Volatility: Enemy #1…

Organizations implement Operational Risk solutions to lower "volatility" in earnings growth and return on capital. The focus on volatility is because no institution likes to see peaks and valleys in their earnings or their return on capital.

A steady and consistent growth curve without "Volatility" is the goal by many steadfast organizations.

Contrary to the goal of minimized "volatility" there are also those who feed off of the chaos and the large swings between these highs and lows in the marketplace and with specific companies in vital sectors of the financial economy. Will another Blueprint for Regulatory Reform be the answer?

As a hedge fund investor, can you explain what the strategy is for your investment fund? Do you know what your money is being invested in?

Does your hedge fund manager provide transparency on calculating your return on funds invested? What was the reason you invested in alternative investments to begin with?

Carrying this analogy to the operational processes within your organization, the goal is to keep the processes running smoothly. When people or systems deviate from the agreed upon "Rule Sets" then change ensues along with the volatility of the performance measures.

Errors, Omissions and systemic "glitches" are the catalysts to volatility that creates fear, uncertainty and doubt.

Do you understand the Math? When the process gets to this stage and people don't trust the rules anymore, you are on the brink of a failure and impending loss, in dollars and/or peoples lives.

Operational Risk Management is a discipline that is remerging in our corporate ranks because it has already proven that it saves lives. The regulators and inspector generals are going to raise it’s mandate within our institutional ranks once again.

The "Rule Sets" of playing business in the financial, health care and energy sectors are not the only ones being subjected to this increased scrutiny and renewed focus on OPS Risk as lessons were learned over 15 years ago:

“In March of 2008, the Department of Defense learned that four non-nuclear nose cone assemblies and their associated electrical components for a ballistic missile where mistakenly shipped to Taiwan in the fall of 2006. These items were originally shipped in March 2005 from F.E. Warren Air Force Base in Wyoming to the Defense Logistics Agency warehouse at Hill Air Force Base in Utah. There are no nuclear or fissile materials associated with these items.

Upon learning of the error, the U.S. government took immediate action to acquire positive control of the components and arranged for their safe and secure recovery to the United States. These items have been safely returned to the United States.”

After this event, lessons learned and “After-Action-Reports” were generated in the ranks of the U.S. Treasury Department and the Department of Defense all relating to the failure of People, Processes, Systems and or External events.

Operational Risk is all around us and continuously ready for prime time focus in terms of our leadership strategy execution, implementation and measurement.

Whether you utilize Operational Risk Management (ORM) in the Defense Industrial Base or in another Critical Infrastructure sector in the United States, it’s important to revisit what it is NOT:

Operational Risk is Not:

• About avoiding risk
• A safety only program
• Limited to complex-high risk evolutions
• A program -- but a process
• Only for on-duty
• Just for your boss
• Just a planning tool
• Automatic
• Static
• Difficult
• Someone else’s job
• A well kept secret
• A fail-safe process
• A bunch of checklists
• Just a bullet in a briefing guide
• “TQL”
• Going away

The goal of Risk Management is not to eliminate risk, but to manage risk so the mission can be accomplished with minimum impact...

Algo Bots: The Risk of Human Error...

What "Trust Decisions" did you make this past week?  How fast did you make them?  The ability to manage an entire portfolio of operational risks in a daily routine is daunting.  How do you prioritize? What Operational Risk Management (ORM) process will you engage in, with so many uncertain outcomes?  Why will you sit up in bed at 3AM, to read the latest alert on your smartphone?

In October of 2012, this ORM blog discussed the topic of "Algo Bots" and "Dark Pools".  Machine language talking to other machines, to make optical network speed decisions and more precise, "Trust Decisions."  What is the risk of a low probability and high consequence incident when humans are taken out of the equation?  Dave Michaels of Bloomberg explains the current focus:

Mary Jo White’s blueprint for imposing tighter controls on high-frequency traders and some of the murky venues they inhabit stops short of a crackdown. 

The U.S. Securities & Exchange Commission’s plan, unveiled by White in a speech this week, advanced some new ideas while borrowing heavily from existing proposals and measures that already have support on Wall Street. While stock exchanges, rapid-fire traders and private trading venues known as dark pools all would come under new scrutiny, White didn’t embrace the kind of tighter restraints that have been enacted in countries such as Australia and Canada. 

