UBS: Our Risk Systems Did Detect $2bn Rogue Trader

A few weeks ago, UBS employee Kweku Adoboli (universally described as a "rogue trader") ran up a $2 billion loss for his employer; many readers wondered how it is the systems which allow trades to happen at all aren't better tuned to catch such massive cash flows without triggering alerts. Now, reader DMandPenfold submits a report from Computerworld UK in which the bank claims that such triggers were in place — they were simply not acted on. From the article: "UBS has insisted its IT systems did detect unusual and unauthorised trading activity, Interim chief executive Sergio Ermotti, who is running the company following Oswald Grubel's resignation last month, sent a memo to employees saying the bank is aware that its systems did detect the rogue activity. In the memo, Ermotti wrote: 'Our internal investigation indicates that risk and operational systems did detect unauthorised or unexplained activity but this was not sufficiently investigated nor was appropriate action taken to ensure existing controls were enforced.'"

Comments

What was the security protocol?

[Moheeheeko]

Hey......dont do that.

Re:What was the security protocol?

[blair1q]

I thought it was rather odd that they had nothing in place to detect this. And odder that the CEO was okay with that.

So here's the next question: if UBS lost $2e9, to whom did they lose it? Have the counterparties been identified, and do those identities still exist?

Re:What was the security protocol?

[SydShamino]

It's hard to say that the money was "lost to" anyone. They bought a security at a given price, so other people sold them at that price, yes. Later, the value of the security went down. Unless the people who sold them knew that the price was going to fall, those people did nothing wrong. (And if they did know and were acting on insider information, then that's a completely separated, basically unrelated crime.)

In the last year I've sold stock whose value subsequently went down, so as far as I know I took some of their money. Stock transactions are anonymous, and I don't know in what the rogue trader invested.

Re:What was the security protocol?

[FooAtWFU]

If you could identify these counterparties, what standing would UBS have to ask for their money back?

I mean, I bought some stocks and the market crashed. Can I go to the prior owner and get my money back? Somehow I think not.

Re:What was the security protocol?

[perlchild]

They detected him
They let him run 2 billion in bad trades
They didn't honeypot him
They didn't stop him at a lower amount...

This is supposed to be good how?

Re:What was the security protocol?

[Anne Thwacks]

The entire derivativves trading system is a giant Ponzi scheme - the value of fees charged by bankers for trading in derivatives based on on changes in the value of a security exceeds the value of the underlying security over a relatively short time. (it is MINUTES for gold!)

Someone then "looses" a great deal of money. In reality, the "missing" money has already been paid out in commissions to banks for trading - and "bonuses" for traders. (Anyone who understands differential equations can see that vastly more money is paid out to bankers than is actually invested in stocks and bonds, and the banks are sucking the life blood from the world's economic system).

You might ask "Why do people invest in such an obvious Ponzi scheme?" The answer is "Institutional investors do not care about the long term, and are quite happy to feed the system, so long as they get a percentage, and a "plausible deniability" get out clause when it goes wrong. (Why did people give all their money to someone who "Madoff" with it?

Why did the bank not stop him? Because prior to catastophic disaster, he seemed to be "on a roll", and was winning more than he was losing. Banks do not employ people who understand differential equations in a management role, and most bank directors have only a marginal grip on reality. They say "ooh, profit!" like Homer Simpson and doughnuts.

Re:What was the security protocol?

[Hatta]

If you're making money, no one cares about security protocols.

Re:What was the security protocol?

[Genda]

"You need to understand that everyone is rogue trading these days, and a 2 billion dollar loss hardly even rings a bell around here anymore. I mean if we don't smoke half a trillion, I can't get anybody's attention but the janitor!" -- The Security Manager

Re:What was the security protocol?

[Znork]

Yes, isn't it odd that we're only hearing about cases where 'rogue traders' lose money? Out of the group capable of bypassing the systems one would expect at least a few to be bright enough to actually make a couple of billions.

Of course, one would assume that those probably get a fat bonus and a promotion, which indicates a culture where acting outside the rules is accepted behaviour as long as money is made.

The day we see the headline 'Rogue trader arrested for making $2bn for employer' we'll know that the banks are actually taking security seriously. Until then, everyone, including their employees, will know that it's not gambling with other peoples money that's the problem, it's losing.

Re:What was the security protocol?

[David Greene]

This kind of thing happens all the time in any organized group of people. Procedures and policies get extablished and promptly ignored. I, for one, appreciate the UBS is being up-front about it.

Re:What was the security protocol?

[kraut]

The entire derivativves trading system is a giant Ponzi scheme

I don't think you quite understand what a Ponzi scheme is, but derivatives certainly aren't one.

the value of fees charged by bankers for trading in derivatives based on on changes in the value of a security exceeds the value of the underlying security over a relatively short time. (it is MINUTES for gold!)

Investing in gold is arguable more like a ponzi scheme than derivatives are. Gold has no intrinsic value, and provides you no income - it only has a value if you can find some other sucker that buys it off you. Hopefully for more than you paid. Or not. Oops.

Someone then "looses" a great deal of money. In reality, the "missing" money has already been paid out in commissions to banks for trading - and "bonuses" for traders. (Anyone who understands differential equations can see that vastly more money is paid out to bankers than is actually invested in stocks and bonds, and the banks are sucking the life blood from the world's economic system).

Differential equations are wonderful, and it's great you understand them, but clearly they're not that useful for calculating percentages.

You might also want to investigate concepts such as hedging, realised and unrealised PnL (Profit and Loss), and what happens to your PnL when it turns out that your hedge was made up. It's not difficult compared to differential equations.

But why let facts and understanding get in the way of a good rant, eh? ... snip...

"Institutional investors do not care about the long term, and are quite happy to feed the system, so long as they get a percentage, and a "plausible deniability" get out clause when it goes wrong.

Institutional Investors like pension funds don't care about the long term? Okay, we're not talking long term like millenium clock long tern, but actually they do care very much about the long term.

They also care very much about the short term because individual investors care about the short term, and will take their money out and put it elsewhere if an institution has a couple of quarters where it does badly.

Plausible deniability - or more precisely, CYA (Cover Your Ar....) is, of course, extremely important.

Why did people give all their money to someone who "Madoff" with it?

Because he consistently, over decades, paid out an outstanding, reliable return on their money, and it was actually quite hard for an unsophisticated investor to understand why that wasn't kosher.

Better questions are: Why did professional investor invest with him? (answer: A lot of smart ones did not!) Why didn't the regulators act on the numerous tip offs?

Why did the bank not stop him? Because prior to catastophic disaster, he seemed to be "on a roll", and was winning more than he was losing.

No, because to the risk management system it looked like he was flat risk. He wasn't "making" anywhere near the amount of money that he later lost.... and it looked like he was well hedged. The flaw was that the system didn't spot that the hedges were fake.

Banks do not employ people who understand differential equations in a management role

I'm quite sure that retail banks rarely do that, but you underestimate investment banks. Where do you think all those really bright physicists end up - there are only so many jobs at CERN et. al.

and most bank directors have only a marginal grip on reality.

There are a lot of psychopaths, and the concentration increases the higher you go. That's probably true of a lot of organisations, but is a particularly pronounced effect in investment banks. That, and their incentives are misaligned.

Re:What was the security protocol?

[blair1q]

it depends. If they were insiders of some sort and knew that they were getting a highly leveraged profit from an improper trade, then they would owe UBS every nickel, and the state years of hard time.

Re:What was the security protocol?

[blair1q]

And by up-front you mean since they caught the CEO not being up-front and are now hanging him by his neck over the crowd and being up-front about what really happened that was covered up the first time they stood in front of that crowd.

Re:What was the security protocol?

[Anonymous Coward]

It shows their commitment to "diversity". You don't want to risk offending anyone by "oppressing" the diversity hire, do you? He's like the Ft. Hood shooter, completely uncontrolled until it's too late.

