The need for Continuous Monitoring and Assurance for Financial Institutions

1. The need for Continuous Monitoring and Assurance for Financial Institutions Michael Alles Miklos Vasarhelyi Department Of Accounting, Business Ethics And Information Systems CONTECSI 2008: I SIMPÓSIO DE AUDITORIA CONTÍNUA

2. Background: A Serious Crisis • Bank write-downs from subprime crisis are $355 billion and growing: by most measures, larger than either S&L or Latin American debt crises of 1980’s. • Estimates are that this crisis will be longer and deeper than any other before and losses at investment banks could amount to 2 ½ years of profits! • House prices in free-fall in much of the developed world as mortgages become difficult to get even for borrowers with good credit. • Some consider banking sector to be facing a crisis of 1930’s proportions as entire basis for modern banking practices brought into question, as well as the governance/regulatory structure that gave rise to it.

3. 1. Why don’t we learn?

4. Why don’t we learn? • In 1997/1998 LTCM failed precipitously forcing the Fed intervention to coordinate 16 banks to contribute close to 4 bi dollars to shore up an institution largely deregulated that was operating with leverages around 30 times capital, ignoring even their swap and derivative positions • The total effect on the economy, justifying the Fed’s action was estimated to be about 1 trillion dollars • Among the major players for countertrades and financing for LTCM were Bear Sterns, Chase, and Merryl Lynch • The epilogue was that these firms escaped largelly unscatted and recovered their investment and loans with positive returns in about 18 months after Mr. Greenspan’s interest lowering

5. Why don’t we learn? (2) • Greatly contributing to the crisis, net of the different international currency crises, were • the total lack of transparency of LTCM positions • the ignorance by counterparties of LTCM of their intricate web of relationships and exposures • the nearly totally unregulated nature of hedge funds • the immense greed of both LTCM partners and their counterparties • the lack of disclosures on derivatives by all parties

6. Why don’t we learn? (3) • Since those days (10th Year anniversary celebration of LTCM) • The FASB issued derivative disclosure rules • Many other types of financial instruments continue to be non-reported under the guise of competitive impairment • As private equity and hedge funds remained largely unregulated and Sarbanes increased the onus of regulation large amont of funds was routed to these entities • The financial institutions refined the use of SPElike entities for their funds • The amounts at serious risk are now in the hundreds of billions not in the pittance amount that partners were forced to contribute at LTCM • Write downs at banks are accumulating to the 100 bi mark and continuing

7. Background considerations • The ill defined nature of the boundaries of business entities with special purpose entities and partnering organizations impacting the firm’s balance sheets, but which are often outside the scope of existing audit practice. • The inability to fully assess the value at risk from financial instrument and contracts whose underlying assumptions are unclear and whose value depends on market dynamics and market confidence to a degree that only now is being realized. • The interlocked nature of financial entities and instruments that are being measured, assured, and valued separately, and with less control than many had assumed, with for example, hedge operations involving numerous instruments often managed and monitored on nothing more sophisticated than a spreadsheet. • As the Societe Generale case has demonstrated, even seemingly sophisticated real-time controls have weaknesses stemming from their own lack of security, monitoring and alarm handling features. Firms may be monitoring the wrong people and the wrong things and not know what to do with the information that controls are generating.

8. Audit considerations • The sufficiency of capital to give a “going concern” opinion and satisfy banking regulation. • The “arms length” valuation of the financial assets of the auditee, the value at risk that they pose. • A methodology for ensuring that such instruments are properly recorded when they are created or traded and that controls are in place to monitor how they are utilized.

9. a Subprimes Subprimes Subprimes Subprimes Subprimes An Evolving Crisis Many forms of mortgages have been engineered to minimize monthly payments Are sold to clients that cannot afford them or speculators These lower quality loans carry higher interest rates therefore pay higher sales commissions Moral hazard.. The one that sells the mortgage is not who ultimately carries it With the passing of time or decrease in real estate values these mortgages become unaffordable

10. Perverse incentives • Loan originators and loan carriers • Praying on uneducated consumers • Too complex titles • Rating agencies • Being paid by the rated entities • Accounting rules • Allowing again “off balance sheet entities” • Fair value valuations precipitating unintended consequences … a cooling period with double reporting would help • Clueless in non regulated markets • Clueless in dealing with regulated interfacing with unregulated parties • Clueless in general    

11. Subprimes Subprimes Subprimes Subprimes Subprimes Subprime B Subprimes Subprime B Subprimes Subprimes C Subprimes Subprimes C An Evolving Crisis They are sold as paper to banks wanting to improve their returns Sold by one entity acquired by another that converts them to a SIV (structured Investment Vehicle) These are broken down into different risk categories called “tranches”

12. Short- term Financial paper Subprimes Subprimes Subprimes Subprimes Subprimes Subprime B Short- term Financial paper Subprime B Subprimes Subprimes Subprimes C Short- term Financial paper Subprimes C Subprimes Off balance sheet Entities are created An Evolving Crisis Sold by one entity acquired by another that converts them to a SIV (structured Investment Vehicle) Banks sell The tranches to clients that finance it issuing short term paper

13. Short- term Financial paper Subprimes Subprimes Subprimes Subprimes Subprimes Subprime B Short- term Financial paper Subprime B Subprimes Subprimes Subprimes C Short- term Financial paper Subprimes Subprimes C Off balance sheet Entities are created An Evolving Crisis Swaps are sold insuring the instruments Sold by one entity acquired by another that converts them to a SIV (structured Investment Vehicle) Banks sell Higher interest yielding insured instruments

15. Market Failure • The credit crisis has choked off many of the markets that banks in recent years relied on to take assets off their balance sheets. Issuance of mortgage-backed securities has dropped sharply, while demand for more complex instruments such as C.D.O.s has dried up completely. • Many bankers think it will be months, if not years, before they can start issuing these securities again. If and when they do, investors are bound to demand higher returns than before and are likely to require banks to demonstrate confidence in the securities by keeping a greater proportion themselves. • In short, this means that banks will be forced to fund more of their future loans from their own balance sheet resources.