White isn’t acting in a vacuum. She is responding to political pressures raised by an investigation by the New York attorney general into whether speed traders prey on slower-moving investors as well as a book by Michael Lewis, “Flash Boys,” that condemned the role of exchanges and brokers in enabling unfairness. She announced the initiatives even as she said U.S. markets aren’t rigged and serve the goals of retail and institutional investors.

As an Operational Risk Management (ORM) professional, you have to stay on the edge.  You must imagine the future and dive into the current R&D of innovation.  Being a futurist is staying on the bleeding edge of technology and this is just one facet of the risk mosaic.  The other and more human factor oriented component are the TTP's.  Tactics, Techniques and Procedures (TTP) are what you need your own "Opposition Research" team to be studying.  This is your opportunity to gather the intelligence on your competition and simultaneously look at your own vulnerabilities.  Sam Mamudi and Keri Geiger explain:

The U.S. Securities and Exchange Commission cited Wedbush Securities Inc. and Liquidnet Holdings Inc. for violations of stock market rules, taking tangible steps a day after Chairman Mary Jo White outlined her plan to improve Wall Street trading. 

Wedbush, which the SEC said is among the five biggest Nasdaq Stock Market traders, failed to vet clients who broke the law as they placed billions of dollars of transactions in the stock market, the regulator said. Two current and former Wedbush executives, Jeffrey Bell and Christina Fillhart, were also targeted in the complaint. 

Liquidnet, one of the biggest independent dark pool operators, agreed to pay a $2 million fine for not living up to client secrecy standards on its private trading platform.

So what?  The Rise of the Machine Traders:

In the beginning was Josh Levine, an idealistic programming genius who dreamed of wresting control of the market from the big exchanges that, again and again, gave the giant institutions an advantage over the little guy. Levine created a computerized trading hub named Island where small traders swapped stocks, and over time his invention morphed into a global electronic stock market that sent trillions in capital through a vast jungle of fiber-optic cables. 

By then, the market that Levine had sought to fix had turned upside down, birthing secretive exchanges called dark pools and a new species of trading machines that could think, and that seemed, ominously, to be slipping the control of their human masters. Dark Pools is the fascinating story of how global markets have been hijacked by trading robots--many so self-directed that humans can't predict what they'll do next.

So how do you mitigate the potential risk of a rogue algorithm? Some have devised a mechanism called a circuit-breaker. In other words, an alarm that something is not normal. Let's slow down until we can understand what is going on here. What are some other ways that we could potentially address the threat or the vulnerability? Was the "Flash Crash" a weak signal of a pending melt down of the complete system?

Or is this just the next natural phase of the future growth curve.  Who will you put your faith in for your next "Trust Decisions"...

operational risk

Social Media Risk: Situational Awareness on Wall Street to Main Street...

It has been a wild few weeks for Twitter and the Operational Risks associated with account hijacking and "Tweets" that may compromise the positions of active police activities. The Boston Police were
warning people via their official Twitter account:

The first official announcement that law enforcement agencies had concluded their manhunt for Boston Marathon bombing suspect Dzhokhar Tsarnaev didn’t come at a press conference by police commissioner Ed Davis or Mayor Tom Menino. It didn’t come from a press release or a dispatch over a police scanner. It came instead from two tweets:

Boston Police Dept. ✔ @Boston_Police#MediaAlert: WARNING: Do Not Compromise Officer Safety by Broadcasting Tactical Positions of Homes Being Searched.   8:52 AM - 19 Apr 2013 

Boston Police Dept. ✔ @Boston_Police#MediaAlert: WARNING - Do Not Compromise Officer Safety/Tactics by Broadcasting Live Video of Officers While Approaching Search Locations 1:14 PM - 19 Apr 2013

Social Media and a hacked AP Twitter account were the catalyst for a sudden drop in the financial markets. As the news service realized what had occurred they contacted their employees in the White House briefing room to refute the information:

Twitter Inc. plans to bolster security on its site after the account of the Associated Press news service was hacked and an erroneous post triggered a stock- market decline, according to a person familiar with the matter. 

Two-step authentication will be introduced to make it harder for outsiders to gain access to accounts, said the person, who declined to be identified because the information isn’t public. In addition to a password, the security measure requires a code sent via text message to a user’s mobile phone, or generated on a device or software. 