Re:What was the security protocol?

[smellotron]

Out of the group capable of bypassing the systems one would expect at least a few to be lucky enough to actually make a couple of billions.

FTFY. This guy was trading so-called "delta 1" derivatives, meaning he was expected to be leveraged and hedged. The hedge gives you smaller—but more consistent—profits and losses, meaning you live to fight another day.

Re:What was the security protocol?

[Anne Thwacks]

But why let facts and understanding get in the way of a good rant, eh?

You must be new here!

Ok, so I had a little too much brandy, and not enoughy coffee when I wrote that. I can't expect to post a whole book in one /. posting.

However, you might want to look at the system as a whole - sure pension funds like to report good long term results, but they try to do it by the same fashionable "high speed trading" as everyone else does: They don't buy X because its intrinsive value will go up over time (like C18th people would buy shares in a tea clipper voyage at increased prices as the tea gets nearer to sale), they bet on X going up or down couple of points in the next 30mS. My point is they are betting someone else's money for a percentage, whether the bet wins or loses and like Madoff, they pay a good divi till they crash - then a scapegoat is found in the time-honoured tradition.

To make it clear: I am not suggesting that any single person or corporation is doing this in a deliberately corrupt manner - what I am saying is that - while I accept that hedging can perform a useful function) a system where the money invested in derivatives exceeds the money invested in productive activity (like farming and manufacturing) by several orders of magnitude is inherently unstable as well as unproductive, and the only beneficiaries in the long term are the traders and banks. Society as a whole loses on a catastrophic scale, because there is no investment in building homes, growing food, or manufacturing enduring products (see UK papers for an example). (Greece and Ireland have marginally different - and much more severe - problems).

Why would they?

[Anonymous Coward]

Tax payer funded bailouts are far more profitible the sound management or ethics.

According to the computer ...

[Smallpond]

It can only be attributable to human error.

Re:According to the computer ...

[Anonymous Coward]

The IT department was saying this. So in this case, they're saying it can only be attributed to inferior human error. Have you not talked with your IT department lately?

Re:According to the computer ...

[TheLink]

The other explanation is they were hoping the trader would make money, in which case everyone would share the profits etc.

He lost money so he's a rogue trader.

Re:According to the computer ...

[Palshife]

Traders who make $2 billion in rogue trades are called Managing Directors.

Re:According to the computer ...

[Anonymous Coward]

Thurston Howell III said, "Hey Bob, just got a red flag that Kweku Adoboli just bet the bank on the price of onions in India."

Bob replied, "Take it easy Magoo, if it works we get 50%, if it blows he's rogue."

Reminds me of the cops eating donuts

[Anonymous Coward]

Sure we saw the murder, but we were busy chowing down!

Called it

[CharlyFoxtrot]

From my comment on the original article :

"Let's face out out on the terrain no-one is holding these guys accountable. IT may set up the system, Risk Management may generate the reports and they'll be either modified to say what management wants to say or just plain ignored because like all gamblers these guys think they have a system which lets them keep on winning even as they are betting their house (or in this case our houses.)"

This "blame IT" crap has gone on long enough. It's time we stood up for ourselves instead of allowing ourselves to be used as a convenient scapegoat all the time.

Re:Called it

[Anonymous Coward]

Yep. It's been my observation when I previously worked in IT for a Fortune 500 company, that when these kinds of safeguards are ignored, it's because ignoring them has become SOP for the company management, who are more focused on increasing stock value and their own year-end bonuses than reigning in the reckless wheeling and dealing of the so-called "go-getters" within the company.

Re:Called it

[HornWumpus]

'Blame IT' is a shallow description of what happened. The original discussion was all about: 'didn't they have risk management in place?' Not: blame the IT guy that wrote the VAR report.

Sounds like they are blaming their risk officer (who should be the CFO or at least report to the CFO).

Re:Called it

[ackthpt]

From my comment on the original article :

"Let's face out out on the terrain no-one is holding these guys accountable. IT may set up the system, Risk Management may generate the reports and they'll be either modified to say what management wants to say or just plain ignored because like all gamblers these guys think they have a system which lets them keep on winning even as they are betting their house (or in this case our houses.)"

This "blame IT" crap has gone on long enough. It's time we stood up for ourselves instead of allowing ourselves to be used as a convenient scapegoat all the time.

How often have you seen an IT representative in front of the cameras say, "Well, we see this behaviour, the lights are flashing, the klaxons are going like a cat with its tail in a wringer, but the people who collect 7 figure salaries haven't been taking an interest so far."

Should be criminal charges for management negligence -- and I don't mean just giving the the sack. Those protesters on Wall Street have a point, everyone gets hurt when the bank CEOs screw up, but those most responsible. Thanks to their stalwart defenders in the US Congress no stronger regulation get passed. If that's not sign that government is in the bank's pockets, I can't imagine what could be more clear.

Re:Called it

[Wansu]

  Those protesters on Wall Street have a point, everyone gets hurt when the bank CEOs screw up, but those most responsible.

Herman Cain says it's the protester's faults if they don't have job. After all, this is 2011 and what the bankers did was in 2008.

Re:Called it

[FishOuttaWater]

We need the right amount of regulation. Enough that the game is played equitably but not so much that it is unplayable. I cringe every time there is some scandal like this because I know the next Sarbanes-Oxley overreaction is coming soon so congress can look like it cares.

Re:Called it

[operagost]

And Chewbacca is on Endor. That just doesn't make any sense.

Re:Called it

[Doc Ruby]

Actually, what Cain said yesterday was "Don't blame Wall Street, don't blame the big banks, if you don't have a job and you're not rich, blame yourself."

While it's arguable that not having a job is a person's own fault (a losing argument with the economy, but arguable), saying it's the fault of everyone not rich that they're not rich isn't just insane. It's the kind of institutional insanity that is driving the country into nothing but the madhouse, with a corporatocracy of Cains at the wheel.

Re:Called it

[Doc Ruby]

No, the logic of that post is perfectly clear. Someone says bank CEOs screwing up hurts everyone but those CEOs. Like people who have lost jobs, or can't get one, after bank CEO screwups destroyed the economy's growth, and the jobs with it. Herman Cain says it's the jobless person's own fault for not having a job - and even their own fault they're not rich. The contrast is that Cain says it isn't the bank CEO's fault people don't have jobs, it's their own fault.

But that's obvious. Except perhaps to a Republican, er "Libertarian", like you. Who spent the entire Bush era telling us Chewbacca was on Endor whenever people complained that deregulation was killing us.

Re:Called it

[AK Marc]

There's a class war in the US. The "conservatives" (not actually conservative, but self-label as such, so I'll use the tag they put on themselves) firmly believe that in the Land of Opportunity, the inability to succeed indicates a personal flaw, proving the person is inferior and deserves poor treatment. That's simply insane. I can't argue with it any more than someone who insists the sky is red. It's provably not true, but only if they will open their eyes and look at the facts, and that just doesn't happen.

Re:Called it

[GlobalEcho]

Actually in this case, the CEO resigned, and much of the rest of senior management involved has been also compelled to resign. The losses have been absorbed by the shareholders and employees of UBS, which is exactly as it should be.

The 2008 crisis was a completely different animal, and everybody should be angry the giant banks are relatively unchanged since then. But even then almost all the senior management of those organizations was kicked out.

Re:Called it

[ackthpt]

No, the logic of that post is perfectly clear. Someone says bank CEOs screwing up hurts everyone but those CEOs. Like people who have lost jobs, or can't get one, after bank CEO screwups destroyed the economy's growth, and the jobs with it. Herman Cain says it's the jobless person's own fault for not having a job - and even their own fault they're not rich. The contrast is that Cain says it isn't the bank CEO's fault people don't have jobs, it's their own fault.

