Every large trading loss that was not simply a bad bet shares a pattern. A trader understood the control environment better than the people running it. A control that existed on paper did not exist in the system, or existed and was overridden. A limit was breached and the breach was approved after the fact, or the limit was raised to fit the position. A back office, risk function or product controller trusted the front office’s explanation of a reconciliation break, a late trade or an unexplained profit. And somewhere in the data, months before the loss, were the signals: cancellations and amendments clustered around one trader, unconfirmed trades aging past the point any counterparty would tolerate, a book that never lost money, a trader who never took leave. Auditing trading floor controls means testing the control set front to back against the system of record rather than the procedures manual, and then running the analytics that find the signals.
This guide explains how: why trading controls fail, the regulatory frame, the control set from pre-trade to settlement, limits and breach escalation, trade capture and the cancel-and-amend red flags, confirmations and reconciliations, independent price verification and P&L sign-off, mandatory leave and access, surveillance and conduct, the analytics, a test-by-test program, a worked engagement at Thornwick Bank, the lessons of the classic failures, and how to report. It builds on the market risk guide and the value at risk explainer, and it is the trading-book counterpart of the treasury audit guide.
In this guide
- Why trading controls fail
- The regulatory frame
- The control set from pre-trade to settlement
- Limit structures and breach escalation
- Trade capture and the cancel-and-amend red flags
- Confirmations, settlement and reconciliations
- Independent price verification and P&L sign-off
- Mandatory leave, access and segregation
- Surveillance and conduct
- The analytics that find what sampling misses
- A test-by-test program
- A worked engagement: Thornwick Bank’s FY26 trading controls audit
- The rogue trader playbook: what the classic failures teach
- Reporting trading control findings
- Questions about auditing trading controls
- Related guides
Why trading controls fail
Trading is the activity in which one employee can commit the firm to losses larger than its capital in an afternoon, so its control environment is denser than any other part of a financial institution: pre-trade limits enforced in systems, independent risk measurement, daily P&L production by a product control function that does not report to the front office, confirmation of every trade with the counterparty, reconciliation of positions and cash to external records, independent pricing, surveillance of communications and orders, and the mandatory absence rule that forces someone else to run a trader’s book for two weeks a year. The density is the point: no single control stops a determined insider or a runaway algorithm, and the design assumes that several controls would have to fail at once. They fail at once for recognizable reasons. Profitable desks acquire deference, and limit breaches become “temporary increases.” Controls are configured by the people they constrain (the trader who used to work in the back office, the desk that specifies its own system settings). Exceptions become normal (a few hundred unconfirmed trades, a few dozen aged breaks, a cancel rate nobody benchmarks). The risk function measures what the system shows and the system shows what the front office booked. And the independent functions are understaffed relative to the volume, so they clear exceptions by accepting explanations. Every classic case in the lessons section is a version of this, which is why the audit tests the controls in the systems and runs the behavioral analytics rather than reading the control framework and sampling a few trades.
The regulatory frame
| Regime | What it requires of trading controls | Internal audit’s angle |
|---|---|---|
| Basel market risk framework (the revised standards, known as FRTB, finalized 2019; EU application postponed to 2027 and US implementation still unsettled; the earlier framework still governs capital at many firms) | Trading book boundary; internal models with backtesting (the 99 percent one-day VaR traffic light: up to four exceptions in 250 days green, five to nine yellow, ten or more red) and P&L attribution tests; desk-level model approval; independent risk control unit | Backtesting and attribution results; boundary governance; desk structure; the risk control unit’s independence |
| Volcker Rule (Section 619, implementing regulations as amended 2019 and 2020) | Prohibition on proprietary trading with exemptions for market making, hedging and underwriting; compliance program; limits and metrics for market-making desks (reasonably expected near-term demand); CEO attestation for the largest firms | Desk mandates and limits; exemption documentation; metrics reporting; attestation support |
| Swap dealer and security-based swap dealer rules (Dodd-Frank Title VII; CFTC and SEC) | Registration above de minimis thresholds; risk management programs; trade reporting; margin for uncleared swaps; business conduct standards; chief compliance officer annual report | Reporting completeness and timeliness; margin calculations; risk management program testing |
| Broker-dealer supervision (FINRA Rule 3110; SEC market access rule 15c3-5; Consolidated Audit Trail reporting) | Written supervisory procedures; pre-trade risk controls on market access (credit and capital thresholds, erroneous order checks) under the firm’s direct and exclusive control; order and trade reporting | Pre-trade control configuration and testing; CAT reporting accuracy; supervisory reviews |
