Michael Lewis’s The Big Short: Inside the Doomsday Machine explains the 2008 financial crisis through the handful of investors who saw it coming and bet on it: a one-eyed physician turned fund manager who read the mortgage-bond prospectuses nobody else read, a Deutsche Bank trader who built the case for betting against the housing market and sold it to investors, a short-tempered fund manager who interrogated the people building the machine, and two young men running a fund from a garage who worked out that the mispricing was in the parts of the structure everyone else ignored. Published in March 2010, it is the most readable account of how subprime mortgages were turned into securities rated as safe as government bonds, and of the incentives, at every link in the chain, that made the result predictable. For an internal auditor it is a book about information: who had it, who read it, who was paid not to, and what an organisation looks like when nobody inside it has examined the thing it is selling. This guide summarises the book without reproducing it, sets out the machine and the people, draws out the lessons, maps them to audit practice, and ends with a worked example of a community bank’s audit function reviewing its mortgage origination and sale pipeline against the book’s questions.
In this guide
- The book in one page
- Who Michael Lewis is, and how the book came about
- The machine: from a subprime loan to a triple-A bond
- The people, and what each saw
- The timeline: 2004 to 2008
- The incentives at every link
- The nine ideas worth keeping
- The vocabulary: fourteen terms defined for practitioners
- What it means for internal audit: reading the documents
- The Las Vegas conference, read as a walkthrough
- The criticisms, and what the book leaves out
- Editions, reading time and how to read it
- A one-hour discussion guide for an audit team
- Worked example: Lakeshore Bancorp reads its own pipeline
- Frequently asked questions
- Related guides
The book in one page
| Question | The answer, in our words |
|---|---|
| What is it about? | The investors who bet against the American subprime mortgage market between 2005 and 2008, and what their bets reveal about the machine that turned bad loans into securities the whole financial system held. |
| How did the machine work? | Mortgage lenders made loans to borrowers who could not repay them, sold the loans to Wall Street, which pooled them into bonds; the riskiest slices of those bonds were pooled again into collateralised debt obligations whose top layers the rating agencies rated triple-A; synthetic versions multiplied the exposure without new loans; and insurers and banks held the result as if it were safe. |
| Who saw it? | Michael Burry, who read the loan-level data and bought credit default swaps on the bonds from 2005; Greg Lippmann, who marketed the trade; Steve Eisman and his team, who interviewed the people in the chain and concluded they were either deluded or dishonest; and Cornwall Capital, who found that the double-A tranches were priced as if they could not fail. |
| Why did nobody else? | Because every participant was paid on volume rather than outcome, because the ratings substituted for analysis, because the documents were long and the data was expensive, and because the people who built the machine did not themselves understand it. |
| What happened? | Defaults rose from 2006; the bonds and the CDOs built on them were downgraded and collapsed in 2007 and 2008; the short sellers were paid, several of them by banks that were failing; and the system was rescued in the manner the Too Big to Fail summary describes. |
| Why read it as an auditor? | Because it shows what happens when an organisation sells, holds or rates something nobody inside it has examined, and because its heroes did what auditors are supposed to do: they read the documents and asked the questions. |
| Reading time | About ten hours for the 290-page paperback; it is funny, fast and precise about the instruments. |
Who Michael Lewis is, and how the book came about
Lewis had worked as a bond salesman at Salomon Brothers in the 1980s and written about it in Liar’s Poker, the book that made him. Twenty years later he returned to Wall Street to find out how the mortgage machine had been built and who had understood it, and he found that the people who had bet against it were few, eccentric and willing to talk. The book, published by W. W. Norton in March 2010, was a bestseller and became an Academy Award-winning film in 2015. Lewis’s method is character: he explains systems through the people who saw them clearly, and the explanation of synthetic CDOs in the book is better than most textbooks because it is told through someone working it out. The limits of the method, discussed below, are that the people he chose are the heroes and the institutions are the backdrop.