But that's obvious. Except perhaps to a Republican, er "Libertarian", like you. Who spent the entire Bush era telling us Chewbacca was on Endor whenever people complained that deregulation was killing us.

I hadn't done any research on Cain, as I usually get anyone running for President a few months to flesh out their views and see whether they have a chance or not. The dumb ones usually implode, like Perry is currently doing. I was quite taken aback by the magnitude of profound stupidity of Herman Cain's statement - the man should stick to what he knows, slinging pizza.

Re:Called it

[Anonymous Coward]

Couple of points:

1. Having worked in exactly this area (for a competitor although I did work on the trading floor for this bank) in the past I can tell you that the risk department gets overridden if it comes in the way of making a "profit". i.e. if the parameters around the risk of a deal mean it is not practical then they are ignored on the basis that "if we don't do this deal someone else will". There is always a pissing contest because of Risk's decisions altering the reserves on trade P&L that in turn affects traders. Therefore they fight tooth and nail to override them.
2. I thought this is exactly the sort of thing Sarbannes-Oxley was created for.

Re:Called it

[AwesomeMcgee]

Resigned is a strong word for took his miillions in parachute and went home.

Re:Called it

[Anonymous Coward]

Sarbanes-Oxley is a US regulation. The trader was in London.

Re:Called it

[CharlyFoxtrot]

Sarbanes-Oxley is a US regulation. The trader was in London.

Banks in Europe certainly implemented SOX, they couldn't do business with the US if they hadn't, as well as the various Basel accords.

Re:Called it

[CharlyFoxtrot]

How often have you seen an IT representative in front of the cameras say, "Well, we see this behaviour, the lights are flashing, the klaxons are going like a cat with its tail in a wringer, but the people who collect 7 figure salaries haven't been taking an interest so far."

I'd love to see someone do that, they'd never work in the industry again though.

Should be criminal charges for management negligence -- and I don't mean just giving the the sack. Those protesters on Wall Street have a point, everyone gets hurt when the bank CEOs screw up, but those most responsible. Thanks to their stalwart defenders in the US Congress no stronger regulation get passed. If that's not sign that government is in the bank's pockets, I can't imagine what could be more clear.

Thanks to the revolving door between Goldman Sachs and the US government the banks are the government. The barbarians aren't at the gate, they're manning the walls.

Re:Called it

[CharlyFoxtrot]

After all, this is 2011 and what the bankers did was in 2008.

What bull. The financial crisis is ongoing, the dominoes are still falling.

Re:Called it

[Serpents]

Any NYSE-listed company has to comply with SOX

Re:Called it

[Anonymous Coward]

The problem is that money is a resource. The more you have it, the more you can earn. Those that have the largest supply of the resource can determine its value.

Use this example: Gain 100000 dollars in one month. Someone who is already rich and has large amounts of cash available can achieve this. Someone with no money to start with can not possibly gain this in one month. (I say gain because earn didn't seem right)

Re:Called it

[GlobalEcho]

While your bitterness toward CEO packages is understandable, you are pathetically underinformed in this case.

Re:Called it

[fermat1313]

Beg to differ, but the Risk officer should definitely not be the CFO, nor report to the CFO. In a large org, ideally the Chief Risk Officer should report to the Board, and should be independent from the CEO, CFO and CIO, where significant amounts of risk lie. The purpose of the CRO is to make risk assessments and corrections independent of the other officers, who each have different priorities and reasons to ignore risk. Of course, in reality, the CRO often reports to the CEO, but having the CRO be the CFO or report to the CFO can cause a huge conflict of interest.

A reminder why computers aren't perfect...

[MrCrassic]

I guess it forgot to 'pick up' the job cuts and absolute chaos this would ensue while it was at it.

They didn't have adequate risk systems

[Chris Mattern]

A risk system that nobody pays attention to is no different from not having a risk system at all, except that you're paying for it. As UBS found out.

Re:They didn't have adequate risk systems

[thepainguy]

Actually, it's worse because it lulls you into a false sense of security.

I wonder if this was a case of the boy who cried wolf/car alarm problem; a system that isn't calibrated well and that people learn to tune out due to all of the false alarms.

Re:They didn't have adequate risk systems

[TubeSteak]

A risk system that nobody pays attention to is no different from not having a risk system at all, except that you're paying for it. As UBS found out.

Boy are people going to be surprised when they find out the government has all these regulations and very few employees to monitor compliance and initiate enforcement actions.

Re:They didn't have adequate risk systems

[Anonymous Coward]

A risk system that nobody pays attention to is no different from not having a risk system at all, except that you're paying for it. As UBS found out.

I bet they'll feel the difference when it is mentioned during testimony for the shareholder's lawsuit.

Re:They didn't have adequate risk systems

[mikael]

Nick Leeson worked in the IT department before he became a trader. He learned all the phrases traders used when a false-positive alarm was triggered; "Oh, I'm just clearing up a wrong transfer", "Just rolling through some accounts", "sorry, the other guy was logged in at my terminal", "Just tidying up an old account".

Then when he became a trader, he knew about the test accounts to store his losses, as well as how to smooth over the tripwire alarm system whenever IT called him up.

Re:They didn't have adequate risk systems

[HornWumpus]

Not surprised. Why do you think they pass most of the useless regulation? So the useful regulation is not enforced, just like the limits on feeding cows cornflakes.

Also helps their donors, no better way to preempt competition then put in volumes of regulations and crooked regulators.

Re:They didn't have adequate risk systems

[thepainguy]

How about, after 10 or 100 or whatever over-rides, somebody does some poking around just to see if anything's up?

Re:They didn't have adequate risk systems

[Anonymous Coward]

A system that does not work or produces wrong outcomes is WORSE than no system at all. Belief in the system makes people grow complacent.

Re:They didn't have adequate risk systems

[aynoknman]

he knew about the test accounts to store his losses

Security by obscurity raises its ugly head again

Re:They didn't have adequate risk systems

[quarterbuck]

Nick Leeson did not work in IT according to his biography or according to Wiki.
He used an error account, which he realized was unaudited, but that is something you pick up from being a trader or an auditor- not necessarily IT. These things are common in investment banks/brokerages which have a lot of accounts and client trades and errors need to be isolated in an account that does not belong to a client. ie. if a client asked to buy 100 pork belly contracts and you bought him lean hogs instead, you need a place to dump the pork bellies you bought. It does not mean a "test account" in the IT sense.

Re:They didn't have adequate risk systems

[Anonymous Coward]

if you don't see the difference between having warnings that you choose not to look at and not having them at all, obviously you're not cut out for the street.

Re:They didn't have adequate risk systems

[Doc Ruby]

The most important part is where the government stops collecting taxes, guaranteeing that even agencies with oversight orders and staffing budgets are underfunded and so understaffed. It helps even more to block the appointment of top managers in the agencies, so the whole office is crippled, overburdened, and unfocused without a leader.

Guess who is responsible for undertaxing and blocking agency appointments? Don't strain - it's the Republicans, and maybe enough fellow "Conservatives" in the Democratic Party to muddy the waters.

The solution is to tax businesses, like the financial business, enough to cover their costs to the public in protecting us from their bad work. Who's going to stop a 0.05% tax on financial transactions, as is now applied in the EU? The Republicans/Conservatives, of course.

Re:They didn't have adequate risk systems

[AmberBlackCat]

Maybe the risk system worked so many times that they stopped taking it seriously. Maybe they have a risk assessment guy who has gotten used to clicking "Allow" all day long. Sound familiar?

Re:They didn't have adequate risk systems

[bryan1945]

"yeah, we knew about it, but we didn't fucking care until he lost a bunch of money. Then we sorta cared, but pushed all the losses off onto our customers, so no, we still don't fucking care.

Re:stood up for ourselves

[TaoPhoenix]

How exactly do you do that?

Either you write a report that is just plain ignored or you get pegged as a HaxorTerrierist.