| Market abuse and conduct (EU and UK Market Abuse Regulation; US anti-manipulation and anti-spoofing provisions; FX Global Code) | Surveillance of orders and communications for insider dealing, manipulation and spoofing; personal account dealing; information barriers; recorded communications | Surveillance coverage and alert handling; communications capture; conduct policy enforcement |
| Settlement and reporting infrastructure (US T+1 settlement since May 2024; EU and UK moving to T+1 in 2027; trade repositories; CLS for FX) | Same-day affirmation and allocation; settlement discipline; reporting to repositories within deadlines | Affirmation rates; settlement fails; reporting exceptions |
| Supervisory expectations on trading controls (Fed, OCC and PRA guidance and enforcement; the lessons letters issued after the major losses) | Independent risk management, product control and valuation; limit frameworks with escalation; new product approval; mandatory absence; incentive compensation aligned with risk | Comparison of the firm’s framework with the expectations and the known failure cases |
| Accounting and valuation (fair value hierarchy, prudent valuation adjustments in the EU, independent price verification expectations) | Independent verification of marks; valuation adjustments; level 3 governance | IPV coverage and variance handling; level 3 challenge |
| Model risk management (SR 26-2 and OCC 2026-13; PRA SS1/23) | Validation and governance of pricing, risk and algorithmic trading models | Inventory and validation currency for front-office models; the SR 26-2 explainer |
The control set from pre-trade to settlement
The trading control set follows the trade’s life. Mandate and product approval: each desk has a written mandate (products, markets, strategies, limits) and no product is traded before the new product approval process has signed off on pricing, risk measurement, booking, settlement, accounting and legal. Pre-trade controls: system-enforced checks before an order leaves (notional and quantity limits, price collars, fat-finger thresholds, counterparty credit availability, restricted lists), with hard blocks rather than warnings for the material ones. Trade capture: every trade booked in the system of record at or near execution, with voice and chat trades entered immediately and the time of execution recorded, so that risk, P&L and confirmations see the real position. Risk measurement and limits: positions valued and risk measured independently of the front office (VaR, sensitivities, stress, concentration), compared with limits set by a committee, with breaches escalated and resolved under a documented procedure. Confirmation and affirmation: each trade’s economic terms matched with the counterparty’s record promptly, by the operations function, with unmatched trades chased and aged. Settlement and reconciliation: cash and securities movements settled and reconciled daily to external records (nostro, depot, exchange, clearing house and prime broker statements), with breaks aged, investigated and escalated. Valuation and P&L: product control produces daily P&L from the system, explains it against risk factors, verifies prices independently against external sources at least monthly, and signs off. Access, segregation and leave: traders cannot amend trades after a cutoff, cannot touch confirmations, settlements or static data, cannot approve their own limit breaches; mandatory absence of two consecutive weeks a year with system access suspended while someone else runs the book. Surveillance and conduct: orders and communications monitored; personal account dealing controlled. Governance: a market risk committee, a new product committee, a valuation committee and an operational risk forum that see the exceptions and act on them. The audit tests each control where it lives (the system configuration, the exception reports, the committee minutes), and it tests whether the exceptions the controls generate are handled rather than accumulated.
Limit structures and breach escalation
A limit framework has layers: the board’s risk appetite expressed as firm-wide VaR and stress limits, allocated down to businesses, desks and sometimes traders; sensitivity limits (interest rate delta by tenor bucket, credit spread, FX, vega, gamma) that constrain the shape of risk VaR summarizes; concentration and issuer limits; stop-loss and drawdown limits that force action after losses; counterparty credit limits enforced at trade time; and liquidity and tenor limits. The framework works when limits are set independently of the desks, enforced in systems where possible, monitored daily by the risk function, and governed by an escalation procedure with authority to approve or require reduction at defined levels within defined times, with breaches and temporary increases reported to the committee and trended. It fails when limits are set by negotiation with the desk, when “temporary” increases are approved by the desk head, when breaches are approved after the fact or allowed to persist as “passive breaches” with no reduction plan, when the risk function’s data lags the book (a trade booked late is a breach the system never saw), and when the limits do not cover the risk being taken (the position that destroyed JPMorgan’s chief investment office in 2012 grew while VaR was being re-modeled downward and while the desk’s own measures were breached hundreds of times). The audit tests the framework’s design against the risk appetite, tests the system enforcement and the data timeliness, pulls every breach and temporary increase in the period and tests approval level and timing against the procedure, trends breaches by desk, and reads the committee packs to see whether the committee saw what the data shows. The risk appetite guide covers the top of the structure and the VaR explainer the measure’s limits.
