How to lose  $ 360 Million A Case Study in Operational Risk Richard Barr & Stanley Epstein Principal Associates
Definition - Operational Risk “ Operational Risk  is defined as the risk of loss resulting from inadequate or failed inter...
Case Study In January 2004 the National Australia Bank announced that it had suffered a A$360 million foreign exchange los...
The Facts <ul><li>Amount of the losses:  The final figure was A$360 million. The losses were calculated by the National an...
Timeline 30 September 2001 30 September 2003 30 September 2002 A$ 400 A$ 360 A$ 320 A$ 280 A$ 240 A$ 200 A$ 160 A$ 120 A$ ...
Timeline 30 September 2001 30 September 2003 30 September 2002 A$ 400 A$ 360 A$ 320 A$ 280 A$ 240 A$ 200 A$ 160 A$ 120 A$ ...
Timeline 30 September 2001 30 September 2003 30 September 2002 A$ 400 A$ 360 A$ 320 A$ 280 A$ 240 A$ 200 A$ 160 A$ 120 A$ ...
Timeline 30 September 2001 30 September 2003 30 September 2002 A$ 400 A$ 360 A$ 320 A$ 280 A$ 240 A$ 200 A$ 160 A$ 120 A$ ...
Timeline 30 September 2001 30 September 2003 30 September 2002 A$ 400 A$ 360 A$ 320 A$ 280 A$ 240 A$ 200 A$ 160 A$ 120 A$ ...
Timeline 30 September 2001 30 September 2003 30 September 2002 A$ 400 A$ 360 A$ 320 A$ 280 A$ 240 A$ 200 A$ 160 A$ 120 A$ ...
Timeline 30 September 2001 30 September 2003 30 September 2002 A$ 400 A$ 360 A$ 320 A$ 280 A$ 240 A$ 200 A$ 160 A$ 120 A$ ...
Timeline 30 September 2001 30 September 2003 30 September 2002 A$ 400 A$ 360 A$ 320 A$ 280 A$ 240 A$ 200 A$ 160 A$ 120 A$ ...
Timeline 30 September 2001 30 September 2003 30 September 2002 A$ 400 A$ 360 A$ 320 A$ 280 A$ 240 A$ 200 A$ 160 A$ 120 A$ ...
How the Losses were Concealed <ul><li>The practice of concealing losses by the Traders started in September 2001, and pote...
How the Losses were Concealed <ul><li>The Operations Division started the process of checking transactions at about 9:00am...
What Happened Next <ul><li>The impact on risk:  As the currency options desk’s losses increased from 1 September 2003, exp...
What Went Wrong <ul><li>The investigation revealed critical weakness in three areas related to the losses; </li></ul><ul><...
Operational Risk Management is a Journey - Not a Destination
Basel’s Three Pillars <ul><li>Pillar 1 </li></ul><ul><li>Measurement & Calculation of Credit Risk, Market Risk & Operation...
Definition - Operational Risk “ Operational Risk  is defined as the risk of loss resulting from inadequate or failed inter...
Operational Risk According to a recent poll*, 70 per cent financial institutions believe that they'll have sound operation...
The Basel II Options Basic Indicator Approach Risk Management Measurement Approach 15% of 3 years average gross income Gro...
What Basel II Requires <ul><li>Not only  capital reserve requirements based on historic and expected loss data </li></ul><...
Two Quotations <ul><li>“ A quantitative approach to operational risk management is not the ultimate solution. … critically...
What are the Operational Risks? <ul><li>Internal fraud </li></ul><ul><li>External fraud </li></ul><ul><li>Employment pract...
Causes & Consequences
How is Risk Assessed and Managed?   Identification of Risk Risk Assessment Risk Mitigation Risk Management & Monitoring
Risk Analysis Prioritization Measurement Identification Risk Assessment Share or Transfer It Control It Diversify or Avoid...
Managing Operational Risk <ul><li>Acceptance </li></ul><ul><li>Transfer </li></ul><ul><li>Controls </li></ul>
The “How”  <ul><li>Quantitative </li></ul><ul><ul><li>VAR </li></ul></ul><ul><ul><li>Statistics </li></ul></ul><ul><li>Qua...
