External reporting: compliance and documentation risk

Billions of dollars have been lost in the financial services industry due to compliance
violations and documentation errors. The misuse or misapplication of derivative
instruments has been a major factor in many of these losses. The actual violations
have ranged from inadequate disclosure to clients, unlicensed sales personnel,
improper corporate governance, ultra vires transactions, and inadequate or errorprone
documentation. The root causes have been primarily insufficient or outdated
controls or failure to enforce controls. The media focus on these major losses due to
lax internal controls or violations of external regulatory requirements has become a
permanent blotch on the reputation of the industry.
While Value-at-Risk and stress scenarios can help optimize the use of risk capital
and improve returns, large equity losses are often the result not of market risk but
rather of compliance failures. Often it is a trusted or highly regarded employee (often
long standing) who causes the damage. Typically, the loss is not triggered by a single
event but occurs over time. A recent example occurred in Chicago in late 1998, where
a futures brokerage was being sold. Just prior to the scheduled closing, the CFO of
Griffin Trading Co. revealed that he had lost millions by trading stock options with
the firm’s money. The unauthorized trading went undetected for more than a year
and the company became another compliance casualty (see Ewing and Bailey, 1999).
While compliance and documentation risks can never be eliminated, they can be
contained. This chapter is intended as a broad overview of compliance risk and
highlights the major issues confronting manager of derivatives sales staffs. It focuses
on practical methods to ensure compliance that will survive the continuing consolidation
of financial service companies and changes in regulatory oversight. This chapter
is divided into four main parts:
Ω Structuring a compliance unit
Ω Creating enforceable policies
Ω Implementing compliance policies
Ω Reporting and documentation controls.

There will be reference throughout the chapter to actual losses that have occurred
to emphasize the critical importance of appropriate controls. The goal is not to detect
actual problems. Rather it is to discover ineffective, omitted, or outdated controls
that could lead to actual losses. The reader should have an overview of why compliance
controls are critical and how they can be used to limit business risk.
A compliance unit should play an active role in a firm’s business strategy. It
enables business lines to optimize revenues by limiting non-market risks such as
credit, operations, and reputational risk. In many firms, however, compliance is
viewed as an add-on expense and an impediment to performance. It is perceived to
drain valuable resources and time and to serve as an adversary to achieving business
goals. This chapter reflects the view that compliance is necessary and beneficial.
Complying with external regulations and internal policies will insure greater consistency
of performance and will in the long run, reduce capital needed to fund incidences
of operational failure and fraud.