12The Risk-Management Function

The examiner appointed in the bankruptcy of Lehman Brothers reported in March 2010 that between December 2006 and December 2007 the firm raised its firm-wide risk appetite limit three times, from $2.3 billion to $4.0 billion. The last increase was approved in January 2008 and backdated to December 2007, which removed the excesses of the intervening weeks from the record; the examiner’s advisers calculated that the method used the year before would have given a limit of about $2.5 billion. The firm’s stress tests left out its commercial real estate and private equity investments and, for a time, its leveraged loans. The numbers were there. What failed was a function that could not make them count.

12.1 Independence: where the risk function reports

A trading firm’s risk function measures the risks its businesses take, sets and polices the limits of chapter 7, and objects when the two disagree. It is the second of Book 6’s three lines of defence: the businesses own their risks, the risk function challenges them, and internal audit checks both. Its value lies entirely in the objection, and an objection is only as strong as the reporting line behind it.

Three things make the chief risk officer independent in practice: a reporting line that does not run through the businesses whose risk is measured, pay that does not depend on their revenue, and a direct line to the risk committee that no one in between can filter. The first is visible on an organisation chart (Figure 12.1); the others are not, and matter as much. The examiner’s report cites press reports, published before the bankruptcy, that the firm had removed its chief risk officer in 2007 because of opposition to its growing accumulation of illiquid investments; the chief risk officer had also argued for a lower limit increase at the end of 2006 than the one adopted.

Supervisors who compared major firms after the first months of the 2007 turmoil found the difference was not independence alone. The Senior Supervisors Group reported in March 2008 that at firms which avoided significant losses the risk function had independence and authority but also considerable direct interaction with senior business managers; that some firms escalated concerns about emerging risks as early as the summer of 2006, gaining up to a year; and that in others hierarchical structures filtered what reached senior management. A risk function that is independent and remote sees the numbers late and is heard little.

12.2 Committees and the risk officer’s tools

The risk function’s tools are few and blunt. It proposes the risk appetite (chapter 6) and the limit framework (chapter 7); it measures value at risk and runs stress tests (Book 6); its model validation team approves the models that produce those numbers; it signs off new products and new strategies; and it decides, or recommends, what happens when a limit is breached. Each tool works only if a trade cannot happen without it.

The principle is the operational form of segregation of duties (Book 6): the trader who wants a larger limit does not grant it, and the quant who changes a risk model does not validate the change. It fails when the second pair of eyes belongs to someone whose interests are the first person’s: a head of desk who approves increases for their own desk applies four eyes on paper and two in fact.

12.3 Escalation: breaches, excesses and exceptions

Chapter 7 defined the limit breach and the difference between hard and soft limits. What happens next is the escalation procedure.

A breach is graded by size and by duration. The chapter’s rules (Listing 12.1) grade a breach severity 1 if it exceeds the hard limit by at most 5% for at most two days, severity 3 if it exceeds it by more than 20% or lasts more than five days, and severity 2 in between. Severity 1 is reported to the head of desk the same day, severity 2 to the chief risk officer within a day, and severity 3 to the risk committee within two. There are three honest ways out of a breach: cut the position, have a temporary increase approved by someone independent, or show that the risk was mismeasured and have a corrected model validated. The same three are also the dishonest ways out, when the increase is granted to fit the position or the model is changed to fit the limit.

@dataclass(frozen=True)
class Rules:
    minor_excess: float = 0.05      # peak excess over the hard limit, as a fraction of it
    major_excess: float = 0.20
    minor_days: int = 2             # duration in days
    major_days: int = 5
    repeat_window: int = 60
    repeat_count: int = 2
    notify: dict = field(default_factory=lambda: dict(NOTIFY))


DEFAULT = Rules()


def severity(excess, days, rules=None):
    rules = rules or DEFAULT
    if excess > rules.major_excess or days > rules.major_days:
        return 3
    if excess > rules.minor_excess or days > rules.minor_days:
        return 2
    return 1


def notify(sev, rules=None):
    rules = rules or DEFAULT
    return rules.notify[sev]

The public record (Figure 12.2) shows each of the dishonest exits. A limit raised while the firm was over it; an increase backdated so that the breach disappeared from the register; a limit recalculated with new assumptions that produced a larger number; and, before these, a large position left out of the usage calculation from May to August 2007, which kept the usage under the limit until it was included. One Quant Book 6 tells the story of a later case in which a risk model was changed while a limit was being breached. The escalation register must be built so that such patterns are visible: limits and models kept point in time, as they were known each day, and every change recorded with the day it was approved as well as the day it takes effect.