The machine: from a subprime loan to a triple-A bond
An auditor should be able to reproduce the chain, because every link is a control point and the book shows each one failing.
| Link | What happened | The control that failed | The incentive that drove it |
|---|---|---|---|
| Origination | Lenders made loans with low teaser rates that reset after two years, to borrowers with no documented income, often for more than the house was worth | Underwriting standards; verification of income and appraisal | The lender sold the loan within weeks and was paid on volume |
| Securitisation | Investment banks bought the loans, pooled thousands into a bond, and sliced it into tranches that absorbed losses in order | Due diligence on the loans; representations and warranties that were real | Fees on issuance; the loans were someone else’s problem within months |
| Rating | The agencies rated the senior tranches triple-A using models that assumed house prices would keep rising and that defaults across regions were weakly correlated | Independent analysis; model validation; refusal to rate | The issuer paid for the rating and could take its business to a competitor |
| Re-securitisation | The lowest-rated tranches of many mortgage bonds were pooled into a CDO, and the top of the CDO was rated triple-A again | Look-through to the underlying loans; limits on re-rating | A CDO manager paid to assemble; a bank paid to sell |
| Synthetic exposure | Credit default swaps referencing the bonds let banks create CDOs without buying any loans, multiplying the exposure to the same borrowers | Counterparty limits; understanding of what the firm held | Demand for triple-A yield; the short sellers needed someone to take the other side |
| Holding | Banks, insurers and funds held the senior tranches as near-cash; AIG insured them; the holders did not read the structures | Investment policy that looks through ratings; valuation independence | The yield was higher than Treasuries for the same rating |
The chain is the credit risk guide‘s subject at industrial scale, and the model risk audit guide covers the rating models whose correlation assumptions were the hinge. The book’s contribution is to show that the information needed to see the failure existed at every link, in the loan tapes and the prospectuses, and that almost nobody was paid to read it.
The people, and what each saw
| Person | Position | What they did | What it represents |
|---|---|---|---|
| Michael Burry | Manager of Scion Capital, a hedge fund | Read the prospectuses and loan data for hundreds of mortgage bonds, identified the worst pools, and persuaded banks to sell him credit default swaps on them from 2005; endured an investor revolt while waiting | Primary-source analysis; the auditor who reads the documents |
| Greg Lippmann | Trader at Deutsche Bank | Built the case for the short, with an analyst’s data on default rates and house prices, and marketed it to funds; the bank’s own CDO desk was on the other side | The insider who saw the machine from within and sold the bet against it |
| Steve Eisman | Manager at FrontPoint Partners | Interviewed lenders, CDO managers and rating analysts, and concluded from their answers that the chain was built on ignorance; shorted the bonds and the companies | Inquiry; the auditor who asks the people in the process what they understand |
| Charlie Ledley, Jamie Mai and Ben Hockett | Cornwall Capital | Found that double-A tranches of CDOs were priced as nearly riskless when they were nearly worthless, and bought protection at trivial cost | Looking where nobody else is; mispricing in the overlooked part of the structure |
| Wing Chau | A CDO manager | Assembled CDOs from the worst tranches for fees, with no interest in their performance; the dinner with Eisman is the book’s central scene | The agent paid on volume |
| Howie Hubler | Trader at Morgan Stanley | Shorted the riskiest tranches and funded the position by selling protection on the triple-A tranches, losing about $9 billion when both fell | Partial understanding; hedged in form, exposed in substance |
| The rating analysts | Moody’s and Standard and Poor’s | Rated what the banks presented, with models the banks had learned to satisfy | The captured gatekeeper |
The timeline: 2004 to 2008
| Date | Event | Why it matters |
|---|---|---|
| 2004 to 2005 | Subprime origination accelerates; interest-only and no-documentation loans spread; Burry begins buying credit default swaps on the worst bonds in May 2005 | The analysis existed three years before the collapse |
| 2006 | House prices stop rising; early-payment defaults climb; Lippmann’s presentation circulates; Eisman and Cornwall take positions; the ABX index allows the trade to be priced | The data turned before the ratings did |
| January 2007 | The securitisation industry’s conference in Las Vegas; Eisman meets the CDO managers and rating agencies and finds nobody who understands the structures | The book’s portrait of an industry that cannot explain itself |
| February to July 2007 | Subprime lenders fail; two Bear Stearns hedge funds collapse; the rating agencies begin mass downgrades in July | The machine begins to run backward |
| August 2007 to March 2008 | Credit markets freeze; the banks mark down CDO holdings; Bear Stearns is sold | The holders discover what they own |
| September 2008 | Lehman fails; AIG, which insured the senior tranches, is rescued; the shorts are paid, some by counterparties that are themselves failing | The end, covered in the Too Big to Fail summary |
The incentives at every link
The book’s deepest point is about incentives rather than instruments, and an auditor should state it plainly: at every link in the chain, the party was paid on the transaction and bore no consequence of the outcome. The originator was paid when the loan closed and had sold it by the time it defaulted. The bank was paid when the bond was issued. The rating agency was paid by the issuer for the rating, and lost the business if it refused. The CDO manager was paid on assets under management. The salesman was paid on the sale. Only the final holder bore the loss, and the final holder had been told, by a rating, that there was no loss to bear. The fraud risk guide treats compensation tied to volume without outcome as a condition of fraud risk; the book shows it producing a catastrophe without any individual needing to commit one. For an audit function the question in any process is the same: who is paid on the transaction, who bears the outcome, and does anyone between them have both the information and the incentive to say no?