Trade capture and the cancel-and-amend red flags
Trade capture is where fictitious trading lives. Every major rogue trading case involved trades that were booked, cancelled and rebooked, amended, booked late, booked to internal counterparties, or booked as deferred-settlement instruments that would not generate a confirmation or a cash movement for weeks: the fictitious hedges at Société Générale in 2008 were created and cancelled before confirmation; the fictitious exchange-traded fund trades at UBS in 2011 exploited a settlement window during which no confirmation was due; the forward reconstitution trades at Kidder Peabody in 1994 exploited a system that recognized profit on trades that would never settle. The controls are timeliness (trades booked at execution, with late trades reported and explained), completeness (voice and chat trades reconciled to recordings or blotters), restriction of cancellations and amendments after cutoff to operations with reason codes, internal and intercompany trades confirmed and reconciled like external ones, deferred-start and long-settlement trades flagged and confirmed on trade date, and reporting of cancel-and-amend activity by trader to supervisors and risk. The audit tests the system controls (who can cancel or amend, when, with what approval) and then runs the analytics: cancel and amend rates by trader against desk norms; amendments that change economics (price, notional, counterparty, settlement date) versus static fields; cancellations and amendments clustered late in the day, before month-end, or around P&L sign-off; trades cancelled and rebooked with different dates; late-booked trades by trader; internal trades with unusual volumes or one-sided profits; and deferred-settlement trades by trader. A trader whose cancel rate is three times the desk’s deserves an explanation; a trader whose amendments systematically move profit between periods deserves an investigation under the first 48 hours protocol.
Confirmations, settlement and reconciliations
Confirmation is the control that reaches outside the firm: if the counterparty does not recognize the trade, the trade may not exist. The controls are automated matching where platforms allow (and the US move to T+1 settlement in May 2024 made same-day affirmation the norm for securities), prompt dispatch and chasing of paper and electronic confirmations for over-the-counter trades, aging of unconfirmed trades with escalation thresholds (a trade unconfirmed after a few days is a question; after thirty it is a finding), reconciliation of confirmation exceptions by operations rather than the front office, and reporting of unconfirmed volumes by desk and counterparty. Settlement and reconciliation controls add daily matching of cash and positions to external records, aging and escalation of breaks, control of suspense and wash accounts, settlement fail management, margin and collateral reconciliation with clearing houses and prime brokers, and the segregation that keeps traders away from settlement instructions and static data. The audit tests the matching rates and the aging of exceptions, samples aged items for the quality of investigation (an explanation from the trader is not an investigation), tests the reconciliation design for coverage (every account, every day, independent source), tests suspense account aging and clearance, and looks specifically at the counterparties and products with the worst confirmation performance, because that is where a fictitious trade would hide. Nick Leeson’s error account 88888 at Barings in 1995 was a suspense account that nobody reconciled and that the trader himself controlled; the account reconciliations guide covers the general program and this is its sharpest application.
Independent price verification and P&L sign-off
Product control is the function that tells the firm what the trading book is worth and what it earned, independently of the people who earned it, and its two core processes are independent price verification and the daily P&L. Independent price verification compares the marks used to value positions against external sources (exchange prices, consensus services, broker quotes, observable inputs) at a defined frequency, with coverage measured (what share of positions by value is verified, and what remains trader-marked), variances investigated and adjusted above thresholds, and level 3 positions subject to model and input challenge through a valuation committee. The daily P&L is produced from the system of record, decomposed into explained components (new trades, market moves by risk factor, carry, fees, reserves) and unexplained residual, with the residual investigated above a threshold and the result signed off by product control and acknowledged by the desk. The failure patterns are coverage gaps (illiquid positions marked by the desk with no challenge), variance thresholds set so wide they never trigger, unexplained P&L accepted day after day, valuation adjustments controlled by the front office, and product controllers who are reorganized under the business they control. The audit tests IPV coverage and the variance investigation, re-performs the verification on a sample of positions (especially level 3), tests the unexplained P&L escalation against the days the data shows large residuals, reviews valuation committee minutes for substance, and examines the reporting lines and staffing of product control. The reconciliations and management review controls guides cover the control types; the London Whale case is the reminder that mismarking inside the tolerance of a generous threshold can hide hundreds of millions.