Operational Risk Standards Publication Published by Date “ Sound Practices for the Management and Supervision of Operation...
Identifying and Assessing Operational Risk <ul><li>Environmental Survey </li></ul><ul><li>Technology Inventory </li></ul><...
Environmental Survey <ul><li>Provides an enterprise level view of resources, physical locations, hardware and software con...
Technology Inventory <ul><li>Provides a detailed record of an institution's technology resources, including Hardware, Soft...
Risk Assessment <ul><li>Self Assessment </li></ul><ul><ul><li>Bottom-up approach </li></ul></ul><ul><ul><li>Focus on busin...
Scorecard
Mapping Risks to Controls <ul><li>Understand </li></ul><ul><ul><li>Risks, Goals, Priorities  </li></ul></ul><ul><li>Establ...
The Effect of Risk Mitigation US Naval Aviation Mishap Rate 1950 - 1996 Fiscal Year 0 10 20 30 40 50 60 50 65 80 96 Class ...
The Solutions Basel II Operations Risk Model External Inputs Assessment Standards Definitions Regulator Operations Risk Ma...
What Went Wrong <ul><li>The investigation revealed critical weakness in three areas related to the losses; </li></ul><ul><...
Integrity of People <ul><li>The Traders initially misstated profits and losses by ‘smoothing’, but this developed into usi...
Risk and Control Framework <ul><li>Lack of adequate supervision </li></ul><ul><li>Risk management failed </li></ul><ul><li...
Governance   and Culture <ul><li>Board oversight  – the Principal Board received bad risk management information that was ...
Governance and Culture <ul><li>CIB management  – was aware of significant limit breaches and failed to investigate and tak...
The Conclusions “…  the culture fostered the environment that provided the opportunity for the Traders to incur losses, co...
Thank You
Upcoming SlideShare
Loading in...5
×

Basel Ii Opps Risk How To Lose $360 Million Nov 2005

362

Published on

Published in: Business, Technology
0 Comments
1 Like
Statistics
Notes
  • Be the first to comment

No Downloads
Views
Total Views
362
On Slideshare
0
From Embeds
0
Number of Embeds
1
Actions
Shares
0
Downloads
0
Comments
0
Likes
1
Embeds 0
No embeds

No notes for slide

Transcript of "Basel Ii Opps Risk How To Lose $360 Million Nov 2005"

  1. 1. How to lose $ 360 Million A Case Study in Operational Risk Richard Barr & Stanley Epstein Principal Associates
  2. 2. Definition - Operational Risk “ Operational Risk is defined as the risk of loss resulting from inadequate or failed internal processes, people and systems or from external events.” Basel II
  3. 3. Case Study In January 2004 the National Australia Bank announced that it had suffered a A$360 million foreign exchange loss* *Based on the results of PricewaterhouseCoopers’ subsequent investigation
  4. 4. The Facts <ul><li>Amount of the losses: The final figure was A$360 million. The losses were calculated by the National and announced during January 2004. </li></ul><ul><li>Traders involved: Four National staff were involved in the currency options trading that led to the losses. We refer to them as the Traders. They were supervised by the Joint Head of Global Foreign Exchange. </li></ul><ul><li>How the losses occurred: The Traders’ activities were contrary to the National’s strategy. The risk exposure of the currency options desk to the US dollar increased significantly in late 2003. This exposure resulted in significant losses when the US dollar fell by some ten cents against the Australian dollar. </li></ul>
  5. 5. Timeline 30 September 2001 30 September 2003 30 September 2002 A$ 400 A$ 360 A$ 320 A$ 280 A$ 240 A$ 200 A$ 160 A$ 120 A$ 80 A$ 40 Million Losses At 30 September 2001 Value of the currency options portfolio was overstated by approximately A$4 million .