Twitter’s defense against password theft came under scrutiny this week after a hacker sent a false post about explosions at the White House, triggering a drop that wiped out $136 billion in value from the Standard & Poor’s 500 Index.

Social Media is becoming a way of real-time situational awareness and organizations that have ignored the potential impact on its Operational Risk are now paying attention. Proactive steps are now being taken to not only monitor the daily feeds on official company twitter accounts and also upgrade the security of those feeds by using multi-factor authentication.

Companies such as Duo Security are going to start seeing an uptick in their web site activity as a result of these latest hacks on Twitter and others. Why? Because it works.

Corporate integration of public relations and information security are not anything new per se. What is getting more attention is how social media has become a catalyst for changing human behavior. Even more revealing is how automated trading systems react to a false tweet on Twitter. Have the algorithms gone too far in high frequency trading? Not really. HFT professionals don't let Twitter change their strategies. Here is a dose of reality:

There is little predictive value in the events of the, "Hack Crash." However, there are some key takeaways for traders. First is the importance of protective stops. One never knows what could happen next. Second, verify news reports. I have the AP's iPhone app, which alerts me to breaking news and had no mention of the tweet until after the fact. Therefore, the corporate disconnect between Twitter and their app was my first clue it was bogus. Finally, cut the high frequency traders some slack. Their programs are based on risk and reward just like our own and the liquidity they provide in times of dramatic events is exactly what allows us to get out of the market and keep some powder dry until the smoke clears.

What will continue to be an ongoing trend in corporate ranks is the need to continuously monitor social media and to spend the time on due diligence to determine what is real and what is simple "Information Operations." (IO) in the corporate ranks and across Wall Street is the name of the game. Those who understand how to manage their monitoring and deal with the daily anomalies will be able to mitigate the major risks to the enterprise.

Our only hope is that the thousands of major law enforcement agencies across the globe, are doing the same. @Boston Police is a good place to start with any lessons learned.

operational risk

Dark Pools: OPS Risk of Rogue Algorithms...

When you begin to think about the potential Operational Risks we face everyday, they are so wide and so numerous that each organization has developed their own methods for Enterprise Risk Management.  Depending upon the industry you are in and the speed of your business will determine the subject matter expertise that is required to deter, detect, defend and document your particular operational risks.

This is business as usual in the Financial Services industry.  Yet what about those low probability and high consequence incidents that are looming over the horizon?  The "Black Swans" as they have been defined in the past few years.  What if these "Black Swans" were known to exist everyday and could be witnessed swimming around in what are known as "Dark Pools."  You know, the places where the "Algo Bots", Quants and those who win, are doing so at the speed of light.  In the milliseconds of time it takes, for one algorithm to buy and another to sell within the trading exchanges, we can only continue to pray that the mathematics does not go rogue:

A news-breaking account of the global stock market's subterranean battles, Dark Pools portrays the rise of the "bots"- artificially intelligent systems that execute trades in milliseconds and use the cover of darkness to out-maneuver the humans who've created them.
In the beginning was Josh Levine, an idealistic programming genius who dreamed of wresting control of the market from the big exchanges that, again and again, gave the giant institutions an advantage over the little guy. Levine created a computerized trading hub named Island where small traders swapped stocks, and over time his invention morphed into a global electronic stock market that sent trillions in capital through a vast jungle of fiber-optic cables.  
By then, the market that Levine had sought to fix had turned upside down, birthing secretive exchanges called dark pools and a new species of trading machines that could think, and that seemed, ominously, to be slipping the control of their human masters. 
Dark Pools is the fascinating story of how global markets have been hijacked by trading robots--many so self-directed that humans can't predict what they'll do next. 

Managing Operational Risk with the underground "Dark Pools" is a stretch.  No different than trying to understand something as easy as CDO's or a tranche of sub-prime mortgages from a zip code in Las Vegas all packed up in a Wall Street product you now recognize as a Mortgage-Backed Security (MBS):

Low quality mortgage-backed securities backed by subprime mortgages played a major role in the 2007–2012 global financial crisis. By 2012 the market for high quality mortgage-backed securities had recovered and was a profit center for banks in the United States.

