“Rogue” trading exposes poor management

The importance of developing a risk management culture and infrastructure in today’s complex markets cannot be overstated. UBS Bank found it the hard way, on the back of a $2 billion-plus loss, but put the spotlight on the importance of managing a complex trading operation, and the need for developing a robust risk management system.

“Risk is part of any business and particularly financial businesses; firms need to manage risk just like they manage profits, customer relations or any other part of the business,” said Thomas S. Coleman, author of A Practical Guide to Risk Management, at a recent CFA Institute webinar titled “Risk Management and the Rogue Trader”.

Managing risk, he said, cannot be separated from the rest of the business and good managers have always known this. The tools and technique for understanding and measuring risk have increased in complexity and sophistication, but the fact that “risk management is the responsibility of anybody who contributes to the profits of a firm” has remained constant.

This is a radical departure from the conventional view of risk management as a separate department not reporting to line managers. “Managers think just because the bank has a risk management department, managing risk is no longer their responsibility…that would be a huge mistake,” said Coleman. “Managing risk requires that the managers understand the risks they are undertaking and act to manage those risks.”

That responsibility rests squarely on the shoulders of those who run the business and cannot be delegated to any risk management department, he added.

Coleman says it all comes down to people. “[Managing risk] is as much the art of managing people, processes and institutions as it is the science of measuring and quantifying risk,” he said. “Trading disasters occur not because a computer spits out the wrong number, but because some person takes those numbers, or behaves improperly, and makes a bad decision.”

The solution, he asserted, is building a robust organization with incentive schemes designed around a “carrot and stick” approach. “More than anything, risk management means building a flexible and robust organization; unexpected and extreme events are really the hardest things to deal with,” he said. “They are the least susceptible to mathematical modelling, yet [they] are the most dangerous [and] can cause the most damage.”

Building a flexible organization with people who can manage the unexpected must be the ultimate goal of risk management.

Risk management is not just controlling the down side, but also the up side. “It’s about making the tactical and strategic decisions to control those risks that should be controlled but also to exploit the opportunities that can be exploited.”

Effective risk management requires a balance between the old-fashioned judgment and experience and understanding and employing quantitative tools. “Managers nowadays need to upgrade their skills so they’re comfortable using [quantitative risk tools such as] volatility, value at risk and contribution to risk.”

Managing risk and uncertainty call for out-of-the-box thinking, said Coleman. “To understand, appreciate and work with risk, we have to move away from the rigid fixed thinking and consider alternatives; we must give up any illusion that there is certainty in this world and embrace the future as fluid, changeable and contingent.”

Rogue trading

Most instances of so-called “rogue trading”—Coleman prefers the term “trading losses”—are not acts of malfeasance. “They are often triggered by errors, mistakes or bad luck which a trader subsequently tried to hide [to keep their reputation and job]; it simply reinforces the idea that risk management is, in fact, management.”

Trading loss events serve as reminders that bad things do happen and allow managers to learn from mistakes. Coleman contends that whether due to fraud or incompetence, “trading losses are due to bad management, not [necessarily] fraudulent trading.

“It doesn’t make the losses any less painful, but it does point us in the direction to protect against such problems.”

All told, the primary and overall lesson is that “risk management, plain and simple, requires good management; [that] managers absolutely need to know, understand and effectively manage the business.”

Good operational infrastructure is necessary to catch mistakes and flag exceptions and do so in early stages. And good infrastructure is “a combination of good people, good processes and procedures and good IT system.”

Read: Heads roll at UBS