  6. 6. Timeline 30 September 2001 30 September 2003 30 September 2002 A$ 400 A$ 360 A$ 320 A$ 280 A$ 240 A$ 200 A$ 160 A$ 120 A$ 80 A$ 40 Million Losses <ul><ul><li>At 30 September 2002 </li></ul></ul><ul><ul><li>Overstatement was approximately A$8 million. </li></ul></ul><ul><ul><li>Overstatements were concealed by false transactions. </li></ul></ul>
  7. 7. Timeline 30 September 2001 30 September 2003 30 September 2002 A$ 400 A$ 360 A$ 320 A$ 280 A$ 240 A$ 200 A$ 160 A$ 120 A$ 80 A$ 40 Million Losses <ul><ul><li>During Financial Year to 30 September 2003 </li></ul></ul><ul><ul><li>Currency options Traders regularly under and over reported </li></ul></ul><ul><ul><li>profits, concealing the desk’s true performance. </li></ul></ul>
  8. 8. Timeline 30 September 2001 30 September 2003 30 September 2002 A$ 400 A$ 360 A$ 320 A$ 280 A$ 240 A$ 200 A$ 160 A$ 120 A$ 80 A$ 40 Million Losses During September 2003 New transactions greatly increased the National’s exposure to the weakening US dollar. The Traders incurred losses of A$35 million in September 2003 This was concealed by false transactions. Enabled them to achieve an apparent annual profit of A$37 million, overstating the cumulative position by approximately A$42 million.
  9. 9. Timeline 30 September 2001 30 September 2003 30 September 2002 A$ 400 A$ 360 A$ 320 A$ 280 A$ 240 A$ 200 A$ 160 A$ 120 A$ 80 A$ 40 Million Losses October, November and December 2003 Traders continued to exceed risk limits and falsify the true position. Growing exposures, combined with the falling US dollar, increased the 31 December overstatement of the value of the currency options portfolio to A$92 million.
  10. 10. Timeline 30 September 2001 30 September 2003 30 September 2002 A$ 400 A$ 360 A$ 320 A$ 280 A$ 240 A$ 200 A$ 160 A$ 120 A$ 80 A$ 40 Million Losses By the 12th of January 2004 False transactions with a reported value of A$185 million were included in Horizon (the currency options trading and processing system),
  11. 11. Timeline 30 September 2001 30 September 2003 30 September 2002 A$ 400 A$ 360 A$ 320 A$ 280 A$ 240 A$ 200 A$ 160 A$ 120 A$ 80 A$ 40 Million Losses 13 January 2004 National made the first announcement of the losses, then estimated at A$180 million.
  12. 12. Timeline 30 September 2001 30 September 2003 30 September 2002 A$ 400 A$ 360 A$ 320 A$ 280 A$ 240 A$ 200 A$ 160 A$ 120 A$ 80 A$ 40 Million Losses 27 January 2004 27 of January 2004 After adjusting for a revaluation of the portfolio, total losses of A$360 million were announced.
  13. 13. Timeline 30 September 2001 30 September 2003 30 September 2002 A$ 400 A$ 360 A$ 320 A$ 280 A$ 240 A$ 200 A$ 160 A$ 120 A$ 80 A$ 40 Million Losses 27 January 2004 How the losses grew
  14. 14. How the Losses were Concealed <ul><li>The practice of concealing losses by the Traders started in September 2001, and potentially earlier. </li></ul><ul><li>Initially, by using incorrect dealing rates for genuine transactions, the Traders shifted profits and losses from one day to another. They called this ‘smoothing’. </li></ul><ul><li>Later they processed false spot foreign exchange and false currency option transactions to conceal trading losses. </li></ul><ul><li>The Traders entered false transactions in Horizon just before the end-of-day close, at about 8:00am the next morning. Entries in Horizon were the basis for profits and losses included in the general ledger from which financial reports are prepared. </li></ul>
  15. 15. How the Losses were Concealed <ul><li>The Operations Division started the process of checking transactions at about 9:00am each day </li></ul><ul><li>Between 8:00am and 9:00am, referred to as the ‘one-hour window’, the Traders were able to amend the incorrect deal rates and reverse the false transactions in Horizon to prevent their detection by the checking process . It appears that the Traders discovered this ‘window’ accidentally during 2000. </li></ul><ul><li>In October 2003, the Traders identified that the back office had stopped checking internal option transactions . This provided them with the third method of concealment – entering undetected, one-sided internal currency option transactions. </li></ul><ul><li>As a consequence of meeting profit targets in 2003, the Traders received bonuses ranging from A$120,000 to A$265,000. Some of the Traders also received bonuses for 2001 and 2002. </li></ul>