The nine ideas worth keeping
- Read the documents. Burry’s edge was labour: he read what was available to everyone. An audit function’s edge is the same, and the professional skepticism guide is about applying it.
- A rating is an opinion paid for by the seller. Any external assessment should be read with the fee arrangement in mind; the agencies were gatekeepers who could be shopped.
- Models encode assumptions; assumptions encode interests. The correlation and house-price assumptions in the rating models were the ones that produced the ratings the issuers wanted. Model validation that does not test assumptions against interests tests nothing.
- Volume pay without outcome risk is a control failure. It appears in origination, sales, procurement and trading, and it predicts behaviour better than any code of conduct.
- Ask the people in the process what they understand. Eisman’s interviews were his evidence; a process whose participants cannot explain it is a process nobody controls.
- Complexity is where the mispricing hides. Cornwall found the error in the tranche nobody analysed; audit coverage should go where the analysis is thinnest, not where the attention is.
- Hedged in form can mean exposed in substance. Hubler’s trade was a hedge on paper and a $9 billion loss in fact; the economics of a hedge, not its label, are the audit subject.
- Being right early looks like being wrong. Burry’s investors revolted and tried to pull their money out; an audit function that reports a risk before it materialises should expect the same and keep the record.
- The holder is the only one who checks too late. Whoever ends up holding the asset, the risk or the counterparty is the one whose due diligence mattered, and the one who relied on everyone else’s.
The vocabulary: fourteen terms defined for practitioners
| Term | What it means in the book | What it looks like in an audit |
|---|---|---|
| Subprime mortgage | A loan to a borrower with weak credit, often with a teaser rate | Underwriting standards; the credit risk guide |
| Mortgage-backed security | A bond paid from a pool of mortgages | The securitisation process and its due diligence |
| Tranche | A slice of a securitisation with a defined place in the loss order | Where the risk sits; look-through analysis |
| Collateralised debt obligation (CDO) | A security built from other securities, often the low tranches of mortgage bonds | Re-securitisation; the test is whether anyone has looked through to the loans |
| Synthetic CDO | A CDO built from credit default swaps rather than bonds | Exposure without ownership; counterparty risk |
| Credit default swap (CDS) | Protection against a bond’s default, for a premium | The short sellers’ instrument; AIG’s undoing |
| ABX index | An index of subprime mortgage-bond credit default swaps | The price that made the trade visible from 2006 |
| Teaser rate | A low initial rate that resets higher | A loan feature that predicts default; a data field to test |
| No-documentation loan | A loan made without verifying income | The verification control that was removed |
| Rating shopping | Taking a deal to the agency that will rate it highest | The gatekeeper paid by the gated |
| Correlation assumption | The model input for how defaults move together | The hinge of the rating models; see the model risk audit guide |
| Mezzanine | The middle tranches, rated below the senior and above the equity | Where the CDOs were built from |
| Loan tape | The loan-level data behind a securitisation | The document Burry read; the population an audit should test |
| Representations and warranties | The seller’s promises about the loans | Enforceable only if someone checks them |
What it means for internal audit: reading the documents
The book’s lessons apply most directly to lending, securitisation, investment and any process in which the organisation relies on an external assessment of something it has not examined. The table maps them to tests. The credit risk guide, the third-party risk guide and the model risk audit guide carry the detail.