Mandatory leave, access and segregation
The mandatory absence rule exists because concealment requires presence: a trader hiding losses must keep adjusting positions, answering queries and intercepting confirmations, and two consecutive weeks away with system access suspended, while a colleague runs the book and operations handles the exceptions, is the single control that would have exposed several of the classic cases earlier (Toshihide Iguchi concealed losses at Daiwa for eleven years without a meaningful absence; John Rusnak at Allfirst for five). The controls are a policy requiring a defined consecutive absence (two weeks is the common standard), tracking of compliance by trader with exceptions approved at a senior level and reported, suspension of system and remote access during the absence, and a review of the book during the absence by someone independent. Access controls add the segregation that keeps traders out of operations, confirmations, settlement, static data and limit configuration, prevents operations staff from booking trades, and prevents anyone from approving their own exceptions; the segregation of duties and user access review guides give the method, and the trading floor is where to apply it most strictly (traders who have moved from operations and kept their old access, shared logins on the floor, developers with production access to the trading system, and the desk’s own “control” spreadsheets with no access control at all). The audit tests leave compliance trader by trader, tests whether access was actually suspended (log-ins during leave are a classic finding), tests the book review, and tests access rights against the segregation matrix across the trading, confirmation, settlement and static data systems.
Surveillance and conduct
Conduct risk on a trading floor includes market abuse (insider dealing, manipulation, spoofing and layering, benchmark manipulation), mis-selling and best execution failures, information barrier breaches, personal account dealing abuses and the use of unrecorded communication channels; the enforcement record of the past fifteen years (benchmark rigging, FX conduct, spoofing cases that produced a $920 million settlement by one bank in 2020, and the 2021 to 2024 off-channel communications penalties running to billions across the industry) shows the exposure. The controls are trade and order surveillance (pattern detection calibrated to the products traded, with alert triage and escalation), communications surveillance (lexicons and increasingly behavioral models over recorded voice, chat and email, with capture of all permitted channels and prohibition of others), information barriers and watch and restricted lists, personal account dealing pre-clearance and monitoring, conduct training and attestation, and a conduct committee or equivalent that sees the output. The audit tests coverage (which products, venues and channels are surveilled, and which are not), alert volumes, backlog aging and the quality of closures (a backlog of thousands of unreviewed alerts is a finding whatever the model’s sophistication), the capture completeness for communications, the off-channel policy and its monitoring, and the governance; the conduct risk guide covers the broader frame and the fraud risk assessment guide the method for the insider scenarios.
The analytics that find what sampling misses
| Analytic | Computation | What it finds |
|---|---|---|
| Cancel and amend rate by trader | Cancellations and economic amendments ÷ trades, by trader versus desk, by time of day and proximity to month-end | Concealment patterns; booking discipline |
| Late booking | Minutes between execution time (voice log, chat timestamp) and system entry, by trader | Risk measured on stale positions; after-hours concealment |
| Unconfirmed trade aging | Unconfirmed trades by days outstanding, counterparty and desk | Fictitious trade hiding places; operational weakness |
| Internal and deferred trades | Internal counterparty trades and long-settlement trades by trader, with P&L direction | Loss parking; smoothing |
| Breach timing | Limit breaches versus approval timestamps and approver level; passive breaches by duration | After-the-fact approval; limits raised to fit |
| P&L smoothness | Distribution of daily P&L by trader; books with no losing days; reserves released in loss periods | Smoothing and mismarking |
| Unexplained P&L | Days with residual above threshold versus days with documented investigation | Sign-off as a formality |
| IPV coverage and variances | Verified value ÷ total by desk; variances above threshold versus adjustments made | Trader-marked books; tolerance abuse |
| Reconciliation break aging | Breaks by age, account and desk; suspense balances by age | The error account problem |
| Leave compliance and access during leave | Consecutive days absent per trader; log-ins and trades during recorded leave | The concealment-requires-presence control |
| Access conflicts | Users with trading plus operations or static data rights; shared accounts; developer production access | Segregation failures |
| Surveillance backlog | Open alerts by age and type; closure reasons distribution | Surveillance that does not surveil |
A test-by-test program
| Area | Test | Evidence |
|---|---|---|
| Mandates and new products | Desk mandates current and approved; products traded reconcile to approved product list; new product approvals complete before first trade | Mandates, product inventory, NPA records versus trade data |
| Pre-trade controls | Configuration of notional, quantity, price and credit checks against policy; hard blocks on material checks; change control over configuration; test of a sample of limits by attempted breach in a test environment | System configuration, change records, test results |
| Limits and breaches | Framework versus risk appetite; enforcement and data timeliness; every breach and temporary increase tested for approval level and timing; trend and committee reporting | Limit tables, breach logs, approvals, committee packs |