  16. 16. What Happened Next <ul><li>The impact on risk: As the currency options desk’s losses increased from 1 September 2003, exposures grew larger and riskier. Although the Traders partly obscured the position by the false option transactions, many limit breaches were identified, reported and approved. </li></ul><ul><li>VaR limits were breached throughout 2003 and approved by the supervisor. Other option risk limit breaches such as vega were routinely approved by him. The number of breaches grew significantly in late 2003 and in January 2004. </li></ul><ul><li>Who discovered the losses and how: In early January 2004, a currency options desk employee raised concerns about substantial losses included in the currency options portfolio, with another currency options desk employee. Others, including an analyst attached to the desk, then inquired further over the next few days and discussed the losses with the supervisor. Senior management was informed on 12 January 2004 and the National suspended the Traders on 13 January 2004. </li></ul>
  17. 17. What Went Wrong <ul><li>The investigation revealed critical weakness in three areas related to the losses; </li></ul><ul><ul><li>Integrity of people </li></ul></ul><ul><ul><li>Risk and control framework </li></ul></ul><ul><ul><li>Governance and culture </li></ul></ul><ul><li>There was a failure in the management of Operational Risk </li></ul><ul><li>Before we conclude our story, we are going to take a short trip into Operational Risk, what it is and how to mitigate it </li></ul>
  18. 18. Operational Risk Management is a Journey - Not a Destination
  19. 19. Basel’s Three Pillars <ul><li>Pillar 1 </li></ul><ul><li>Measurement & Calculation of Credit Risk, Market Risk & Operational Risk </li></ul><ul><li>This determines the minimum capital the bank must hold </li></ul><ul><li>Pillar 2 </li></ul><ul><li>Supervisory review process allowing Bank Supervisors to require more capital than calculated </li></ul><ul><li>Pillar 3 </li></ul><ul><li>Disclosure to Financial Markets </li></ul><ul><li>The greater the reliance on internal methods the greater is the Transparency requirement </li></ul>
  20. 20. Definition - Operational Risk “ Operational Risk is defined as the risk of loss resulting from inadequate or failed internal processes, people and systems or from external events.” Basel II
  21. 21. Operational Risk According to a recent poll*, 70 per cent financial institutions believe that they'll have sound operational risk management in place by the magic Basel II date of January 2007. The same poll, however, also indicates that 83 per cent of these same financial institutions still are pretty unclear of just what operational risk is, much less how to manage it. * Fitch, June 2004
  22. 22. The Basel II Options Basic Indicator Approach Risk Management Measurement Approach 15% of 3 years average gross income Gross income across 8 business lines – varying percentages Sum of expected loss and unexpected loss Gross Income Data Sound Practices for the Management and Supervision of Operational Risk Operational Risk Data Gross Income Data Operational Risk Management System Operational Risk Data Operational Risk Management System Standardized Approach Advanced Measurement Approaches (AMA)
  23. 23. What Basel II Requires <ul><li>Not only capital reserve requirements based on historic and expected loss data </li></ul><ul><li>Is also the active mitigation of operations risk, which over time will effectively reduce the capital that a bank will have to reserve </li></ul>
  24. 24. Two Quotations <ul><li>“ A quantitative approach to operational risk management is not the ultimate solution. … critically important is the implementation of an effective qualitative process of identifying, measuring, managing and controlling operational risk.” </li></ul><ul><li>“ Since operational risk will affect credit ratings, share prices and organizational reputation, analysts will increasingly include it in their assessment of the management, their strategy and the expected long-term performance of the business.” </li></ul>