High Frequency Trading (HFT) is not new.  It has been evolving for years.  The battle for speed, has even changed the way organizations think about buying their circuits for telecommunications and data communications, between these increasingly complex and sophisticated computing critical infrastructures.  Here is one example:

Ridgeland, MS - September 17, 2012 -Spread Networks, LLC, a privately owned telecommunications provider, today announced the deployment of 100G technology on Spread's industry leading Chicago to New York fiber backbone. Spread's new service offers customers access to 100 gigabits per second of optical bandwidth, unregenerated, on Spread's 14.6 millisecond round-trip best-latency-in-class Ultra Low Latency Chicago-New York Wavelength service.  Spread's flagship Ultra Low Latency Chicago-New York Dark Fiber service is now operational at a roundtrip latency of 12.98 milliseconds roundtrip, a 100 microsecond improvement from Spread's previous 13.1 millisecond offering.  The latency improvement over Spread's dark fiber, which is already implemented, is the result of continuous route improvements that Spread has undertaken since going live in August, 2010.  Spread's 12.98 millisecond dark fiber offering provides customers with unlimited bandwidth on a 99.999% available service at the lowest latencies achievable by fiber optic networks between these two financial centers.  For financial customers who value low-latency and reliability for their mission critical trading applications, there is no other comparable solution.

Most people at the SEC, Federal Reserve and the DOJ fully understand the need for business to do whatever it takes to create a competitive advantage.  What however still remains our "Single-Point-of-Failure" is the math.  The mathematics that make up the algorithms.  The zeros and ones of software code that tell the computers what to do and when to do it.  How many people really can understand it and explain it?

So how do you mitigate the potential risk of a rogue algorithm?  Some have devised a mechanism called a circuit-breaker.  In other words, an alarm that something is not normal.  Let's slow down until we can understand what is going on here.  What are some other ways that we could potentially address the threat or the vulnerability?  Was the "Flash Crash" a weak signal of a pending melt down of the complete system?

We are increasingly dependent on computers for all that we do, and the government won’t always be able to prevent their malfunctioning from causing serious problems. But the many glitches that have plagued financial markets in the past couple of years should serve as a sobering reminder that financial markets have evolved much more quickly in the past decade than regulators have.As Scott Patterson, author of Dark Pools, a book about high-frequency trading, said to Yahoo Finance Monday, “We have seen a massive revolution in how exchanges work. It’s been put in place extremely fast . . . the problem is that the race for profits at the exchanges and at the high-frequency firms has outpaced their ability to manage risk.”  Read more: http://business.time.com/2012/08/08/high-frequency-trading-wall-streets-doomsday-machine/#ixzz2AWeXPorn

operational risk

Quants: Fear and Loathing in Computer Code...

The Operational and Systemic risk is still lurking in the zero's and one's masking itself in the mathematical blur of algorithms designed by the "Quants". Is "SkyNet" just a few lines of computer code away from creating an incident that no insider can reverse?

Jeremy Grant and Michael Mackenzie of FT are establishing an argument discussed on this blog soon after the economic meltdown began to take place:

Not long after lunchtime one day on the New York Stock Exchange three years ago, unusual things started to happen. Hundreds of thousands of “buy” and “sell” messages began flooding in, signalling for orders to be made and simultaneously cancelled.

The volume of messages sent in was so large that the traffic coming into the NYSE from thousands of other trading firms slowed, acting as a drag on the trading of 975 shares on the board.

The case was made public only last month when the disciplinary board of the NYSE fined Credit Suisse for failing adequately to supervise an “algorithm” developed and run by its proprietary trading arm – the desk that trades using the bank’s own money rather than clients’ funds.

Algorithms have become a common feature of trading, not only in shares but in derivatives such as options and futures. Essentially software programs, they decide when, how and where to trade certain financial instruments without the need for any human intervention. But in the Credit Suisse case the NYSE found that the incoming messages referred to orders that, although previously generated by the algorithm, were never actually sent “due to an unforeseen programming issue”.

It was a close call for the NYSE. Asked if the exchange could have been shut down as it was bombarded with false trades, an exchange official says: “If you had multiplied this many times you’d have had a problem on your hands.”