I swear, this is just that old childhood playground stuff all over again, where the jocks in the board room and Gov are blaming the geeks.

You must test

[TheSync]

Whenever you have a monitoring or backup solution, it must be regularly tested to ensure a responsive psychology (as well as proper device operation).

They should have had 1 or 2 fake funny trades per month, and if the people who got the alert messages didn't respond, they should have been punished or fired.

Re:You must test

[blair1q]

^ THIS.

Re:You must test

[Anonymous Coward]

spot on. there's no difference between this approach and netflix's chaos monkey.

Re:You must test

[TheCarp]

Whenever you have a monitoring or backup solution, it must be regularly tested to ensure a responsive psychology (as well as proper device operation).

They should have had 1 or 2 fake funny trades per month, and if the people who got the alert messages didn't respond, they should have been punished or fired.

Nah, you don't need to punish or fire them in the traditional sense.

All you need is to have some mandatory meetings that kick off to investigate, document, etc. Just make missing them a pain in the balls for the people who should have caught it, and they will make sure it doesn't happen again. Getting fired sucks.... facing repetitive ball busting hell is much worst and an excellent motivating factor.

But also.... thats not enough, and might not even be the right problem. You have to ask, why did they miss them?

Did they miss them because they were fucking off or just didn't care? Ok.... well thats one issue.

Did they miss them because the system catches so much shit, that the alarms are worthless? Thats a whole different issue.

I mean, technically, you could just alert on everything all the time.... send thousands of alerts a day. You will catch the problems... but... it wont matter because the people can't possibly keep up.

We had some issues with swap monitoring. Why? We started out a bit naive and just set thresholds. Lo and Behold, Linux systems will swap stuff out just to increase cache sometimes. We would have hosts with 80% swap usage that... were not swapping in or out and had 90% free memory. So, people were getting pages, alot, often. If we let that just go on...eventually.... no matter how vigilant you try to be... people will start to ignore it...then some day...its going to take a machine down.

Monitoring is great, and you are right but... you have to make sure you are addressing the actual cause rather than a symptom of a larger problem.

Re:You must test

[perlchild]

This is worse, as a "rogue" trader is, at least to this speaker of english as a second language, someone who deliberately did wrong.

He was not "making mistakes" he was trying to game the system.

As I posted earlier in this thread, at the very least, he should have been sandboxed/honeypotted, with someone replaying any transactions he made that had value(so he'd NOT know he was being audited for being a crook and facing jail time).

Re:You must test

[Doc Ruby]

Nothing pains the balls as much as being fined your share of the rulebreaking losses. Which should exceed the annual pay.

Unless it's being fined and fired, which implants the pain instrument in the balls. Better yet, fined, fired, and convicted of a crime. That'll put "balls pain" right at the top of your resume.

Re:You must test

[tlhIngan]

You missed other reasons.

Perhaps said trader got annoyed at all the alerts and simply told them "I'm a hot shit super trader. if there's any odd trades coming from me, it's because I know stuff you idiots don't so screw you and let me do my trades!" This is espeiclaly true if the trader has a reputation of oddball trades but makes tons of money back.

The other possibility is said trader simply causes alarms constantly but they're small ones and they up the threshold for his alarm. Eventually the threshold is pushed extremely high and while being detected, won't be acted upon as that sort of trade usually happens.

Either way, hiding a bunch of trades becomes easy. The system has to adapt to different trading patterns constantly so there's no real way to not hae false positive alerts, and prima donna traders who think they're above it al and think the alerts are just a nuisance as the trades they do will constantly trigger it.

Re:You must test

[Anonymous Coward]

20 Whenever you have a punishing or firing solution, it must be regularly tested to ensure a responsive psychology (as well as proper department operation).
30 They should have had 1 or 2 fake funny alerts per month, and if the people who ignored the alert messages didn't get punished or fired, their superiors should have been punished or fired.
40 GOTO 20
^D
> RUN
ERROR: STACK OVERFLOW!

Re:You must test

[TheCarp]

Thats interesting and points out something that I missed...

Monitoring is great for looking for broken systems.... however.... it will never be enough to catch an intelligent adversary, who is actively gaming it (unless he doesn't understand the game he is playing, or makes a mistake).

You are always limited by manpower, because someone has to act on alarms. Humans can and will act according to how the environment dictates. You either have enough people to investigate and log evidence on every single alert, or you must tune alerts/ignore alerts.

Even then, it only works if the monitors that you setup to flag issues catches something that the next adversary is going to try, and that whatever he is doing can be verified to fraudulent with the type of investigation that the people investigating alerts will catch.

Many reasons why this was not detected.

[Anonymous Coward]

I used to work on a NASDAQ trading floor, and once in a while (especially when trading bonds) someone would put the amount of shares in wrong into the Profit & Loss monitoring system. If it was us, we would get a 'friendly' visit from floor manager as to why we were 2 billion dollars in the red. We would just calmly explain that the mark on the bonds was entered wrong and give him a more accurate estimate of our position, and it was good enough. Unless you are bleeding money day in and out for a month, you could usually get by with a simple conversation.

Re:Many reasons why this was not detected.

[blair1q]

What if you were UP $2e9?

Re:Many reasons why this was not detected.

[dr_dank]

I used to work on a NASDAQ trading floor

A difficult job, considering NASDAQ is an all-electronic exchange.....

Re:Many reasons why this was not detected.

[Oswald McWeany]

He could be an Android they're electronic.

"Rogue Trader"

[MimeticLie]

Am I the only one who was really confused when these stories were not about the kind of Rogue Trader I expected them to be?

Re:"Rogue Trader"

[blair1q]

No. But you are the only one who still thinks that's funny. So you got that going for you.

Its a sham security system ...

[Anonymous Coward]

The point of those systems isn't to actually stop anything ... it's to give the impression that the company has some sort of safeguards and place the blame of something going wrong on some unfortunate employee. I'm sure there was some sort of alert. I'm also sure there's 30 alerts a day and the guy who's eventually going to be blamed for this had absolutely no possible chance of actually stopping Adoboli, but he's going to be blamed for this anyway and prevent any lawsuits from ever actually punishing the company for negligence.

Re:Its a sham security system ...

[perlchild]

Your monitoring system doesn't stop your web site from going down either... It's to give you a whack in the head at 3am so you're fired up to do something about it...

Same here, management didn't do anything, IT didn't do anything, risk management was either hamstrung incompetent or complacent or a mixture of all three...

I can't say I'm surprised.

[idontgno]

I've actually had leadership-types ask me, straight-faced and very upset, "Why did you let me ignore those warnings you've been sending me?"

There is, of course, no answer. (Well, there are answers, but they're pretty dickish: "I tried mind control, but apparently you have no mind." Or "I'm not your mommy, Major." And by "dickish", I mean "likely to get my uniformed ass into correctional custody." To quote Coulton, "Code Monkey not say it out loud; Code Monkey not crazy, just proud")

Re:I can't say I'm surprised.

[Anonymous Coward]

I've found, "I'm not your boss, but if you're offering..." works rather well without coming off as insubordinate.

Re:I can't say I'm surprised.

[mbkennel]

"Why did you let me ignore those warnings you've been sending me?"

"for the same reason that you did let me let you ignore those warning's i've been sending you."

Re:I can't say I'm surprised.

[dave562]

Your NLP is good.

Re:I can't say I'm surprised.

[Anonymous Coward]

I understand your exasperation, but that's actually a pretty legit question from leadership. If there's a serious warning and the manager isn't acting on it, you need to show some responsibility and get him to look at it. Your job doesn't/shouldn't end at writing the software--you're a part of the business and should act like it. Chances are he gets 1000 emails a day in addition to his 10 meetings (not exaggerating, that may be low-balling it), and *relies* on people escalating things that are really important and require his time.

And if you really really can't get him to pay attention, talk to compliance or controllers. Big firms tend to have a dozen ways to escalate problems because they want to avoid scenarios exactly like this!