  25. 25. What are the Operational Risks? <ul><li>Internal fraud </li></ul><ul><li>External fraud </li></ul><ul><li>Employment practices and workplace safety </li></ul><ul><li>Clients, products and business practices </li></ul><ul><li>Damage to physical assets </li></ul><ul><li>Execution, delivery and process management </li></ul><ul><li>Business disruption and system failures </li></ul>
  26. 26. Causes & Consequences
  27. 27. How is Risk Assessed and Managed? Identification of Risk Risk Assessment Risk Mitigation Risk Management & Monitoring
  28. 28. Risk Analysis Prioritization Measurement Identification Risk Assessment Share or Transfer It Control It Diversify or Avoid It Risk Management Activity Level Process Level Entity Level Risk Monitoring
  29. 29. Managing Operational Risk <ul><li>Acceptance </li></ul><ul><li>Transfer </li></ul><ul><li>Controls </li></ul>
  30. 30. The “How” <ul><li>Quantitative </li></ul><ul><ul><li>VAR </li></ul></ul><ul><ul><li>Statistics </li></ul></ul><ul><li>Qualitative </li></ul><ul><ul><li>Identify </li></ul></ul><ul><ul><li>Measure </li></ul></ul><ul><ul><li>Manage </li></ul></ul><ul><ul><li>Control </li></ul></ul>
  31. 31. Operational Risk Standards Publication Published by Date “ Sound Practices for the Management and Supervision of Operational Risk” Basel Committee on Banking Supervision February 2003 “ A framework for Internal Control Systems in Banking Organizations” Basel Committee on Banking Supervision September 1998 “ Internal Audits in Banks and the Supervisors Relationship with Auditors” Basel Committee on Banking Supervision August 2002 “ Compliance and the compliance function in banks” Basel Committee on Banking Supervision April 2005 “ Consolidated KYC Risk Management” Basel Committee on Banking Supervision October 2004 “ Risk management principles for electronic banking” Basel Committee on Banking Supervision July 2003 “ Management and Supervision of Cross-Border Electronic Banking Activities” Basel Committee on Banking Supervision July 2003
  32. 32. Identifying and Assessing Operational Risk <ul><li>Environmental Survey </li></ul><ul><li>Technology Inventory </li></ul><ul><li>Risk Assessment </li></ul>
  33. 33. Environmental Survey <ul><li>Provides an enterprise level view of resources, physical locations, hardware and software configurations, interfaces </li></ul>
  34. 34. Technology Inventory <ul><li>Provides a detailed record of an institution's technology resources, including Hardware, Software, Network components and topology, and Media </li></ul>
  35. 35. Risk Assessment <ul><li>Self Assessment </li></ul><ul><ul><li>Bottom-up approach </li></ul></ul><ul><ul><li>Focus on business unit insights into risk </li></ul></ul><ul><ul><li>Integrates whole organization </li></ul></ul><ul><li>Key Risk Indicators </li></ul><ul><ul><li>Top-level approach </li></ul></ul><ul><ul><li>Drill-down to trouble spots </li></ul></ul><ul><li>Risk Mapping </li></ul><ul><ul><li>Derived from aggregated internal data </li></ul></ul><ul><ul><li>Provide a top-level risk profile </li></ul></ul><ul><li>Scorecards </li></ul><ul><ul><li>Means of translating qualitative assessments into quantitative metrics </li></ul></ul><ul><li>All four approaches are often used in combination </li></ul>
  36. 36. Scorecard
  37. 37. Mapping Risks to Controls <ul><li>Understand </li></ul><ul><ul><li>Risks, Goals, Priorities </li></ul></ul><ul><li>Establish </li></ul><ul><ul><li>Risk Management Responsibilities </li></ul></ul><ul><ul><li>Establish responsibilities for Governance and Stewardship activities: Design, Monitoring, Disclosure, and Coordination with Compliance </li></ul></ul><ul><li>Map Risk Strategies to Control Categories </li></ul><ul><li>Design & Document Specific Controls </li></ul><ul><li>Implement Controls </li></ul><ul><ul><li>Activities </li></ul></ul><ul><ul><li>Functional Responsibilities </li></ul></ul><ul><ul><li>Staff Training </li></ul></ul>
  38. 38. The Effect of Risk Mitigation US Naval Aviation Mishap Rate 1950 - 1996 Fiscal Year 0 10 20 30 40 50 60 50 65 80 96 Class A Mishaps/100,000 Flight Hours From Tony Ciavarelli: ORRT Presentation 5/2005 Data Source: Atlas of Injuries in the U.S. Armed Forces Angled Carrier Decks Naval Aviation Safety Center NAMP est. 1959 RAG concept initiated NATOPS initiated 1961 Squadron Safety program 776 aircraft destroyed in 1954 39 aircraft destroyed in 1996
