Editor at Large

JPM: A Textbook Case of Risk Management Neglect

Print
Email
Reprints
Comments (5)
Twitter
LinkedIn
Facebook
Google+

If risk management is an art, JPMorgan Chase (JPM) is widely considered to be the financial industry's Michelangelo.

We know this because the company came through the 2008 crisis better than the majority of its peers.

Barbara A. Rehm

But what to make, then, of the amateur mistakes revealed by the massive trading losses clocked by the $2.3 trillion-asset company's chief investment office?

This office exists primarily to accomplish a pretty tame task — invest excess liquidity.

Yet according to chairman and CEO Jamie Dimon, the unit's synthetic credit portfolio "morphed." Testifying before the Senate last week and the House on Tuesday, Dimon didn't do much to explain how or why.

"This portfolio morphed into something that, rather than protect the firm, created new and potentially larger risks," Dimon told the Senate Banking Committee. "As a result, we have let a lot of people down, and we are sorry for it."

Answers like that earned Dimon a gentle pass through the Senate Banking Committee last week and while the House Financial Services Committee challenged him more on Tuesday, members didn't follow up on that central issue.

But risk management experts are focused on how this "morphing" was allowed to occur and are appalled by what they consider to be fundamental lapses at JPMorgan.

To start with, the company's chief risk officer didn't have enough control over the CIO unit's risk officer.

"It really started from the moment that the CIO's office could actually manage its own risk without really coming back and informing the rest of the bank," said Clifford Rossi, a former banker and executive-in-residence at the University of Maryland's Robert H. Smith School of Business. "The most important risk management failure comes to the lack of integration of the CIO risk committee with the rest of the company."

Odd, too, that the company's CRO John Hogan is not running JPMorgan's internal investigation into what went wrong. That job was given to Mike Cavanaugh, the head of treasury and securities services and former CFO.

Next, the CIO unit's losses were discovered after a change was made to its value at risk model, and yet weeks after the trading losses surfaced, no one can explain who approved the model change or whether the bank's primary regulator was notified.

JPMorgan says it changed its model in January because it back-tested better than the model the company had been using. In other words, when old data was run through the new model, the results more closely mirrored reality than with the original model. Okay, fine. Circumstances change. But what threw the new model so far off?

Sen. Richard Shelby, R-Ala., asked that during the Senate Banking hearing.

Here is Dimon's answer: "You know, I — I'm gonna have to give you more detail later. But both these models backtest and have backtested better than the old model, is what I believe. And so these are statistical testing of how it would've — what would've been more accurate looking back over the last year or the last three years. But I think I mentioned, with models, that the future is not the past. Things change: concentration, liquidity, people's views about Europe, credit spreads, high yield versus investment grade. And the old model was better at predicting some of the things that happened in April and May than the new model."

It's hard to tell what Dimon was trying to say, but he did not explain why the two models produced such different results.

Which leads to point #3 — why didn't JPMorgan run the new and the old models in tandem for some period of time? That's standard procedure for model changes, and it's included in the federal guidance regulators released in April 2011 on model governance.

"Models are regularly adjusted to take into account new data or techniques, or because of deterioration in performance. Parallel outcomes analysis, under which both the original and adjusted models' forecasts are tested against realized outcomes, provides an important test of such model adjustments," the guidance reads. "If the adjusted model does not outperform the original model, developers, users, and reviewers should realize that additional changes—or even a wholesale redesign—are likely necessary before the adjusted model replaces the original one."

If JPMorgan did any "parallel outcomes analysis" Dimon didn't bother to mention it. If the company ends up being hit with an enforcement action by regulators, it could very well be because it did not follow this guidance.

It's also pretty clear that compensation policy and practice in the chief investment office did not reward risk mitigation. And the unit either had no risk limits or they were ignored.

How about reverse stress-testing? This is another a common risk-management practice designed to imagine worst-case scenarios and work backward to figure out what could lead to disaster. Dimon never mentioned whether the chief investment office bothered to conduct any reverse stress-tests.