Re:stood up for ourselves

[Anonymous Coward]

I like to put cover letters on my reports stating something to the effect of "please note the parts marked in red, as I am officially informing you that bad shit is happening. If you do not act on it, it is no longer my problem, it is your fault."

Usually the recipient ignores that, too, and I am under no illusions that it covers my ass at all.

But on the plus side, the places the recipient has read it and gotten pissy about it instead of acting on it, I've been able to plan my exit from those companies before they collapsed.

The corporate "Check Engine" light is on again!

[Megaweapon]

Exec: "Eh, it's still running, probably just a glitch or something."

The question is...

[Oswald McWeany]

The question is- why had IT not got a monitoring device that checked to see if people received warnings acted on the warnings.

It seems to me if you send a report out- there needs to be a report that reports on whether or not anyone read the report. If management had such a tool- they would have known they received a report and didn't act on it.

Re:The question is...

[Anonymous Coward]

But they would need another system to check if the report about the report had been acted on!

...that's worse.

[Anonymous Coward]

So you knew about it and didn't act on it? You deserve every cent you lost.

Re:stood up for ourselves

[HornWumpus]

In my case I pulled out the bug report that showed the VAR reports total field was being overflowed when a customer ran it. Bug had been fixed 6 months prior to customer going into bankruptcy (then being made whole by the ratepayer.)

Of course they weren't trying to blame us. They were claiming it was because they couldn't do long term deals. Which is true, but it's true because they had previously engaged in incestuous, non-arms length, long term deals with their open market corporate cousin.

I shouldn't be discussing this, but my former employer is long gone.

Rogue trader my ass

[Vaphell]

It's all CYA tactics.
if the loss alone was 2billion imagine how much money was on the table. I don't see how a trader could have access to such obscene amounts of resources without any authorization and oversight.
I am sure that the management knew about everything and was very happy because the bets on rising swiss franc were extremely profitable and pretty much printed money. They had to be smiling at the thought of fat christmas bonuses coming their way. Everything was peachy... until the swiss central bank intervened and announced pegging to euro at fixed 1.2 : 1 rate (6th of September). Nobody saw that (and the subsequent instant 8% drop) coming so bets placed to earn on rather minute upward movements blew up with full force when such a massive change occured.

Re:Rogue trader my ass

[Orga]

Very very true. You know they made a lot off of those trades, everyone was into it. If this guy likely had some authorization since this profitabel trade sprang up on short notice. If they had made billions you'd have never heard about it, but they lost it and needed a scapegoat. Enter "rogue trader".

Re:Rogue trader my ass

[Warskull]

I am willing to bet a good deal of it goes on. Allow a trader to engage in activity you claim you don't participate in, if he gets caught then you play the rogue trader card. It just massively backfired this time.

Re:Rogue trader my ass

[quarterbuck]

The stories at the time of arrest indicate that it was Equity Index linked securities that the trader was gambling on, not Swiss Franc like it was widely assumed.
That was also the time when European indices, emerging market stocks and to a lesser extent US stocks crashed. But otherwise you are right - apparently Adoboli had done hidden trades starting as far back as 2008 and they were generally profitable. http://www.guardian.co.uk/business/2011/sep/17/kweku-adoboli-ubs-fraud-charges

Re:Rogue trader my ass

[Anonymous Coward]

He got access to that much money because he was doing Delta One flow trading. The idea being for client orders you hedge the position. He pseudo hedged them by placing lots of forward settling trades that should have been identified on a daily report. The book would be measured on a net exposure basis as flow volume is expected to be large. What should have been acted on was the fact that on a daily close basis for settled positions there was a huge mismatch.

Re:Rogue trader my ass

[Anonymous Coward]

And that's why you have to have lots of friends at the central bank, at any cost. Or rather, at the cost of giving your friends lucrative retirement jobs at the ripe old age of 40 or 50.

Re:Rogue trader my ass

[Anonymous Coward]

Quite the contrary. It's not unlikely he could have access to 2 billion, and it's also extremely unlikely management would be happy with him taking risk. Also, btw, it was disclosed that the Swiss peg was not the cause.

First, you need to learn what a one delta desk is. They basically trade stocks against indices and forwards on those stocks. You can hedge these trades perfectly: if client X buys 1 share forward, you hedge by buying 1 share today. Likewise indices can be hedged perfectly by buying the underlying components. (It's not quite that boring, but that's the general idea.)

Since one delta products are so easy to hedge, banks can trade enormous quantities of them without significant risk. And indeed they do; offering indices and forwards is one of many services banks have. Thus a sum of 2bn in delta-one products is not at all uncommon or unreasonable.

However, these desks don't take directional bets. In other words, they stay hedged, not betting on market movements. Instead, their money is earned by picking up the nickels and dimes where there are slight mispricings in the market (e.g. an index is not trading at the sum of its components), and through execution fees (which btw are extradinarily small nowadays).

Indeed, no one in their right mind would want the one delta desk to take directional bets. Something like 2bn unhedged positions generates a ton of PNL volatility. Moreover, it is extremely unlikely bets like this would "print money". Even the best prop trader makes maybe 60% correct calls. UBS would have huge up and down swings in PNL from a desk that traditionally is stable business. Given UBS's tenuous position since the crisis, huge swings in profitability are not something that makes sense for them--they might not even survive this, as they're running out of money to pay their employees.

(And perhaps most obviously of all, despite no /. comments pointing it out, if word got out that unauthorized trades were happening under controllers' noses, shareholders would be really nervous about the company, and regulators would throw a fit. The former means a drop in stock price (which indeed has happened) and the latter means a lot of pain coming from people who have you by the balls. Even if the trades make money, you're in a terrible position!)

Re:Rogue trader my ass

[hughk]

Not hidden trades. The guy was making perfectly reasonable trades on the FDAX and EuroStoxx indices. Allegedly, he was hedging the futures with ETFs (Exchange Traded Funds) which should be comparable to an exposure to the underlying shares. However it seems that the hedge trades were being entered as OTC deals but in reality were never happening. As some banks weren't apparently sending confirmations, this was not spotted. Of course, there would be no cash flows but that would not be spotted immediately.

Why would IT call him?

[khasim]

Then when he became a trader, he knew about the test accounts to store his losses, as well as how to smooth over the tripwire alarm system whenever IT called him up.

Well there's your problem.

Why would IT call him? Wouldn't the alarm go to someone managing the people who manage the trades?

Re:Why would IT call him?

[mikael]

First level contact was to ask the trader to recheck their transactions, then escalate to supervisors.

Re:Why would IT call him?

[Anonymous Coward]

First level contact was to ask the trader to recheck their transactions, then escalate to supervisors.

It goes to security.

Paraphrase

[Torodung]

Paraphrase: "We had (have) severe operational problems. Kweku Adoboli is a scapegoat. We can't explicitly say that because of liability issues."

Awesome!!

[Anonymous Coward]

I love it when these stories happen, for several reasons, no. 1 being - I don't mind banks loosing money, 2 - I think it is pretty cool that someone can "lose 2 billion dollars", as the flip side is someone might have made 2 billion dollars, 3 - it just sows again how bad the system as a whole is when several people control the wealth of nations.

we watched it happen

[chronoglass]

what more do you want?

Isn't that part of the initial shakedown?

[khasim]

You set up the monitoring system ... and you investigate the events it is reporting.

Then you tune it to get rid of the junk ... and you monitor it again ... and you investigate the events it is reporting.

Then you tune it blah blah blah blah blah.

Once you have it to the point where it isn't reporting junk you start testing it by setting up fake scenarios you want to catch. And investigate the events it is reporting (and the cycle continues).

Not to mention just going through ALL the events on a regular schedule to see if there are circumstances / situations / edge-cases that you did not anticipate.

Re:Isn't that part of the initial shakedown?

