Wendy Brewer, a senior vice president at Bank of Tokyo-Mitsubishi Ltd., explains how to assign responsibilities...and the risks of doing it wrong.

Minimizing Operations Risk

The capacity of any organization to monitor risk effectively can be distilled down to one basic concept: The information or database that is used as a building block must be correct. It is also helpful if the data are centralized, accessible and complete.

Operations responsibilities in any derivatives organization are generic, even if the nomenclature of labor differs from company to company. Operations takes over after a transaction is entered into by the trading desk and provides a separation of function and independent control mechanism, as well as actual processing, confirming and accounting for the trade. Operations also maintains and runs the processing systems and is responsible for the integrity of the data.

Operations for derivatives commonly consists of a strong, highly automated processing area—the back office, combined with a specialized, more flexible middle office. Both these operations components have specific duties designed to provide a system of checks and balances to each other, and to the front office. Generic responsibilities are designated in Table 1 with an example of a traditional breakdown of tasks.

TABLE 1 Generic Responsibilities of Operations: An Example
Traditional Responsibility
Function	Middle Office	Back Office
I . Data Capture
Deal Ticket Review: Provide missing fields	Yes	No
Deal Entry: Input to process system	Yes	Sometimes
Market Data Input: Closing prices and volatility	Yes	No
External Verification: Comparison with observable source	Yes	No
Limit Monitoring: Trading, risk and credit	Yes	No
Credit Exposure Calculation: Potential exposure by deal	Yes	No
Credit Limit Tracking: Available credit line	Yes	No
Static Data Maintenance: Payment instructions, contacts	Sometimes	Yes
2. Documentation
Master Agreements: Preparation and negotiation	Sometimes	No
Confirmations: Outgoing and incoming	Yes	No
Documentation Tracking: Status of outstanding	Yes	Sometimes
3. Processing
Daily Rate Reset Input: Floating rate, index	Sometimes	Yes
Payment/Reset Notifications: Advices to counterparties	Sometimes	Yes
Event Monitoring: Payments, fees, exercise dates	Yes	Yes
Settlement Instructions: Payment preparation/authorization	Sometimes	Yes
Audit Confirmations: Counterparty transaction verification	No	Yes
Hedge Processing: Futures, options, securities	No	Yes
Financing: Repurchase/reverse agreements, loans	No	Yes
Collateral Management: Monitor outstandings	No	Yes
4. Accounting
Portfolio Valuation: Mark to market	Yes	Sometimes
Profit and Loss Preparation: Change in value	Yes	No
Profit and Loss Analysis: Actual vs. estimate	Yes	No
Cash Management: Cash in/out reconciliation	No	Yes
General Ledger Entry: Financial accounting	No	Yes
Statement Reconciliation: Cash. positions	No	Yes

The specific responsibility breakdown between the middle and back office can differ from organization to organization, but the functions are the same. Some organizations now call everything except cleanup and cash disbursement "middle office.” Various phases of the operational process as described above have specific risks that can be identified by function:

Middle office

• Incorrect Deal Entry: Incorrect/ incomplete terms, missing deals
• Unverified Market Inputs: Incorrect market assumptions, wrong prices
• Careless Limit Monitoring: Unauthorized trading, positions
• Late or Incorrect Confirmations: Unconfirmed or incorrect commitments

Back office

• Faulty Event Monitoring: Missed exercise/commitments
• Incorrect Credit Monitoring: Incorrect exposure, collateral
• Error in Payments: Fraudulent, missed, incorrect payments
• Misstated Accounting: Incorrect financials, taxes, regulatory reports
• Incorrect Master Agreements: Missed events, incorrect valuation methodology

Systems

• Inadequate Testing: Incorrect payments, valuations, missed events
• Lack of Functionality: Deals forced into system, manual calculations, inadequate information
• Limited Integration: Multiple systems, incomplete views of transactions, inefficient processing
• Inflexibility: Delay in delivering new products, lost competitive advantage, multiple systems
• Weak Systems Security: Corrupted data, unauthorized access, no audit trail
• Insufficient Backup: Processing delays, lack of timely information

These operational and systems risks also have an impact on other risks such as reputation and profitability. Errors in operations are highly visible. Incorrect payments can negatively impact the perception of the company in the marketplace, resulting in a loss of business. In addition, the profitability of the institution is directly affected by missed option exercise dates or hedges based on incorrect deal terms. The relationship between operations risks and other risk types is further illustrated by reviewing the impact of processing failures on market and credit risk:

Operational Risk	Market Risk Impact	Credit Risk Impact
Incorrect data entry	Incorrect gaps, positions	Incorrect counterparty exposure
Unverified market data	Incorrect valuations, risks	Incorrect potential exposure, collateral
Careless limit monitoring	Limits exceeded, unauthorized trading	Limits exceeded, insufficient line
Incorrect confirmations	Inappropriate hedges	Incorrect counterparty exposure, netting
Faulty event monitoring	Missed exercise, increased risk exposures	Missed payments, increased exposure
Late reports	Trading blind	Unauthorized CPs

In addition to a causal relationship, operations risk also has a compounding effect on market and credit risks. Incorrect valuations lead to exceeding limits and the potential for unauthorized trading or unknown risk positions and sensitivities. This can further result in an inability to react to changing market conditions. Difficulties in calculating potential exposure and credit line usage can result in undue concentration or a deficiency or excess of appropriate collateral. There have been many instances in which incorrect or late information or merely human error have caused companies to double up on their risks instead of reducing them. A company's entire strategy in how to react to adverse market conditions relies heavily on the ability of its operations area to provide correct, timely information for stress testing and portfolio analysis.

Not all operational errors result in catastrophic disaster. To put these operational risk management tools in a more meaningful perspective, here are two case studies based on actual occurrences:

Example 1: Cash-settled Swaptions

Company A has a robust set of operational controls that include separate independent checking of confirmations against deal tickets, dual review of confirmations and multiple reconciliations between confirmations and systems. Errors in the database should be highly unlikely in this environment.

However, Company A's trading desk was informed by the back and middle offices of a swaption exercise date according to correct procedure. The front office calculated a cash settlement price and found it differed greatly from the counterparty's price. In reviewing the documents, it appeared that the settlement methodology was different on the ticket and in the system from what was indicated on the counterparty's confirmation, yield to maturity vs. zero coupon. Operations was immediately asked to explain how this could have occurred.

An analysis revealed that the documentation unit had iron-clad procedures for verification of confirmations that were generated in-house. However, within the fast-moving and complicated environment of derivatives, the documentation for swaption products is being developed by market participants and is always a little different, depending on the counterparty. Therefore, even though operations usually acted as the calculation agent and sent out its own confirmations, it sometimes found it more efficient to sign counterparty agreements for cash-settled transactions.

The incoming counterparty agreements were compared with deal tickets, yet if there were differences, the trader was notified orally, and if the confirmation was correct, a note was put on it and it was signed and sent back. The documentation unit assumed that the traders would process a deal amendment ticket and change their system, but never followed up because no additional or amended confirmation was necessary. A comprehensive review showed at least 10 examples in which the ticket did not match the confirmation. The system did not reflect the amendment in all cases.

Thus, existing control systems were no longer sufficient in a new environment. New controls were immediately developed concerning transactions where counterparties' confirmations were used. Also, procedures were implemented so that deal tickets always had to match confirmations before confirmations from counterparties were signed.

Lessons learned

• Confirmations are a critical control.
• New developments require new controls.
• Periodic review of unusual transactions from original documents is always valuable.
• A separate database for confirmations and processing increases risk.

Example 2: Mutual puts

Company A, again the one with the robust control system, has transactions with mutual puts. These transactions have an exercise date and a notification date. The notification date is quoted in relation to the exercise date (that is, two New York or London business days before). The problem with these transactions came to light as a byproduct of the investigation into cash-settled transactions, but highlights a different operational issue.

The back office was not tracking the notification dates on mutual puts as the system could not handle the additional field and the variable nature of its relationship to the exercise date. Although no financial impact was felt, a beneficial put opportunity could have been missed because notification dates of exercise were not captured in the system. Notification dates of exercise dates, with separate holiday conventions for each, is another complication of cash settlement and is beyond the processing abilities of most systems.

Again, controls were developed and a manual tickler and hard copy reports were generated to track all deals with mutual puts since it was not done automatically by the system.

Lessons learned

• Systems capability will probably not stay abreast of market and product developments and should be reviewed for all elements of new transactions.
• Details are important and correct data capture is essential.
• Occasionally, manual controls are a necessary evil.
• Operations risk management is a proactive activity.

The management of derivatives operations includes a sensitivity to the capricious human element, as well as an extremely technical analysis of the deal terms and systems applications. Strong operational staff and controls can also be a frightening concept, invoking images of a huge bureaucracy and rigid systems and procedures. The worst nightmare of some front offices is an operations person with a badge. To respond to the perception of inmates running an asylum, a common goal should be stressed throughout the organization: an accurate, complete and accessible transaction database that can be used as a platform for efficient processing and portfolio management.