Red-Blooded Risk: The Secret History of Wall Street

Risk Control

Getting back to your middle-office risk management job, you're reporting the VaR back to the front office, along with other statistics about their positions and performance. You highlight any discrepancies that suggest the business may not be under risk control. The precise standards for risk control depend on the business. In many financial businesses you typically ask three things: Can the business estimate the daily volatility of its profit and loss accurately? Can the business tell you its profit and loss accurately conditional on what market prices do during the day? And are the estimated numbers coming out of the business consistent with the actual cash flows from arm's-length transactions with third parties? Not all businesses can answer yes to all three questions, and most businesses have some other questions as well, but these are still the basics. Each one of these things can be measured precisely and objectively.

If you are starting a middle office from scratch, or taking over in a place with poor risk management, you will find most businesses are not anywhere close to being under risk control. The VaRs you compute for these businesses will be inflated by missing and erroneous data. The measured ex post risk will not correspond to the business's ex ante estimates, the ex post profit and loss will not respond to market factors as the business predicted ex ante, and the ex post cash flows will not match the business's ex ante accounting claims. These facts ...