[HornWumpus]

The problem is traders see what you did to 'get rid of all the junk' and hide their fun in with the junk. That is exactly what happened here.

The other part is that Traders should not see the risk management system directly. They will still be able to game it (with small test trades to see what gets noticed) but it will be more difficult. Gaming risk management should be fire able.

Re:Isn't that part of the initial shakedown?

[TheCarp]

Exactly. However, not everyone understands that and a lot of people who don't get this.

Its also nearly impossible to get to this point if management doesn't understand the process that is needed and buys in to making everyone play ball.

I remember seeing presentations by a specific monitoring team of positions past. They presented how the decision was made to "just turn everything on". After several years they had hundreds of alerts a day... way too many to even think of turning on paging... and it was another 4 years before they got to the point that they had management buy in to take it seriously, turn on paging, and make people work with the monitoring group to tune down the alerts.

All the while management kept going on about what tools they were using, and looking at different ones etc.... all the time...it was a process issue and a lack of management buy in to work with the tool they had that really hamstrung the whole process.

Not a rogue trader

[steamraven]

If they detected it, and didn't do anything about it, doesn't that mean they approved of it?

My comment from the previous article

[smooth wombat]

This is what I said in the previous article about this situation when commenting about someone who said they couldn't monitor every trade:

Yes, they do. Every trade is supposed to be monitored. Even if it means a few bad trades get through, they can and are supposed to review the accounts, timing, etc that go in to every trade to determine legitimacy and adherence to trading rules.

It's one thing to say you can't check an instantaneous trade. It's quite another to say you can't look at multiple trades your traders make and not pick up on improprieties.

This comes down to willful ignorance. So long as the guy was doing well, it didn't matter if the both internal and external rules were being violated. It is only when trades go bad that, "Oh my! How could that have happened?" comes into play.

For a short time I worked at a brokerage firm and I can tell you, everything you do is watched.

So yes, UBS' systems did detect the trades (as I said they would). It was the people who failed.

It's the same thing where I work. When people turn off their PCs at night, rather than restart as they've been told, our CIO talks about getting Wake-on-Lan implemented. When she and our Security head couldn't remember two passwords to sign on to their laptops (SafeBoot first then domain sign-on) she had us change to autoboot.

In both instances she was advocating a technical solution to resolve an issue of human failure. Same with UBS. The technical side worked as planned. It was the human side that failed.

Well there's your problem.

[khasim]

Sorry for repeating a meme, but in this case it is extremely valid.

First level contact was to ask the trader to recheck their transactions, then escalate to supervisors.

IT should NEVER be involved at that level. The alerts should go to the manager (or the manager of managers) who SHOULD have more insight into the situation than IT.

Having IT in the loop means one more failure point (and an additional delay).

Re:Well there's your problem.

[Anne Thwacks]

You are supposing they want to stop these traders. In reality, the "rogue traders" look very profitable prior to the crash - just like someone who is driving way to fast on the race track is out front till he crashes. There is no way they are going to stop their "star".

The entire system if fundamentally flawed. The banks are expecting to make more money than is in the system to make. Of course the world economy is still screwed. "Its the bankers, stupid!"

Re:Well there's your problem.

[danlip]

+1 great car analogy

Re:Well there's your problem.

[dintech]

Yeah, which is why compliance and middle-office departments exist. Really it is these people that questions should be asked of and ultimately where heads will roll.

Translation:

[Bill, Shooter of Bul]

We're not idiots, we're incompetent.

Re:Translation:

[shoehornjob]

LMAO corporate speak translated for the common man.

Risk Management != IT

[zerofoo]

When I worked for a bank, we had human review of any large transaction that would move money out of the bank. Sure, IT was involved in that, but the process was 90% policy and human activity.

Dumping risk management practices on automated IT systems is just plain lazy and stupid.

It was a measly 2 billon dollars.

[140Mandak262Jamuna]

Yeah, yeah, yeah. We detected the unusual activity. But it was a measly 2 billion dollars. Our high and mighty CEO is not going to break his golf game for such a trivial thing. Heck, forget the CEO. The underling to the assistant deputy sub vice president would not break his Angry Birds practice to take a look at it. If you want these things to be attended to quickly you need to raise their pay enough to motivate them.

Re:It was a measly 2 billon dollars.

[Anonymous Coward]

A billion here, a billion there and it soon adds up to real money.

it's all a scam

[recharged95]

" they were simply not acted on"

Likely cause UBS was trying to figure out how to make money for themselves from the transaction. So typical of these banks.

Why stop a transaction when you can also skim/make some cash on the side as well. That's the name of the game and why self-regulation failed in the financial industry the last 10yrs.

Unfortunately what applies here, someone once said, don't blame the player, blame the game.

Re:it's all a scam

[Doc Ruby]

Blame the player, too. They don't have to play that blameworthy game. In fact, banks as big and influential as UBS are the best positioned to change the game. During the past few years since UBS helped crash the world's economies, UBS has been playing the same game as the other banks in keeping the same reckless risk game running, interfering with efforts to regulate the game. Instead it could have helped regulate the game in a way that let it do legitimate business without overwhelming competition from banks that do illegitimate business.

UBS is to blame for keeping the game going when it had its best chance in generations to change it.

Re:it's all a scam

[Anonymous Coward]

UBS was making the transaction - the trader works for them.

Computers can't always do the job for you

[nine-times]

I'm not sure who to blame here, but I've seen something like this several times in my career: Someone sets up a big elaborate system to detect security threats, monitor their systems, or enforce a workflow. Then the people in charge cheer how this system is going to solve all of their problems, and they cede all responsibility to the computer. They don't check whether the system is working the way it should. They don't pay attention to the alerts the system kicks out.

Having seen it so many times, I've learned a valuable lesson: there is no replacement for a smart and diligent person who is paying attention and exercising good judgment. I don't care how advanced your computer system is, it won't do your job for you.

They built a better idiot

[sirwired]

And again, a basic software axiom has again been proved true:

"When you build a piece of software to be idiot-proof, your user base will find a way to build a better idiot."

They weren't brought down by anything as prosaic as a bug... they lost money because they completely ignored the output from a system specially designed to warn them of activity like this.

Same as It Ever Was

[Doc Ruby]

UBS and the rest of its banking industry crippled the global economy by doing exactly this: IT systems and business rules showed unsupportable risks were being executed by their traders, but the execs did nothing to stop or slow it.

Something like 2-10 $TRILLION in losses later, after years of the worst recession possible since the reforms installed after the Great Depression, UBS hasn't changed. There is no reason to believe any of these banks have changed, since they all act the same way to compete with each other: ignore risk, because they're too big to (be allowed to) fail.

UBS should forfeit every penny of the public money given it to bail it out. And face the stiffest penalties possible under the laws we now have. And cause new laws to be passed that actually prevent, not just promise to punish after the fact, this reckless risktaking - with frequent audits and financial requirements to continue operating. Once slamming UBS is up and running, that government office should go after the rest of the banks that are surely guilty too.

Re:Same as It Ever Was

[jafac]

Well, I think you're right.

This is precisely why there are tens of thousands of Americans on the streets protesting at this very moment.

After the Silverado/S&L crisis of the 1980's, the IPO bubble and Enron scandal of the late 1990's/early-2000's, and then the housing market/derivatives bubble of the late 2000's, each time, we've patiently asked for market reforms, or even an equivalent "justice" so that there would be an obvious moral "penalty" for those charged with this responsibility (and those who enjoy the rewards).

Each time - these requests are denied, and business carries on as usual, and those who bear the costs, and are made to suffer, have had it. We've warned that this was going to happen again.

Lo and behold - it's fucking happening again. Exactly as predicted. And nobody is fucking listening.

Re:Same as It Ever Was

[Doc Ruby]

Some people are listening. I was out in Zuccatti Park last week, and there were at least 15,000 people there with me.