| Trade capture | System controls on cancel, amend and late booking; cancel-and-amend and late-booking analytics; voice and chat reconciliation sample; internal and deferred trade review | System rights, trade data, recordings |
| Confirmations | Matching rates; unconfirmed aging and escalation; sample of aged items for investigation quality | Confirmation system data, chasers, exception reports |
| Settlement and reconciliation | Daily reconciliation coverage and independence; break aging; suspense accounts; fails; margin and collateral reconciliation | Reconciliation reports, break logs, statements |
| Valuation and P&L | IPV coverage, frequency, variance handling and re-performance on a sample; unexplained P&L escalation; valuation committee substance; product control independence and staffing | IPV reports, P&L explain, minutes, organization charts |
| Leave and access | Mandatory absence compliance; access suspension; book review during absence; segregation matrix versus actual rights; shared and developer accounts | HR records, access logs, rights extracts |
| Surveillance and conduct | Coverage of products, venues and channels; alert handling and backlog; communications capture completeness; personal account dealing; off-channel monitoring | Surveillance system reports, capture inventories, PAD records |
| Models | Front-office pricing and risk models in the inventory; validation currency; algorithm governance and kill switches | Model inventory, validation reports |
| Governance | Market risk, new product and valuation committees see exceptions and act; incentive compensation considers risk and conduct | Minutes, compensation policy |
A worked engagement: Thornwick Bank’s FY26 trading controls audit
Thornwick Bank is the regional bank with a capital markets business used in the trading examples on this site: $62 billion in assets, a capital markets division of about 140 front-office staff trading rates, foreign exchange, agency mortgage-backed securities and municipal bonds for clients, with interest rate and FX derivatives offered to corporate customers, a firm-wide one-day 99 percent VaR limit of $12 million, trading revenue of about $310 million a year, a registered broker-dealer subsidiary and swap dealer registration, and a 24-person internal audit function with a five-person capital markets team. The FY26 trading controls audit (900 hours, with 200 co-sourced for the pre-trade control testing and surveillance model review) covered the control set end to end, with analytics run on the full year of trade, breach, confirmation, reconciliation, P&L and access data before fieldwork.
| Test | Result | Rating and outcome |
|---|---|---|
| Limit breaches and temporary increases | Seven VaR limit breaches in the year, three approved more than two business days after the fact; the rates desk’s interest rate delta limit was exceeded on 19 days under a “temporary increase” approved by the desk head, who had no authority to grant it under the procedure; the committee pack showed the desk within limits on those days because the increased limit was displayed | High. Approval authority enforced in the limits system (desk heads cannot change limits); committee pack redesigned to show original limits and increases separately; breaches trended by desk |
| Cancel-and-amend analytics (all 1.4 million trade events) | One municipal trader’s cancel rate was 11 percent against a desk average of 3 percent, concentrated after 5 p.m.; investigation found late client allocation changes (benign) and a booking process fix; a second trader on the rates desk had 48 amendments to internal trades that moved profit between months; investigation under the fraud protocol found deferred internal trades used to smooth the desk’s P&L, a misstatement of about $2.4 million between periods with no net loss | High. The smoothing case referred to compliance and human resources (the trader left the firm); internal trades brought under the same confirmation and amendment controls as external ones; cancel-and-amend reporting to supervisors weekly |
| Confirmations | 310 over-the-counter trades unconfirmed beyond five days at period end, concentrated in four corporate derivative counterparties who did not use electronic matching; 41 beyond thirty days; chasing documented in 60 percent | Medium. Counterparty onboarding now requires a confirmation method; aged unconfirmed trades escalated to the desk head and risk at ten days |
| Reconciliations | 61 nostro and depot breaks older than 30 days ($18 million gross), 14 investigated with a front-office explanation only; one suspense account carried a $3.1 million balance unexplained for four months | High. Break investigation standard set (external evidence required); suspense account cleared and aging reported to the operational risk committee |
| Independent price verification | Coverage 92 percent of positions by value; the remaining 8 percent (illiquid municipal positions) marked by the desk with a monthly broker quote that the desk itself obtained; variance threshold set at a level that had triggered no adjustment in 18 months | High. Product control to source quotes; threshold recalibrated; level 3 municipals added to the valuation committee’s standing agenda |
| Unexplained P&L | Residual above the $500,000 threshold on 14 days; documented investigation on 9; the other 5 signed off with “market move” | Medium. Investigation standard and secondary review |
| Mandatory absence | 9 of 112 traders had not taken ten consecutive business days off in the year; 4 traders logged in to the trading system during recorded leave, two of them booking trades | High. Access suspension automated from the HR leave record; exceptions reported to the chief risk officer |