| Lesson | Control the audit function should expect | Test that produces evidence |
|---|---|---|
| Read the documents | Due diligence on acquired loans, securities and counterparties that examines the underlying data, not the summary | For the last three significant acquisitions of assets, obtain the loan-level or asset-level data reviewed and the exceptions found |
| Ratings are opinions | Investment and credit policies that require internal analysis for material holdings regardless of external rating | Sample ten rated holdings; find the internal analysis; note any held on the rating alone |
| Assumptions encode interests | Model validation that tests key assumptions against alternatives and identifies who benefits from each | Read the validation report for the credit or pricing model; look for the assumption-sensitivity section |
| Volume pay without outcome risk | Compensation design review: deferral, clawback, outcome measures for originators, sales and traders | Compare the pay plans of the three highest-volume roles with the outcomes of what they produced |
| Ask the participants | Process walkthroughs that record what participants understand, not only what they do | Interview three people in a complex process and ask each to explain the end-to-end risk; record the answers |
| Coverage where analysis is thinnest | Audit universe scoring that weights complexity and the absence of independent review | Add a “last independently analysed” field to the universe; audit the oldest |
| Hedges in substance | Hedge effectiveness measured economically, with counterparty and basis risk | Re-perform the economics of the largest hedge; see the interest rate risk guide |
| Keep the record of early warnings | Audit findings and risk reports retained and tracked to outcome | The issue tracking guide‘s method; a review of warnings that were overruled |
The Las Vegas conference, read as a walkthrough
The chapter an auditor should read twice is the one set at the securitisation industry’s annual conference in Las Vegas in January 2007, where Eisman and his colleagues spent the conference interviewing the people who made the machine run. The scenes read as a process walkthrough conducted by someone with no reason to be polite. A rating-agency analyst could not say how the models would behave if house prices fell, because the models had not been asked. A CDO manager explained that his job was to assemble what the banks sent him and that he did not expect to be the one holding the result. Lenders described borrowers in terms that made the loans sound like a bet on the collateral rather than on repayment. Nobody Eisman met was lying, exactly; each had a bounded view of his own link, and each assumed the others had checked. The conclusion the scenes support is less that the industry was criminal than that it was ignorant of itself, which is a more dangerous condition because it has no one to prosecute.
The method transfers directly. A walkthrough in which the auditor asks each participant not what they do but what they understand about where the risk goes, and records the answers side by side, is the most efficient test of a complex process the profession has, and the audit interview techniques guide describes how to run it. The point is not to catch anyone out. It is to discover whether the organisation, taken as a whole, understands what it is doing, and the Las Vegas chapter is the demonstration that a large, profitable, regulated industry can fail that test for years without anyone noticing, because nobody was asking the question in a room where the answers could be compared.
The criticisms, and what the book leaves out
The book has been criticised on three grounds. First, it is a story of heroes, and the heroes were speculators: they made money from a collapse that ruined millions, and the book’s admiration for them can read as indifference to that. Second, by concentrating on the few who saw it, it understates how visible the problem was to many who did not act, including regulators, which the official inquiries documented; the short sellers were not the only people with the data, merely the only ones who bet on it. Third, it is light on the regulators, the central bank and the politics, and on the global dimension, since European banks were among the largest holders. The explanation of the instruments has held up; the moral framing is contested. For an auditor the response is to take the method and leave the romance: the heroes read the documents and asked the questions, which is a job description, not a personality type.
Editions, reading time and how to read it
| What | Details | Best for |
|---|---|---|
| Hardback | W. W. Norton, March 2010, about 270 pages | The first edition |
| Paperback | Norton, 2011, with an afterword | The edition most readers own |
| Audiobook | Unabridged | Works well; the instruments are explained in narration |
| Film | The 2015 film, with its celebrated explanatory interludes | A team introduction; the book is more precise about the trades |
| Reading plan | The Burry chapters, the Las Vegas conference chapter, the Cornwall chapters | An auditor who wants the method in two evenings |
| Companion reading | The Too Big to Fail summary for the rescue; the Financial Crisis Inquiry Commission report (2011) for the institutional record | The full arc |
A one-hour discussion guide for an audit team
- Fifteen minutes: what do we hold that nobody has read? List the organisation’s material assets, counterparties or products that are held on the strength of an external assessment, a rating, a certificate, a vendor’s assurance, with no internal analysis of the underlying thing.
- Ten minutes: who is paid on the transaction? For the organisation’s largest revenue or origination process, name who is paid on volume and who bears the outcome. Identify anyone between them with both the information and the incentive to refuse.
- Fifteen minutes: the Eisman interview. Pick a complex process and ask three participants, in turn, to explain where the risk in it ends up. Compare the answers.