The Operational Risks associated with the software computer code and the development of the trading algorithms is at the center of the still untouched regulation of how financial products are designed. Once the SEC get's educated on a market practice that is creating substantial systemic risk then the wheels of monitoring and potential "Cramdown" begins to take place.

The difficulty is that responsibility for risk controls does not lie entirely with exchanges and trading platforms. Much of it rests instead with brokers, which increasingly provide access to such venues under an arrangement known as “sponsored access” whereby any trading firm that is not a member of an exchange can “piggyback” on a broker’s membership to gain direct access to an exchange. Until recently, before the SEC clamped down on the practice, traders were able to use a form of this process – “naked access” – to gain access to exchanges without brokers conducting pre-trade risk checks to ensure their algorithms were functioning properly.

In the latest books written by "Reporters" on the so called "Quant risk" going on within the ranks of trading firms across the globe, the focus is on the people themselves more than the systems. Comparing poker players to bridge players is only a small part of the issue at hand with regard to a quantitative traders point of view and mathematical orientation.

Imagine for a moment the complexity of the software systems that now control the trading mechanisms across the world. From Hong Kong to Wall Street, London to Tokyo, the software is written to accomplish tasks that the human is not capable of executing in the multi-split seconds that it takes for buyers to match sellers. One only has to spend a few weeks or a month inside the software coding life cycle management process within the walls of a JP Morgan, Goldman Sachs or Credit Suisse to better understand the Operational Risks that exist for the market as a whole.

The sheer complexity of the systems software code alone is enough to give an uneducated eTrader worry over whether the portfolio they are managing with their retirement nest egg is going to get destroyed by the likes a a super "Cyber Algorithm" designed to out smart and out think that last strategy from the previous nights episode of MSNBC's "Jim Kramer."

The next economic crisis will not be a war of who had toxic assets in their asset portfolio's. It will be a single line of computer code that initiated a sequence of risk mitigation strategies to hedge against another previously executed trade the month before. And because of the error that creates this cyber incident, the market detects a new "Fear Factor" on the horizon.

How about a little Deja Vu:

All of us have been watching the gyrations of Wall Street and the stock market in recent days. With the collapse of Bear Stearns and Lehman, the "rescue" of the failing Fannie Mae-Freddie Mac, and the bail-out of AIG, many people wonder, "Have investors completely lost their minds?" Well, the answer may be, "Sometimes". Here's how we might look at anxious investing during a time of market volatility, uncertainty, bad news, and fear.

How does the anxious investor think? Let's consider two possible investors--- one who is reasonably optimistic and the other who is pessimistic.

operational risk

Decision Advantage: OPS Risk Intel...

The "Wall Street to Main Street" sound bytes are coming fast and furious on our multiple channels of media. Attacks on the US Embassy in Yemen and the Marriott hotel in Pakistan provide us with the other side of the Operational Risk Management Mosaic. Whether the "financial terrorists" are operating in the shadows of their trading accounts or "Islamic Jihadists" assembling components in the garage of an unknown warehouse, risk management is on their mind. And embedded in their operational trade craft.

OPS Risk Intelligence tells us what you are concerned about, or trying to learn more. If you are reading this you may have landed here on the Internet because you were searching for answers on some facet of Risk Management. These are just a few of the items that caught our eye in the last 24 hours:

• does "fre 502" apply retroactively
• security issues 4gw 4th generation warfare ? conflict and completion ? what can we learn from this to management
• levels of risk, operational versus strategic risk
• risk management for trucking business
• hp hewlett packard plant safety risk manager
• cyber risk insurance questionnaire
• memento actimize
• erm for citi bank
• the economics of risk management
• strategic operational risk
• risk management blog
• "country risk" offshore
• what risk is associated with spam?
• ? iso (bs 27001? british standard for information security management, mandated for the nhs in 2001 how to
• bank audit
• case study societe generale
• best practices for seizing electronic evidence
• risk management convergence
• telecom operational risk management training
• risk and human factors
• how military contingency plans are formulated
• financial health suppliers risk management
• bank audit and compliance, risk management

How do I continuously monitor my vulnerability and the likelihood of disaster before I achieve my mission? Hedging the risk on whether a stock will decline in value before a certain date and arriving undetected in a truck with a ton of explosives at a certain time both have several risk factors in common. Stealth is one of them. Therefore, only accurate and timely intelligence gained before the trigger event, can make the difference for the targets survival.