  39. 39. The Solutions Basel II Operations Risk Model External Inputs Assessment Standards Definitions Regulator Operations Risk Management Risk Reduction Capital Reservation Internal Inputs Operations Operations Operations Operations Operations Policy Empower Risk Model Bank Board Loss Data Feedback Systems (i.e. Data Mining, Calculations) Risk Mitigation (i.e. Policies, Procedures) Risk Management Tools
  40. 40. What Went Wrong <ul><li>The investigation revealed critical weakness in three areas related to the losses; </li></ul><ul><ul><li>Integrity of people </li></ul></ul><ul><ul><li>Risk and control framework </li></ul></ul><ul><ul><li>Governance and culture </li></ul></ul><ul><li>Now, back to our story …….. </li></ul>
  41. 41. Integrity of People <ul><li>The Traders initially misstated profits and losses by ‘smoothing’, but this developed into using false transactions to conceal significant losses. They did not behave honestly and it can only be assumed that they believed they would earn enough profit in the future to recover the concealed losses. </li></ul>
  42. 42. Risk and Control Framework <ul><li>Lack of adequate supervision </li></ul><ul><li>Risk management failed </li></ul><ul><li>Absence of financial controls </li></ul><ul><li>Gaps in back office procedures </li></ul>
  43. 43. Governance and Culture <ul><li>Board oversight – the Principal Board received bad risk management information that was incorrect, incomplete or insufficiently detailed to alert them to limit breaches or other matters related to the currency options desk’s operations </li></ul><ul><li>Principal Board Audit Committee (PBAC) – reviewed a number of reports from a range of internal and external parties that did not alert them directly to any issues in respect of currency options. After reading the supporting papers, probing of management may have revealed the seriousness of some of the control breakdowns </li></ul><ul><li>Principal Board Risk Committee (PBRC) – the first meeting of the PBRC in November 2003 was not informed of the currency options desk’s risk limit breaches, but was reassured that the Markets Division as a whole was well within VaR limits </li></ul><ul><li>Group Executive Forum, Group Risk Forum and Central Risk Management Committee – there was no evidence of escalation of issues relating to the currency options desk to these groups </li></ul>
  44. 44. Governance and Culture <ul><li>CIB management – was aware of significant limit breaches and failed to investigate and take action. CIB management had little confidence in the VaR numbers due to systems and data issues, and effectively ignored VaR and other limit breaches. There was no sense of urgency in resolving the VaR calculation issues which had been a problem for a period of two or more years </li></ul><ul><li>Risk management – MR&PC raised warnings about the currency options desk’s limit breaches and other exceptions. These warnings were not escalated to the CEO or the Board </li></ul><ul><li>Internal Audit – reported on significant currency options issues, but failed to follow up and ensure that appropriate controls and procedure changes had been implemented </li></ul><ul><li>The National’s culture – there was an excessive focus on process, documentation and procedure manuals rather than on understanding the substance of issues, taking responsibility and resolving matters. In addition, there was an arrogance in dealing with warning signs (i.e. APRA letters, market comments etc). The investigation revealed that management had a tendency to ‘pass on’, rather than assume, responsibility. Similarly, issues were not escalated to the Board and its committees and bad news was suppressed </li></ul>
  45. 45. The Conclusions “… the culture fostered the environment that provided the opportunity for the Traders to incur losses, conceal them and escape detection despite ample warning signs. This enabled them to operate unchecked and flout the rules and standards of the National. Ultimately, the Board and the CEO must accept responsibility for the ‘tone at the top’ and the culture that exists in certain parts of the National” PricewaterhouseCoopers
  46. 46. Thank You

×