Internal Audit , Rogue Trader Presentation -...

Internal Audit , Rogue Trader Presentation

AIBA Sept. 22, 2010

Presented by:

Brent Camery, CPA

2

Crowe Horwath LLP is a member of Horwath International Association, a Swiss association (Horwath). Each member firm of Horwath is a separate and independent legal entity. Crowe Horwath LLP and its affiliates are not responsible or liable for any acts or omissions of Horwath or any other member of Horwath and specifically disclaim any and all responsibility or liability for acts or omissions of Horwath or any other Horwath member. Accountancy services in several states are rendered by Crowe Chizek and Company LLC, which is a member of Horwath. © 2010 Crowe Horwath LLP

Disclaimer & Copyright Notice

The views expressed herein may not necessarily reflect those of theCrowe Horwath LLP.

All materials including but not limited to graphics, photographs, and textappearing in this presentation are protected by Copyright.

Reproduction or redistribution in any form is prohibited.

3


Agenda

History

Socgen Weaknesses Exploited

Control Deficiencies

Control Deficiency Mitigation

What can Internal Audit Do?

Conclusion/Q&A

2010

4


Top Rogue Trading Losses

Year Company Individual MarketIn US$ Billions

2008 Societe Generale Jerome Kerviel European Equity Index Futures 6.95

1996 Sumitomo Corp. Yasuo Hamanaka Copper Futures 2.6

1995 Barings Nick Leeson Nikkei Index Futures 1.3

1995 Resona Holdings (Daiwa) Toshihide Iguchi Sold Custodial US Treasuries 1.1

2008 Groupe Caisse d'Epargne Boris Picano-Nacci Derivatives 1.1

2002 Allied Irish Banks John Rusnak FX Options 0.7

2005 China Aviation Oil Chen Jiulin Jet Fuel Futures 0.6

1994 Kidder Peabody Joe Jett Forward Dated US Treasury Strips 0.35

2004 National Australia Bank Luke Duffy FX Options 0.3

1987 Merrill Lynch Howard Rubin Mortgage IOs & POs 0.28

5


Culture of Ethics

According to a poll of Who's Who Among American High School Students, 80% of the country's best students said it was “common” for their peers to cheat and 66% admitted to cheating.

More than half the students surveyed said they don’t think cheating is a big deal.

95% of academic cheaters say they were not caught.

73% of all test takers, including prospective graduate students and teachers agree that most students do cheat at some point. 86% of high school students agreed.

Historically, fraud is statistically higher in banks than non-bank entities.

6


Societe Generale

• Authorized to do low risk

Arbitrage (i.e. hedged) trading

• Began unauthorized trades in

2005 (up to 50 Billion Euro

positions)

• Hid directional (i.e. unhedged)

positions using fictitious

forward trades

• January 2008 SocGen

announced $7 Billion Rogue

trading loss

7


Societe Generale - Weaknesses Exploited

1. Adequacy of Trading Desk Supervision-1st Line of Defense

Lack of adequate direct supervision for two and a half months between resignation of former desk manager and hiring of new manager

New direct supervisor lacked experience as a desk manager

New manager did not perform detailed analysis of trading activities (example: manager did not regularly analyze profits/losses and the trades in the database to monitor traders’ activity)

SG’s departmental staffing fluctuated rapidly between 2005 and 2007

2. Responsiveness to Alerts

Items discovered through various reviews and analysis were not investigated properly by SG personnel

Kerviel’s responses to inquiries were described as not coherent but supervisors and compliance agents did not prompt him for further explanation.

Kerviel’s reluctance to take vacation time did not alert his supervisors

2. (Source: Societe Generale Mission Green Report, May 20, 2008)

8


Societe Generale - Weaknesses Exploited

3. Entitlement Limits Kerviel traded beyond his trading limit almost immediately once in trading

desk position

4. Controls Knowledge Kerviel held previous job in bank’s risk-control department

By-passed detection controls:

Recorded fictitious trades which were cancelled prior to any confirmation, settlement, or control

Recorded pairs of fictitious trades which offset each other (See next slide)

(Source: Societe Generale Mission Green Report, May 20, 2008; “Societe Generale says its controls failed for 2 years”, New York Times, February, 20, 2008)

9


Societe Generale – Weaknesses Exploited

10


Types of Traders not to Trust

1. Intimidating Traders – characterized by lack of time for auditors, questioning of scope of audit and auditors’ qualifications, condescending attitude, etc….

2. Cooperative Traders – characterized bytheir welcoming and open nature.

3. Continued on next page…

11


Types of Traders not to Trust, Cont’d

3. ALL OTHERS……

12


Control Deficiencies Leading to Undetected Unauthorized Positions

1. Inappropriate System Entitlements

2. Lack of Mandatory Trader Vacation Policy

3. Lack of Review of Gross (i.e. Notional) Trading Positions

4. Inadequate Controls over Cancel & Correct, As of, Amendment and Off-Market Transactions

5. Inadequate Controls Over Trades Booked with Unspecified Counterparties (Temporary Accounts)

6. Unidentified Patterns in unmatched or unconfirmed trades

7. Lack of Market Risk P&L Look Backs

8. Insufficient Treasury (i.e. Funding) Analysis

13



1. Inappropriate System Entitlements

Segregation of Duties and IT Controls:

IT security and access controls should ensure that users may only access those functions necessary to perform their assigned responsibilities.