(Reuters) - Goldman Sachs Group Inc (GS.N: Quote, Profile, Research, Stock Buzz) said on Sunday it would become the fourth largest bank holding company and would be regulated by the Federal Reserve.

Goldman said it would move assets from a number of strategic businesses, including its lending businesses, into an entity called GS Bank USA that would have more than $150 billion in assets.

GS Bank USA would be one of the ten largest banks in the United States, with assets that are fully funded for term and available to funded by the Federal Reserve.

By dispatching suicide bombers to the capital—and particularly to such a high-profile target—the extremists appear to be continuing their bid to force the Pakistani government to halt ongoing military operations in the troubled region, which borders neighboring Afghanistan.

But the bombing, which killed some 57 people—most of them ordinary Pakistanis—is being dubbed as the "9/11 of Pakistan," and is seen by many as a declaration of war on the part of local Taliban. It has also suddenly changed the tone of the government leaders who until recently have been publicly mulling peace deals with the militants.

If you are the target of a takeover by your competitive adversary on the global financial landscape or just another "soft target" hotel or other critical infrastructure, the game remains the same. Gaining intelligence that has been validated from a vetted and trusted source, is what creates a "Decision Advantage."


operational risk

A Glitch: NYSE Minor Malfunction...

AS SHAREMARKETS plunged around the world, anxious investors, big and small, sat glued to their computer screens. But the lesson learned from yesterday's market correction was that computer systems just aren't up to scratch when investor panic sets in.

The first malfunction came in New York, where a glitch triggered a sudden plunge in the Dow Jones Industrial Average. Brokers, already spooked by morning falls, could do little but watch on as, at 2pm local time, the Dow fell 200 points in seconds.

Dow Jones said its computer system couldn't handle the vast volume of trades — about 4.5 billion, double the daily average — at the New York Stock Exchange.

If you have been reading Richard A. Clarke's new "Fiction" novel, Breakpoint, the so called "Glitch" had some of us wondering:

The global village--an intricately intertwined network of technology that binds together the world's economies, governments, and communication systems. So large, so vital--and so fragile. Now a sophisticated group is seeking to "disconnect the globe"--destroying computer grids, communications satellites, Internet cable centers, biotech firms. Hard to do? If only that were so.

What is a glitch anyway? Didn't we hear that as an excuse from Virgil Gus Grissom in the "The Right Stuff".? He was pilot of Mercury-Redstone 4 ("Liberty Bell 7"), the second American (suborbital) spaceflight. Following the splashdown of "Liberty Bell 7", the hatch, which had explosive bolts, blew off prematurely, letting water into the capsule and into Grissom's suit. Grissom nearly drowned but was rescued by helicopter, while the spacecraft sank in deep water. Grissom maintained he did nothing to set off the explosives to blow the hatch. "It was a glitch!" Later evidence proved him right.

Whenever you hear the word "Glitch", what are you thinking? Human error. Or Computer error.

n.

1. A minor malfunction, mishap, or technical problem; a snag: a computer glitch; a navigational glitch; a glitch in the negotiations.
2. A false or spurious electronic signal caused by a brief, unwanted surge of electric power.
3. Astronomy A sudden change in the period of rotation of a neutron star.

In the case of the New York Stock Exchange and Liberty Bell 7 we are talking about something that could not be predicted. Maybe not something that had ever been seen before during testing or simulations. Therefore, the only answer could be a glitch. If you are a computer programmer you know exactly what happened. You know where the orders were piling up in the database ready to be tabulated when the systems processes started up again. Being down for an hour with those kind of trading volumes can pile up a few orders in the queue.

Operational Risk Management is about anticipating those occasional "Glitches" and preparing for them in advance. While you may not see the exact variant everytime you create and exercise a scenario, you recognize something similar. You get a feeling that you have seen this before, even if it was in a bad dream. As a Quiet Professional, working to mitigate risks, create a safe haven and achieve your mission, you expect that you will see a glitch today. And if you do, then you will act with confidence and speed to remedy the situation as it unfolds before you.

So you want a look into the crystal ball? As Richard Clarke says, "Sometimes you can tell more truth through fiction." Or is it?

operational risk