With weekly meetings the wait is three business days on average. A procedure that makes the desk wait with its breach open lengthens every breach that goes to the committee; one that makes the desk cut while it waits does not.

12.4 Tutorial: a year of breaches

def register(expo, hard, model_days=(), rules=None):
    rules = rules or DEFAULT
    expo, hard = np.asarray(expo, float), np.asarray(hard, float)
    n_desks, n_days = expo.shape
    models = set(model_days)
    out = []
    for d in range(n_desks):
        over = expo[d] > hard[d]
        t = 0
        while t < n_days:
            if not over[t]:
                t += 1
                continue
            s = t
            while t < n_days and over[t]:
                t += 1
            peak = float(np.max(expo[d, s:t] / hard[d, s:t]) - 1)
            if t == n_days:
                how = "open"
            elif hard[d, t] > hard[d, t - 1]:
                how = "limit increase"
            elif (d, t) in models or (d, t - 1) in models:
                how = "model change"
            else:
                how = "position cut"
            b = Breach(d, s, t, peak, how, severity(peak, t - s, rules))
            if any(hard[d, k] > hard[d, k - 1] for k in range(max(s, 1), min(t + 1, n_days))):
                b.flags.append("limit raised during breach")
            if any((d, k) in models for k in range(s, min(t + 1, n_days))):
                b.flags.append("model changed during breach")
            ups = [k for k in range(1, n_days) if hard[d, k] > hard[d, k - 1] and s - rules.repeat_window <= k <= t]
            if len(ups) >= rules.repeat_count:
                b.flags.append("repeated increases")
            out.append(b)
    return out

Most breaches are small and short: the median lasts one day in every regime, since utilisation that drifts over a limit often drifts back. The regimes differ in how the rest end (Table 12.1). When the head of desk approves increases, 45% of breaches are closed by raising the limit; breaches are the shortest, and the desks spend 2.44% of their days above the limit they started the year with. Requiring the committee’s approval cuts increases to 14% and time above the original limit to 1.33%, but breaches last longer while desks wait for a meeting (Proposition 12.5): 43.5 breach-days a year against 31.8, and more of them reach severity 2 or 3. Making desks cut while they wait keeps the committee’s control and removes the delay: 5% of breaches end with an increase, the mean duration is 1.25 days, and the desks spend 0.74% of their days above their original limits.

What to change next. Record each increase with its approval day and check it with firm.escalation.backdated; give the desks a position that is left out of the usage for three months and see which register metric notices it first.

12.5 What the risk officer looks for

A register that only counts breaches misses the failures of the public record, which were patterns rather than events. The risk officer looks for:

• limits raised, or models changed, while a breach is open, and temporary increases that are renewed rather than allowed to expire;
• changes that take effect before they were approved;
• positions outside the measure: exposures left out of the usage calculation or out of the stress tests because they are new, illiquid or hard to model (the examiner found the firm’s stress tests excluded its commercial real estate and private equity investments);
• limits recalculated with new assumptions that produce a larger number at the moment a larger number is needed;
• exceptions without an owner or an expiry, and a committee that approves everything it is asked.

Culture cannot be read off a register, but its traces can: the share of breaches closed by increases, the share of flagged breaches, the time from a breach to the committee’s hearing of it, the number of exceptions past their expiry. The examiner found that management had treated the firm-wide limit as a “soft” guideline while describing it to its regulator and board as a meaningful constraint. On the question the examiner had to answer, the report found insufficient evidence that the senior officers’ conduct in managing risk fell outside the business judgement rule or was reckless or irrational: decisions that proved unwise were, legally, still decisions management was entitled to make. The lesson for a risk function is that its authority must be written into the procedure, since it cannot rely on the law to supply it after the event.

12.6 Build: the escalation register

12.7 Exercises

12.8 Problem: Raised to Fit

12.9 Interview questions