| Access and segregation | Six traders held amend rights in the settlement system from prior operations roles; two shared logins on the FX desk; one developer with production access to the trading system | High. Rights removed; shared logins eliminated; developer access moved to break-glass |
| Pre-trade controls | Hard notional blocks present on all order channels but one (a newer algorithmic channel had warning-only thresholds); credit checks enforced; the co-sourced test of 40 configured limits in the test environment found two set above the policy value | High. Hard block added; configuration reconciled to policy and placed under change control |
| Surveillance | Trade surveillance covered rates and FX but not the municipal desk’s venues; communications capture complete for recorded channels; 3,100 alerts open beyond 30 days | Medium. Coverage extended; backlog cleared under a plan with staffing added |
| New product approval | Two structured rate products traded before the approval conditions (settlement testing, valuation methodology) were closed | Medium. No-trade system flag until approval closure |
The report rated the trading control environment Needs Improvement and carried four findings to the audit committee together with the smoothing matter, framed as the failure pattern the classic cases describe: limits adjusted to fit positions, exceptions accumulating in the back office, a trader with the presence to manage his own book’s story. The committee asked for the cancel-and-amend, leave and breach analytics to run monthly as management reporting, which is the right outcome: the analytics an audit runs once, management should run always. Validation of the actions was scheduled for FY27 under the closure evidence standards, with the analytics re-run as the test.
The rogue trader playbook: what the classic failures teach
| Case | Mechanism | Control that failed | Audit lesson |
|---|---|---|---|
| Kidder Peabody (1994, about $350 million) | Forward reconstitution trades on government strips that the system recognized as profitable at entry and that would never settle | System P&L logic; supervision of a star performer | Understand how the system computes P&L on every product; test forward-settling trades |
| Barings (1995, £827 million) | Unauthorized futures positions hidden in an unreconciled error account controlled by the trader, who also ran settlement | Segregation; suspense account reconciliation; head office oversight of a remote unit | Reconcile every account independently; no trader touches settlement |
| Daiwa Bank New York (1995, $1.1 billion over eleven years) | Unauthorized bond trading with losses concealed through custody records the trader controlled | Custody confirmation independence; mandatory absence | Confirm holdings with the custodian independently; enforce leave |
| Sumitomo (1996, $2.6 billion) | Unauthorized copper trading over a decade with falsified records | Independent confirmation; limit enforcement; oversight of a dominant trader | Deference to a profitable trader is a control weakness |
| Allfirst / Allied Irish Banks (2002, $691 million) | Fictitious options offsetting real losses; confirmations not obtained for Asian counterparties “to save time” | Confirmation discipline; back-office independence; VaR inputs supplied by the trader | Never let the front office supply risk inputs; confirm every trade |
| Société Générale (2008, €4.9 billion) | Fictitious hedges created and cancelled before confirmation, concealing massive directional positions | Cancel-and-amend monitoring; unconfirmed trade follow-up; gross position limits | Run the cancel-and-amend analytics; limit gross as well as net |
| UBS (2011, $2.3 billion) | Fictitious exchange-traded fund trades booked with deferred settlement so no confirmation was due; a back-office past used to game the controls | Deferred-settlement trade controls; supervision; alert follow-up | Flag long-settlement trades; investigate alerts to conclusion |
| JPMorgan chief investment office (2012, $6.2 billion) | A credit derivatives position grew while the VaR model was changed and internal limits were breached repeatedly; marks managed within thresholds | Limit escalation; model change governance; independent valuation | Breaches that persist are approvals in disguise; test valuation tolerances |
| Archegos / Credit Suisse (2021, $5.5 billion at the bank) | Concentrated swap exposures to one client with margin and limits repeatedly extended | Counterparty concentration limits; escalation; risk culture | Client limits need the same escalation discipline as desk limits |
| Citigroup equities (2022, about $1.4 billion sold in error; £61.6 million in UK penalties, 2024) | A trader entered an order for $444 billion instead of $58 million; a basket worth about $189 billion reached the algorithm and $1.4 billion executed before cancellation; the pre-trade warning displayed hundreds of alerts in a window showing only the first few | Hard pre-trade blocks; alert design; real-time monitoring | Warnings are not controls; test blocks by attempting to breach them |
Reporting trading control findings
Trading findings are read by people who know the business better than the auditor and who will contest the significance of each exception, so the report states conditions in their own data (the number of breaches, the days of passive breach, the aged unconfirmed trades by counterparty, the trader’s cancel rate against the desk) and connects each to the failure pattern it belongs to, because the pattern is what the audit committee needs to recognize. Use the five Cs, rate with the severity guide (a control that would have let a fictitious trade persist is High whatever the current loss), and handle fraud indicators through the protocol rather than the report. The strongest recommendation an audit can make on a trading floor is that the analytics it ran become management’s monthly monitoring; the KRI program guide shows how to turn them into indicators, and the board risk reporting guide where the breach trend and the unexplained P&L belong in the pack.