An appropriate change management process should be in place to remove access upon departure from a position.

Access for incompatible duties should be reviewed.

A security conscious culture should be established in order to diminish the sharing of passwords.

Access to modification of IT control parameters (such as trading limits) should be limited to a select group of individuals.

14



2. Lack of Mandatory Trader Vacation Policy

HR Controls:

Are traders are required to take two-week continuous holidays?

Management should consider a policy where traders are

required to take “desk holidays” where a colleague takes over

responsibility for marking or valuing the trader’s books.

Under either scenario, traders access to systems and ability to record trades should be restricted.

15



3. Lack of Review of Gross Trading Positions

Trading Risk Management Controls:

Both Supervisory and Market risk personnel should review gross (i.e. not just net) trading positions.

Trading limits (including products, markets, and corresponding risk limits) are established and maintained by management including the trading management and risk management personnel.

Appropriate limits and monitoring reports address exotic and high order risks, including basis risks and liquidity risk.

Reconciliations of margin / collateral calls to the trading book should be performed to ensure that margin calls are correct and positions on the book are accurate.

Mechanisms exist to monitor traders’ positions as compared to trader limits and overall desk position.

Proper process or escalation to investigate any breaches of these parameters

16



4. Inadequate Controls over Cancel & Correct, As of, Amendment and Off-Market Transactions

Transaction Monitoring Controls:

Management should create and review a monitoring report for transactions performed at an “off-market” rate.

Large day-one P&Ls and / or cancelled and amended trades with large P&L impact are adequately analyzed

Designated staff should be responsible for monitoring trade corrections for patterns (e.g. specific traders).

17



5. Inadequate Controls Over Trades Booked with Unspecified Counterparties (Temporary, Error, Holdover, Suspense, Pending, Average Price, etc. Accounts)

Exception Reporting Controls:

Suspicious activity (i.e. inappropriate suspense accounts) is escalated to, and acted on, by senior management.

Counterparty exposures are monitored and analyzed for any technical or unspecified counterparties.

18



6. Patterns in unmatched or unconfirmed trades

Confirmation Controls:

Outstanding confirmations should be tracked and analyzed and escalated to senior management.

Confirmations are received directly by personnel in the middle or back office, rather than the front office.

Reconciliations between front office, risk management, and back-office systems to support from the outside world (i.e. confirmations and reconciliations with custodians, nostro accounts, exchanges, and brokers, etc.) should be performed on a periodic basis.

19



7. Lack of Market Risk Look Backs

Environmental Monitoring Controls:

A reconciliation between actual P&L and a VAR model should be performed to discover any anomalies.

A review of collaterals/margin posted by traders against historical patterns and predetermined thresholds should be performed by designated personnel on a periodic basis to identify unusual patterns.

20



8. Insufficient Treasury Analysis (i.e. Desk Funding analysis)

Monitoring Controls:

An analysis of trading positions versus collateral / margin posted should be performed.

A review of collaterals/margin posted by traders against historical patterns and predetermined thresholds should be performed by designated personnel on a periodic basis to identify unusual patterns.

21



Internal Audit is the 3rd line of defense after 1) Business Management; and 2) Control Functions (e.g. Finance & Operations, Risk Management, Compliance, etc,).

In this capacity, Internal Audit should validate that 1) & 2) have mitigated:

Inappropriate System Entitlements, Lack of Mandatory Trader Vacation Policy, Lack of Review of Gross (i.e. Notional) Trading Positions, Inadequate Controls over Cancel & Correct, As of, Amendment and Off-Market Transactions, Inadequate Controls Over Trades Booked with Unspecified Counterparties (Temporary Accounts), Patterns in unmatched or unconfirmed trades, and Lack of Market Risk P&L Look Backs.

22



Ensure that Whistle Blower Hotlines are well known, operative, and hotline reports are thoroughly investigated.

Other investigative procedures could include: Look for Cash positions with large unrealized P&L;

Look for Large Positions in Suspense, Holdover, Average Price, etc. accounts;

Look for Traders not in compliance with vacation policy;

Look for Traders with a high volume of cancels & corrects; and

Recommend that Supervisory Management periodically certify that they have sufficient tools to identify unauthorized trading.

23


Conclusion/Q&A

24


Contact Information

For a copy of this presentation, contact:

Brent Camery, CPAOffice Phone:(212)572-5598

Email: [email protected]

Internal Audit , Rogue Trader Presentation -...

Documents

Transcript of Internal Audit , Rogue Trader Presentation -...