Operational Risk – a wave of internal, external and portfolio fraud

It is probably a sign of the times that these cases are coming to light. Fraud thrives in boom times but rarely gets reported. Ponzi-like schemes, where old investors are paid off with the deposits of new investors, succeeds when returns are high and there are lots of investors. It is only when the incoming investments dry up that the schemes unravel. And how many trader frauds have been undiscovered (or hidden) because the booming markets have allowed the positions to be recovered in profit? Again it is only in falling markets that recovering positions is impossible and the frauds have to be revealed.

Basel II is pretty clear about the need to allow for internal and external frauds in risk management and capital considerations. But to date controls appear to concentrate on small-scale events – forged signatures, siphoning off of retail deposits, wilfully violating trading limits, cheque or draft forgery, bribery, etc. All serious offences and ones that, if unchecked, can impact a firm’s profitability and reputation.

But major internal fraud is rarely discovered by the risk management process – usually it come to light when the fraudster is absent through sickness or holiday and a replacement starts handling the accounts. Or when the losses are so large they can no longer be hidden. Banks have fraud departments, internal auditors and risk managers – the first only get called in when a fraud is suspected, the second can be handled by the fraudster as inspections are at regular times – so where does that leave the risk manager? Does he have the right to analyse performance and investigate any abnormally successful individuals? Even if he had the right, that could be a career limiting activity as the fraudster is usually hidden in a galaxy on company stars!

And who calculates the fraud risk of external investment – the risk that a portfolio investment can be destroyed by fraud on the part of the recipient of the investment? Risk managers are obliged to identify, assess, report and mitigate. Was this ever done on behalf of investments in Madoff funds or in Stanford International Bank? Was this even considered part of the operational risk manager’s role?

Questions, always questions, but they must be answered and standards agreed if this wave of fraud is not to become a flood.