But not enough. Across America, the same people who voted for Phil Gramm (whose Gramm-Leach-Bliley deregulatede the post-Depression banking protections), who voted for Bush/Cheney twice, who voted Republicans a House majority in 2010 and likely will again in 2012, who will vote for Romney or his standin - those people are parroting the lines that OccupyWallStreet people are "trying to destroy jobs", that it's their fault they're not rich, whatever the Koch brothers society PR think tanks have cooked up for them to squawk. It's those people's refusal to listen to anything but poison, refusal to think, that protects the thieves every decade when they come around - and get away.

But Occupy[WallStreet] is different. I haven't heard of such largely spontaneous demonstrations against the corporate/financial tyrants since at latest the 1940s. Certainly never the main point of such large public demonstrations. And I've even seen some sympathetic reporting among the corporate mass media, surprisingly enough including Disney/ABC. It might not be nearly enough. But it's different. That change in momentum is the signal to do more to support it.

You should go to a nearby OccupyX rally if you can. Or send some sandwiches or sleeping bags. Maybe it'll matter. But if we don't with this time we have, it surely won't matter.

That's almost worse...

[Mysticalfruit]

If you have a rogue trader who games the system, you can look at UBS and say "geez, I guess you'll be investing in a better risk management system!"

But if you have a good risk management system that throws alarms and nobody looks at them, or follows up on them, then it's all on their heads.

They only had to look over one of their borders into France to see what a rogue trader could do. This isn't a novel problem, rogue traders taking positions, then losing money and then taking crazier positions to get back what they lost isn't a new problem.

Exactly.. And even worse.

[khasim]

After several years they had hundreds of alerts a day... way too many to even think of turning on paging... and it was another 4 years before they got to the point that they had management buy in to take it seriously, turn on paging, and make people work with the monitoring group to tune down the alerts.

One place I worked had a problem with an average of 1 alert A WEEK. Because it almost always turned out to be some stupid non-issue ... eventually everyone started ignoring it. Even to the point of ignoring the follow-up emails about WHY the alert was happening.

This supports my belief that security is easy.
But no matter how easy it is, NOT doing it will always be easier.
And somewhere in the chain will be an individual who is lazy enough to break the security.

asymmetric risk management

[przemekklosowski]

It's curious how we never hear about rogue traders caught _earning_ 2B$. The hedge traders are supposed to run balanced trades that do not have large downside risks, but consequently aren't supposed to earn fantastic profits---so a trader who suddenly earns a lot of money was likely to have violated his guidelines, and the risk management people in theory should police it just as vigorously. In practice, I can't remember anyone being fired for extra earnings, so I suspect that those controls are purposedly kept vague and/or easy to circumvent.

Operations

[alexander_686]

Prior to working on the trading desk they worked in operations. While Operations may be the kissing cousin of IT, it is not exactly the same. But in either case, (Leeson or Adoboli) knew what would trigger the compliance office (In those days “Risk Management” tended not a separate department).

In Lesson case, he was head of both trading and operations (which is a no-no - but it was Singapore – a small desk – why can’t one person do both jobs?). So on side he present it as a error account and on the other a client account (loss not to the firm.)

And as somebody who has worked in a similar posistion (Operations / Risk managment) - it's hard. Give me a simple and clear rules with a robust report, and I know it can be gamed. Traders tend to be optimizers. Be careful when you play magic or poker against them. They will test every last loophole and push every last inch.

Good risk management requires human judgment and subjectivity. Alas, the money and the fame goes to the traders who earn the money, not the referrers that keep people safe.

Underfunded regulators.

[sjbe]

Boy are people going to be surprised when they find out the government has all these regulations and very few employees to monitor compliance and initiate enforcement actions.

That will come as a surprise to precisely no one. The SEC has been purposely underfunded for decades. You think that is by accident? The financial firms and their, ahem, elected representatives want it that way so they can't cause too much trouble. Hard to monitor wrongdoing when you don't have enough manpower. Congress can effectively neuter any regulatory agency simply by cutting their budget. Doesn't matter what laws are actually on the books if they can't be enforced.

Re:Underfunded regulators.

[AK Marc]

Don't forget, "independent" auditing firms, like Accenture and PWC, actively solicit bribes to certify compliance for those not compliant. The accounting firms approved Enron's activities long after the illegal stuff started. Auditing firms are leaches who lie for a living (because if they don't lie, the other firms will come in and get the big account and lie). Die PWC die.

No Other Way to Put It

[Nom du Keyboard]

There is no other way to put it. This is even worse than not having any triggers at all.

au contraire

[Anonymous Coward]

UBS guy: So our systems -were- actually in place, but they weren't. If that makes any sense.

Reporter: That doesn't make sense, sir.

UBS guy: .... (runs off stage)

Agenda

[C_Kode]

$2B in losses. There had to be an agenda there. Kill the company? Maybe. Funnel money to someone else is quite likely too. Friends? Terrorist? I think they should look more into where the losses went. Not just how they were lost.

of-course it's nonsense

[roman_mir]

As I said of-course this is nonsense.

Earlier it was reported that $2 Billion was lost in some shady trading transactions by Kweku Adoboli, a UBS trader. This of-course ran all sorts of alarm bells, having worked in banking it's difficult to imagine that it would be possible for a single trader to be able to trade with so much money without anybody noticing. It's much more likely that there is higher management involved in this and the poor sap, who will be set up for this will receive a few years of jail time, just like Jerome Kerviel of Societe Generale, who supposedly singlehandedly lost 4.9 Billion Euro in unauthorized transactions. Well, Jerome is serving a 3 year sentence, and it's unclear what will happen to Kweku, but what is clear is that what is being reported is just not the reality.

A bank does not just allow a trader to lose billions of Euro or Dollars. The most likely scenario is a robbery, likely done with knowledge (or at initiative of) one or more of banks' managers. I believe we are coming to a point, where it will become more dangerous to hold one's money at a bank, we are at a point in time that has never been tested before in history of human civilization, where all of the countries are on fiat currencies that are being devalued all at the same time. Anybody with real bank deposits (gold and otherwise), may want to think what is the most likely scenario that is going to play out when the proverbial fecal matter hits the rotary impeller device. It's likely that people closest to the funds will simply dump them into a truck and skip town, that is my contention.

Another interesting point to mention: in the same comment from 15 September, 2011, it is noted that 4 national banks (US Fed, UK, Swiss and Japanese national banks), have announced that they will devalue their currencies further to buy all sorts of short term sovereign debt (mostly 3-month US bills), and as was mentioned, DOW went up on these inflationary news, while the monetary commodities (gold/silver) took a sharp dive. As was explained, the commodities were most likely depressed on that day based on selling related to margin calls and leveraged trading, so it was predicted that the prices of these monetary metals are now going to go up higher on these bullish news (bullish for real money), and now the results are clear: gold and silver are sharply up. Obviously the traders realize what is in the bag - more inflation.

All of this combined together with more "weaker than expected" news on employment (who are these so called 'economists', that can never expect what is so obvious?), is yet another indication and proof that the fiat money based economies, and especially vendor financed economies are moving closer to the edge of the proverbial cliff.

Watch out and watch those banks, if you have real deposits, don't leave them there thinking that they are going to be safe.

Re:stood up for ourselves

[AK Marc]

No, you go walk up to a reporter and say "Hi, I work for UBS and woudl like to get IT's story on the record." Then you paint a picture where IT is told to "detect" such things but never block them. Report them to the people who would then authorize blockage (but never do in a timely manner) and then the system, enforcing bad business processes, is blamed for a business process problem that lies with the upper management not wanting to enforce reasonable rules, knowing they can always blame it on some other department or such.

Unusual activity was discovered and reported to the appropriate management, who then elected to do nothing and then later blame it on the people who detected it and had explicit orders to never block it for not blocking it. The problem is that nobody ever goes on record to explicitly point to the non-IT business decisions as the actual cause of the issue, as the IT people don't understand people, just systems.

