Operational Risk – the old rules are still the best rules!

The FSA contacted 50 of the largest trading banks in London and asked them what reviews they had carried out following the SG incident, and they are using this edition to highlight the checks that all firms should be carrying out. This is not formal rules or guidance (yet) but a series of discussion questions incorporating lessons from the SG and previous “rogue trader” incidents.

Among the many risk to be monitored, Market Watch highlights front office culture and governance, in particular are traders encouraged to take two-week continuous holidays, segregation of front office staff from middle and back office functions, usage of suspense accounts, management information and password control.

For the FSA to make the above comments must show that it is the 80 year old risks that are still causing problems, that these old risks are still not being managed, and that, under the pressure of making profits, it is these old controls that are the first to be pushed aside. A sad admission.

Segregating the trader from the limits checkers from the settlement processors has been one of the standard rules since markets started to be regulated in the 1930s. One of the first checks that internal auditors were instructed to make in any system was to monitor all traffic through suspense accounts – in my experience this has hidden foreign currency control violations, money laundering and concealment of losses before a bonus trigger date. And I had assumed that every finance director in the world received a report on who was not taking holidays, who never took more than a week’s holiday and who never took holidays over month or year-end dates. Elementary!

Maybe it is time we stopped developing ever more complex operational risk models and simply brought back all the retired, ex-military, compliance and internal audit officers and gave them big sticks! They have the experience, the intuition and don’t care about career advancement. It will be cheaper and more effective than employing yet another quantitative operational risk management guru!