JOIN THE DISCUSSION

(5) Comments

SEE MORE IN

Who's Who in Auto Lending Investigations
As U.S. auto lending has boomed, the industry especially its subprime sector has become a growing target for a slew of prosecutors and regulators. Here are seven government agencies to keep an eye on.

(Image: Bloomberg News)

Comments (5)
The missing ingredient in all of risk management is that we have not yet developed an understandable and aggregatable measurement system for managing risk exposures as they accumulate. Models give us approximations of the size of future potential loses not the means to understand why those loses might be rising or diminishing. For that human judgment is needed and for that better techniques and systems for assessing risk exposures are required. When executive management tells congressmen that they do not/cannot run their businesses on the basis of VaR models; when Chairmen of companies say their Board's cannot be expected to understand the granularity of the risks a firm is taking; when CEO's say their regulator cannot be expected to see the kinds of risk that leads to catastrophic losses of the kinds just experienced; then I say something is horribly wrong with the risk management methods and systems the industry has developed with regulators guidance. There is hope now, however, of change as an introspective moment has been thrust upon us in the form of the BIS's recent consultative paper questioning the VaR method in capital computations in the Trading Book. We should seize the moment and question all of the accumulated knowledge that informs us on risk management to date. We have to get on with risk adjusting the financial system. Risk management should not be the oxymoron it has become.
Posted by Allan Grody | Thursday, June 21 2012 at 6:51AM ET
Best starting point for consideration of JPMC's proprietary trading disguised as hedging is the observation that no one pays the head of an investment unit $14 million a year to manage risk, but to take risk.
Posted by jim_wells | Thursday, June 21 2012 at 8:17AM ET
Allan, bravo. For a great perspective on model use in bank risk management, read Models Behaving Badly by Emanual Derman. In essence, these models are developed by brilliant mathematicians but are based on their belief that you can quantify all risk in formulas. What they miss is that human behavior can not always be quantified. I like to use the analogy that every offensive football play is designed to score a touchdown. The reason it does not happen is due to human behavior (all 22 players on the field react and perform differently). I have seen first hand, in a large institution similar to JPM, that predominantly these very intelligent people lack any practical experience in banking outside of their risk quant efforts. Add the presence of smart, aggressive traders comped on profit and you always have a potential problem. The issue is complacency caused by a false sense of security in the models. Humans still need to actively question every thread of activity in a wel designed committee structure.
Posted by Ray Dardano | Thursday, June 21 2012 at 8:20AM ET
The question, as in any market investing, in the long run have your gains out performed your losses. For JPM the answer is yes. Risk management goes way beyond a single function but speaks to the governance of an entire organization. It is a testament to JPM that the loss is little more than a rounding error in terms of impact to their market cap. Models are not intended to be static. They are informed by results good and bad and adjusted accordingly. Everything can be better executed with 20/20 hignsight. However, as they are dynamic the trading loss attributes will likely inform their model and make adjustments accordingly. All of the advice assumes they need it and wont learn and adapt accordingly. I think their results indicate otherwise. Less specific to this article but the noise in general, are we at a point where some will be advocating the best way to avoid risk is to take none. The point being they are banks, the business they are in is taking risks and being able to absorb impacts if they get it wrong. What we dont need is more regulation from those who when making similar bets rarely get it right.
Posted by wkeenan | Thursday, June 21 2012 at 9:04AM ET
Interesting quotes from the article - "This office exists primarily to accomplish a pretty tame task -- invest excess liquidity." and "This portfolio morphed into something that, rather than protect the firm, created new and potentially larger risks,". These statements are in conflict, either the office was taking risk (investing liquidity is not risk-free) or they were engaged in risk reduction activity (hedging). At a high level, this conflict needs resolution, but that will likely never happen as the obfuscation (failed models and other distractors) obscurs this basic question.
Posted by phelpsj | Thursday, June 21 2012 at 10:24AM ET
Add Your Comments:
Not Registered?
You must be registered to post a comment. Click here to register.
Already registered? Log in here
Please note you must now log in with your email address and password.
Already a subscriber? Log in here
Please note you must now log in with your email address and password.