- Ten minutes: the overlooked tranche. Ask which part of the organisation’s universe has not been independently analysed for the longest, and whether the plan covers it.
- Ten minutes: the plan. Decide which of the eight tests belong in the next plan; the risk assessment guide describes the documentation.
Worked example: Lakeshore Bancorp reads its own pipeline
Lakeshore Bancorp is a fictional $9 billion community bank holding company with an internal audit function of twenty-two. Its mortgage business originates loans through its branches and through third-party brokers, sells most of them to the agencies and to private securitisers, and holds a portfolio of mortgage-backed securities in treasury. The 2027 mortgage review was built on the book’s questions rather than on the standard compliance programme.
| Question | What Lakeshore found | Result |
|---|---|---|
| Does anyone read the loan tapes we buy and sell? | Loans sold carried representations and warranties; the bank’s pre-sale quality control sampled 2 percent of branch loans and none of the broker loans, which were 40 percent of volume | Finding: broker loans added to pre-sale sampling at a higher rate; the first quarter’s sample found income-verification exceptions on 9 percent |
| Are securities held on the rating alone? | Treasury’s mortgage-backed holdings were agency securities with internal analysis; two private-label securities, 3 percent of the portfolio, were held on their ratings with no look-through | Observation: look-through analysis performed; one security’s underlying collateral quality was weaker than its rating implied; the position was reduced |
| What do the models assume? | The pricing model for broker loans assumed a prepayment and default profile from 2015 to 2022 data | Observation to the model owner; a sensitivity to a higher-rate, higher-default scenario added; the model risk guide cited |
| Who is paid on volume? | Brokers were paid on closing; the bank’s own originators had a volume bonus with a clawback for early-payment default that had never been invoked | Finding: the clawback tested and found inoperable in the payroll system; fixed |
| Can the participants explain the risk? | Branch originators could explain the credit decision; nobody in the business could explain what happened to a loan after sale if it defaulted within the warranty period | Observation: a repurchase-risk briefing for the business; a repurchase reserve review added to the plan |
| Where has analysis been thinnest? | The broker channel had not been audited since 2021 | The next year’s plan scheduled it |
The review produced two findings and three observations in a business that had passed its compliance review every year. The difference was the question: compliance asks whether the file is complete; the book asks whether anyone has read it, who is paid for what, and what the models assume. The chief credit officer’s remark in the closing meeting was that the broker sampling finding would have been embarrassing in 2007 and was merely useful in 2027, which is the right use of a book about the crisis: to ask its questions before they are asked by events.
Frequently asked questions
Is The Big Short accurate about the instruments?
Yes; its explanations of mortgage bonds, tranches, CDOs, synthetic CDOs and credit default swaps are clear and correct, and are widely used in teaching. Its account of who saw what is a journalist’s selection, and the official inquiries show the problem was visible more widely than the book suggests.
Were the short sellers the heroes?
They were right, early and paid for it; the book admires them, and critics note they profited from a disaster. For an auditor the point is their method, reading the documents and asking the participants, which is independent of how one judges the trade.
What is the central control lesson?
That an organisation should not hold, sell or rely on anything that nobody inside it has examined at the level of the underlying data, and that external ratings and assurances do not substitute for that examination.
How does it connect to Too Big to Fail?
The Big Short is the cause and Too Big to Fail is the consequence; read them in that order. The Too Big to Fail summary covers the rescue.
Does the book apply outside mortgages?
Yes, to any chain in which an asset, a claim or a counterparty passes through parties paid on volume: supply chains, insurance, procurement, acquired loan books, vendor assurances. The third-party risk guide covers the general case.
Where does the book sit in the reading list?
In the financial history group of the internal audit reading list, before Too Big to Fail and beside When Genius Failed.
Related guides
- Credit Risk: Ratings, PD/LGD/EAD, CECL and Capital — the underwriting and securitisation controls
- Model Risk Audit: How Internal Audit Validates the Models — the correlation assumptions that produced the ratings
- Third-Party Risk Management End-to-End — relying on assessments the organisation has not examined
- Fraud Risk Management: Assessment, Controls and Analytics — volume pay without outcome risk as a condition
- Too Big to Fail: Summary and Lessons for Auditors — what followed
- When Genius Failed: Summary and Lessons for Internal Auditors — the 1998 rehearsal
- The Best Books for Internal Auditors — where this book sits among the others
- All book summaries — the full set of summaries for auditors
Leave a Reply