnel Kerviel s responses to inquiries were described as not coherent but supervisors and compliance agents did not prompt him for further explanation. Kerviel s reluctance to take vacation time did not alert his supervisors 2. (Source: Societe Generale Mission Green Report, May 20, 2008) 7

8 Societe Generale - Weaknesses Exploited 3. Entitlement Limits Kerviel traded beyond his trading limit almost immediately once in trading desk position 4. Controls Knowledge Kerviel held previous job in bank s risk-control department By-passed detection controls: Recorded fictitious trades which were cancelled prior to any confirmation, settlement, or control Recorded pairs of fictitious trades which offset each other (See next slide) (Source: Societe Generale Mission Green Report, May 20, 2008; Societe Generale says its controls failed for 2 years, New York Times, February, 20, 2008) 8

9 Societe Generale Weaknesses Exploited 9

10 Types of Traders not to Trust 1. Intimidating Traders characterized by lack of time for auditors, questioning of scope of audit and auditors qualifications, condescending attitude, etc. 2. Cooperative Traders characterized by their welcoming and open nature. 3. Continued on next page 10

11 Types of Traders not to Trust, Cont d 3. ALL OTHERS 11

12 Control Deficiencies Leading to Undetected Unauthorized Positions 1. Inappropriate System Entitlements 2. Lack of Mandatory Trader Vacation Policy 3. Lack of Review of Gross (i.e. Notional) Trading Positions 4. Inadequate Controls over Cancel & Correct, As of, Amendment and Off-Market Transactions 5. Inadequate Controls Over Trades Booked with Unspecified Counterparties (Temporary Accounts) 6. Unidentified Patterns in unmatched or unconfirmed trades 7. Lack of Market Risk P&L Look Backs 8. Insufficient Treasury (i.e. Funding) Analysis 12

13 Control Deficiency Mitigation 1. Inappropriate System Entitlements Segregation of Duties and IT Controls: IT security and access controls should ensure that users may only access those functions necessary to perform their assigned responsibilities. An appropriate change management process should be in place to remove access upon departure from a position. Access for incompatible duties should be reviewed. A security conscious culture should be established in order to diminish the sharing of passwords. Access to modification of IT control parameters (such as trading limits) should be limited to a select group of individuals. 13

14 Control Deficiency Mitigation 2. Lack of Mandatory Trader Vacation Policy HR Controls: Are traders are required to take two-week continuous holidays? Management should consider a policy where traders are required to take desk holidays where a colleague takes over responsibility for marking or valuing the trader s books. Under either scenario, traders access to systems and ability to record trades should be restricted. 14

15 Control Deficiency Mitigation 3. Lack of Review of Gross Trading Positions Trading Risk Management Controls: Both Supervisory and Market risk personnel should review gross (i.e. not just net) trading positions. Trading limits (including products, markets, and corresponding risk limits) are established and maintained by management including the trading management and risk management personnel. Appropriate limits and monitoring reports address exotic and high order risks, including basis risks and liquidity risk. Reconciliations of margin / collateral calls to the trading book should be performed to ensure that margin calls are correct and positions on the book are accurate. Mechanisms exist to monitor traders positions as compared to trader limits and overall desk position. Proper process or escalation to investigate any breaches of these parameters 15

16 Control Deficiency Mitigation 4. Inadequate Controls over Cancel & Correct, As of, Amendment and Off-Market Transactions Transaction Monitoring Controls: Management should create and review a monitoring report for transactions performed at an off-market rate. Large day-one P&Ls and / or cancelled and amended trades with large P&L impact are adequately analyzed Designated staff should be responsible for monitoring trade corrections for patterns (e.g. specific traders). 16

17 Control Deficiency Mitigation 5. Inadequate Controls Over Trades Booked with Unspecified Counterparties (Temporary, Error, Holdover, Suspense, Pending, Average Price, etc. Accounts) Exception Reporting Controls: Suspicious activity (i.e. inappropriate suspense accounts) is escalated to, and acted on, by senior management. Counterparty exposures are monitored and analyzed for any technical or unspecified counterparties. 17

18 Control Deficiency Mitigation 6. Patterns in unmatched or unconfirmed trades Confirmation Controls: Outstanding confirmations should be tracked and analyzed and escalated to senior management. Confirmations are received directly by personnel in the middle or back office, rather than the front office. Reconciliations between front office, risk management, and back-office systems to support from the outside world (i.e. confirmations and reconciliations with custodians, nostro accounts, exchanges, and brokers, etc.) should be performed on a periodic basis. 18

19 Control Deficiency Mitigation 7. Lack of Market Risk Look Backs Environmental Monitoring Controls: A reconciliation between actual P&L and a VAR model should be performed to discover any anomalies. A review of collaterals/margin posted by traders against historical patterns and predetermined thresholds should be performed by designated personnel on a periodic basis to identify unusual patterns. 19

20 Control Deficiency Mitigation 8. Insufficient Treasury Analysis (i.e. Desk Funding analysis) Monitoring Controls: An analysis of trading positions versus collateral / margin posted should be performed. A review of collaterals/margin posted by traders against historical patterns and predetermined thresholds should be performed by designated personnel on a periodic basis to identify unusual patterns. 20

21 What can Internal Audit Do? Internal Audit is the 3 rd line of defense after 1) Business Management; and 2) Control Functions (e.g. Finance & Operations, Risk Management, Compliance, etc,). In this capacity, Internal Audit should validate that 1) & 2) have mitigated: Inappropriate System Entitlements, Lack of Mandatory Trader Vacation Policy, Lack of Review of Gross (i.e. Notional) Trading Positions, Inadequate Controls over Cancel & Correct, As of, Amendment and Off-Market Transactions, Inadequate Controls Over Trades Booked with Unspecified Counterparties (Temporary Accounts), Patterns in unmatched or unconfirmed trades, and Lack of Market Risk P&L Look Backs. 21

22 What can Internal Audit Do? Ensure that Whistle Blower Hotlines are well known, operative, and hotline reports are thoroughly investigated. Other investigative procedures could include: Look for Cash positions with large unrealized P&L; Look for Large Positions in Suspense, Holdover, Average Price, etc. accounts; Look for Traders not in compliance with vacation policy; Look for Traders with a high volume of cancels & corrects; and Recommend that Supervisory Management periodically certify that they have sufficient tools to identify unauthorized trading. 22

23 Conclusion/Q&A 23

24 Contact Information For a copy of this presentation, contact: Brent Camery, CPA Office Phone:(212) brent.camery@crowehorwath.com 24