Make it up in volume

[alexander_686]

He was on a ETF desk, which is supposed to be a low risk, low margin place. The only way to make a profit on those desk is to squeze out every penny and make it up on volume. Such a desk can very easily be dealing with billions and yet only have exposure of less then a million - if it's run the way it supposed to.

controls are difficult

[DaveGod]

Blessed with 20/20 hindsight, any failure such as this people react like it's something that was glaringly obvious. Controls can be very difficult to design, implement and monitor effectively. They have to be sensitive enough that they trip when something goes wrong, yet rare enough that they're taken seriously. When they do trip, the response has to be appropriate. They have to be effective yet also not be an endless cycle of bureaucratic red tape.

Generally the best controls are ones that almost prevent and detect fraud as a by-product of helping people do their job properly. The bank reconciliation isn't just a check for missing money, it helps ensure all the sales ledger receipts have been recorded and thus the sales ledger clerk keeps on track. The comptroller doesn't just authorise the bank reconciliation to catch the cashier stealing, the cashier is the one first in line to demand the comptroller reviews and authorises the bank rec because otherwise people are looking at him if there is a problem that he missed.

Most of all, controls are about culture. You can design all the effective controls you want, if the day-to-day mentality is that "detect[ed] unauthorised or unexplained activity... was not sufficiently investigated" then you might as well not have any. Again, take 100 people nodding their heads in hindsight and find 99 who were moaning about red tape and cutting corners the day before.

detection is not sufficient

[t2t10]

It's easy to detect anything: you just always say it's there. In order for detection to be useful, it needs to be traded off against error, you need low false alarms. UBS's system must have had too many false alarms, otherwise this alarm would have been acted upon.

Pearl Harbor

[Haxx]

There must be something wrong with this new radar thing sir, the screen is full of blips over the Pacific.

Re:Pearl Harbor

[Chris Mattern]

"They must be that flight of B-17s we're expecting in." And the lieutenant in charge didn't bother to tell anyone else. (True! The B-17s in question got a helluva shock, too; they actually showed up in the middle of the attack.)

Shameless Simpsons reference

[manwargi]

"You were supposed to be watching the factory!"
"I was watching! First it started falling over, and then it fell over!"

uber LOL

[Dark Lord of Ohio]

Ermotti wrote: 'Our internal investigation indicates that risk and operational systems did detect unauthorised or unexplained activity but this was not sufficiently investigated nor was appropriate action taken to ensure existing controls were enforced.' so they let him play with $2 billions and this is what their Security Dude said "hey, lets see whats going to happen, whoooops - it did not work, my bad, my bad... sorry!"

Yeah, Openly Available Evidence...

[obscuro]

...for a shareholder lawsuit against UBS.

Accenture is not an auditing firm

[sjbe]

Don't forget, "independent" auditing firms, like Accenture and PWC, actively solicit bribes to certify compliance for those not compliant.

Accenture is not an auditing firm. They are a consulting firm which has nothing directly to do with auditing. They used to be part of an auditing firm but have not been for some time. Furthermore having actually worked with big accounting firms myself, they generally are actually pretty honest, albeit flawed. They serve a very useful purpose which is to verify that the financial statements are a reasonable (not perfect - that is impossible) representation of the financial situation of a company. For the most part they succeed in this endeavor. However sometimes greed, incompetence or plain old fraud manages to get by. Sometimes that is the fault of the auditor, sometimes it is the fault of the company being audited, sometimes both.

The accounting firms approved Enron's activities long after the illegal stuff started.

Which was primarily the fault of the partners charged with that account and a failure of Arthur Anderson's audit control procedures. Arthur Anderson was basically executed for the corrupt/incompetent actions of a relatively few individuals. If you have ever looked at Enron's financial statements (I have), they were made intentionally so complex that it was extremely difficult to determine that anything illegal was happening. I truly pity any honest auditors that were trying to provide an opinion on the financial statements of Enron. It was a hopeless task. On top of an engineering degree I have a masters in finance and am a certified accountant and I barely follow much of what they did.

Furthermore Arthur Anderson was not remotely alone in their complicity in the Enron matter. The banks were probably more guilty if anything since they were the ones funding Enron and theoretically should have been casting the most jaded eye at their activities. They really shouldn't have been funding Enron but greed overwhelmed good sense and they put money into something they could not have possibly fully understood.

Auditing firms are leaches who lie for a living...

Since you don't even know which firms actually are accounting firms I'm going to ahead and say you probably don't know what you are talking about.

Re:Accenture is not an auditing firm

[AK Marc]

Accenture is not an auditing firm.

Arthur Andersen committed a number of felonies while "auditing" Enron. It was so bad that they changed their name immediately after to "hide" from being linked to Enron. Whether they sold off a business unit here or there to be able to deny being the auditing firm that signed off on Enron's cooked books doesn't change the fact that they were. And the feds gave them a free pass for the felonies because the feds didn't want to increase the trouble of the bubble bursting that was going on at the time by undermining all the felonious criminal auditing firms.

Furthermore Arthur Anderson was not remotely alone in their complicity in the Enron matter.

That others also did wrong in no way absolves the guilty. Enron saw that the entire system was corrupted/corruptible, and took advantage of it. Any of a large number of organizations could have stopped it. But non did because the rot in the system is to the core and won't be fixed until after the impending total economic collapse.

Since you don't even know which firms actually are accounting firms I'm going to ahead and say you probably don't know what you are talking about.

I knew the name of the firm at the time was Arthur Andersen (AA). I used "Accenture" to discuss them because I think they got off way too easy because of a timely name change. And yes, I am aware they split off AA prior to Enron. And I don't care. There's more than enough blame to go around, and when Ken Lay is Not Guilty (even if now dead), and AA is also Not Guilty (even if no longer practicing due to other factors). Everyone involved was absolved of guilt. Since nobody did anything wrong (according to the courts) that's a strong sign that the entire system is broken at all levels. But I'd expect an accountant to defend the broken system, as you do.

when i grow up

[Anonymous Coward]

i want to be a rogue trader

Unauthorized transactions?

[Anonymous Coward]

Exactly what kind of system that involves this kind of money allows "unauthorized transactions"?

Where do I apply?

Tech problem

[Anonymous Coward]

UBS execs are asking IT why they haven't already altered either cocaine or hooker's asses such that the straight lines of cocaine change shape to spell out the word "warning" while flashing red.

A different perspective - control environment

[Anonymous Coward]

Alot of good comments on this board with a variety of perspectives which I enjoy reading. Most trading shops trade with OTC, Affiliates and Clearing Brokers. Each evening the Clearing Brokers send its several thousand pages statements to its clients who pay / receive the initial and variation margin requirements. Most companies do not reconcile to its Risk Management positions and fair value to the Clearing Brokers due to technology and intellectual capital constraints within the organization. However, the few that do, can identify a position, fair value or deal element variance(s) from its system to the Clearing Broker down. As for the OTC trades, each counterparty would have a master buy sell (bilateral) agreement in place with an established credit limit and margin activity provisions based on the counterparty's credit rating. Each day the Credit Department would call the counterparty or would receive a call from the counterparty to margin or receive a margin call on the OTC fair value that exceeded the established credit limit. When they are on the phone/email/instant messanger with the OTC counterparty they call out the estimated fair value exhibited in its Risk Management system. If its a material disparity, one of the Credit departments would reconcile the position/fair value. If a deal is missing then the fair value "may" be materially mis-stated. Thus, 2-control objects are established to monitor the Risk Management systems' fair value each day to an independent source.

However, if the staff is in lean management style and the support staff are not innovative or creative in delineating its Risk Management systems and work processes to its optimal potential, then its hard for the organization to get in front of the beast that lingers deeply below.

I hope this helps puts things into a different perspective.