Questions about auditing trading controls
What does a trading controls audit cover?
The control set from mandate to settlement: desk mandates and new product approval, pre-trade system controls, limits and breach escalation, trade capture timeliness and cancel-and-amend controls, confirmations, settlement and reconciliations, independent price verification and daily P&L sign-off, mandatory absence and access segregation, surveillance and conduct, front-office model governance and the committees that oversee it, tested in the systems and supported by analytics on the full year’s data.
What are the red flags for rogue trading?
Cancel and amend rates far above peers, especially late in the day or near month-end; late-booked trades; aged unconfirmed trades concentrated on a trader or counterparty; internal and deferred-settlement trades with one-sided profits; books that never lose; limits raised to fit positions or breached passively; traders who skip leave or log in during it; and reconciliation breaks explained only by the front office.
Why is mandatory leave a control?
Concealing losses requires continuous presence to adjust positions, answer queries and intercept confirmations; two consecutive weeks away with system access suspended, while someone else runs the book and operations handles exceptions, exposes schemes that depend on the trader’s management of the story. Several of the classic cases ran for years without a meaningful absence.
How should limit breaches be escalated?
Under a written procedure: the risk function identifies the breach from independent data the same day, the desk reduces or an authorized approver (not the desk head) approves a temporary excess within a defined time and for a defined period, passive breaches have reduction plans, and all breaches and increases are reported to the market risk committee with original limits shown. Approval after the fact is a finding; a limit raised to fit a position is an approval in disguise.
What does independent price verification test?
Whether the marks used to value positions agree with external sources at a defined frequency, with coverage measured by value, variances above a meaningful threshold investigated and adjusted, trader-marked positions challenged through a valuation committee, and the function performing it independent of the front office in reporting line and staffing.
How does the Citigroup 2022 error apply to other firms?
It shows that pre-trade controls built as warnings rather than blocks fail under time pressure: a mistyped order for $444 billion generated hundreds of alerts in a window that displayed only a few, and $1.4 billion executed before cancellation. The audit lesson is to test material pre-trade controls by attempting to breach them, to insist on hard blocks for notional and price checks, and to review alert design as a control attribute.
Related guides
- Market risk: a comprehensive guide — the risk the controls contain.
- Value at risk: the definitive guide — the measure and its limits.
- How to audit treasury — the banking-book counterpart.
- Risk appetite vs tolerance vs capacity — the top of the limit structure.
- How to audit account reconciliations — the error account problem, generalized.
- Management review controls — P&L sign-off as a review control.
- Segregation of duties — front, middle and back office.
- User access review — the method for trading systems.
- How to audit model risk management — pricing and risk models.
- SR 11-7 and SR 26-2 explained — the model guidance.
- Conduct risk — market abuse and the conduct frame.
- Fraud risk assessment — the insider scenarios.
- When internal audit finds fraud: the first 48 hours — the smoothing case.
- KRI program — turning the analytics into indicators.
- Board risk reporting — where breaches and unexplained P&L go.
- The five Cs of audit findings — writing them.
- Finding severity ratings — rating them.
- Evidence standards for issue closure — validating the fixes.
Leave a Reply