16. Banks Need To Strengthen Balance Sheets • Several of the world's largest banks--Citigroup, Merrill Lynch, UBS and Morgan Stanley—have sold multibillion-dollar stakes to Asian and Middle Eastern investors and Sovereign Wealth Funds to boost their capital amid heavy losses on mortgage investments. But as banks increasingly take responsibility for assets that had been held in off-balance sheet funds such as SIVs, their capital needs have grown. • Goldman Sachs estimated that $475 billion of “extra” assets had been moved to bank balance sheets since the credit crunch picked up speed earlier this year. • Mortgage insurance entities have been shored up by the same banks that they insure.

17. 3. Monitoring financial institutions

18. Are the raters reliable monitors? • Standard & Poor’s to revamp its governance procedures, analytics and ratings transparency mark the latest in a series of mea culpas from the leading credit rating agencies as they attempt to restore their credibility with investors. • Moody’s, Fitch and S&P have in recent months come under intense fire from investors and regulators in the US and Europe after complex structured finance instruments they rated have suffered losses far in excess of the rating agencies’ initial expectations.

19. Is the government a reliable monitor? • The government has stayed largely in the sidelines watching the financial bubble grow • The regulator umbrella is cumbersome, prone to political intervention, and lacks effective weapons to deal with the powerful banking establishment • Since the deconstruciton of the Glass Seagall act banks have become investment banks and vice-versa. Hedge funds and private equity have taken secondary and tertiary roles in this process.

20. Are auditors reliable monitors? • External audit methodology is anachronistic • The point-in-time audit is not designed to • Monitor fast moving financial operations • Detect going concern weaknesses in short periods of times • Measure integrated risk faced by financial institutions • Deal with the fuzzy boundary issues of interlinked financial agents • Internal audit groups • Are better positioned to deal with these issues • Do not have the monitoring and control charter • Need to develop a comfort zone for monitoring and assurance functions to be negotiated among the Basel II, compliance, fraud, Sarbanes, and operating groups

21. Underlying Causes Of LTCM Debacle • Greatly contributing to the crisis were: • the total lack of transparency of LTCM positions • the ignorance by counterparties of LTCM of its intricate web of relationships and their consequent exposure • the effectively totally unregulated nature of hedge funds • the immense arrogance and greed of both LTCM partners, counterparties and investors, all of whom were seduced by the Nobel Prizes of the LTCM partners • a refusal to ask hard questions and to insist on usual controls and standards of prudence • the lack of disclosures on derivatives by all parties

22. LTCM Had Little Long Term Impact • 10th Year anniversary of LTCM: • The FASB issued derivative disclosure rules, but disclosures remain opaque. • Many other types of financial instruments continue to be under-reported or non-reported under the excuse of competitive impairment. • As private equity and hedge funds remained largely unregulated and Sarbanes-Oxley increased the regulatory burden on public firms, large amount of funds was routed to these entities. • The financial institutions refined the use of SPE-like entities for taking assets and liabilities off the balance sheet.

23. Securitization: The Great Driver • Securitization—transforming cash flows from assets into bonds—is the real driver of the SPM-crisis. • Bankers created a new market from slicing, dicing and packaging mortgages into such new derivative instruments as mortgage backed securities, collateralized debt obligations, C.D.O.’s squared, special purpose vehicles etc. • At best these structured finance products allowed risk to be better allocated and diversified and hence expanded the amount of credit that could be offered: a key feature of the Basel II standard. • At worst, they vastly leveraged the amount of gambling that could be done on the financial markets: C.D.O.’s of some $75 billion generated trades with a notional value of $60 trillion.

24. Key Enabler: Ratings Agencies • Ability to sell these derivative products depends on their ratings. Instead of being gate keepers, rating agencies became “gate-openers”. • Analysts look at mathematical models, not details of the underlying mortgages. Moody’s did not even have access to the individual loan files. Certainly did not communicate with the borrowers or try to verify the information they provided in their loan applications. • “We aren't loan officers. Our expertise is as statisticians on an aggregate basis. We want to know, of 1,000 individuals, based on historical performance, what percent will pay their loans?” Claire Robinson, a 20-year veteran for Moody’s.

25. Ratings System Broke Down • Centrality of ratings for process and fact that seller not buyer paid for rating created obvious incentive problem: “Every agency has a model available to bankers that allows them to run the numbers until they get something they like and send it in for a rating” says former Moody’s securitization expert. • Moreover, valuing derivatives more difficult than valuing underlying assets when they are put through securitization process: “Four thousand pieces of a Porsche are more difficult to value than a Porsche itself and the sum of the parts does not equal the whole,” says Bill Michael of KPMG. • In the anything goes climate of 2006, Moody’s had only a single day to value a mortgage backed security.

26. Implied Versus Actual Ratings • Moody's Analytics, which operates separately from Moody's ratings division, uses credit-default swap prices as an alternative system of grading debt. • These so-called implied ratings often differ significantly from Moody's official grades, suggesting higher default risk than Moody’s official ratings. • And the data shows that the implied ratings are more accurate predictors of default risk. • “The only thing holding [securities] at AAA is simply the model that the rating agencies claim they use to judge that capital and the fact they know that if they downgrade the companies, it'll push them into default”. Tim Backshall, CDR LLC.

27. Lessons For Auditing From Recent Crises • Point of recounting this story is to understand the challenges facing governance and control of financial service firms today. Many lessons available from recent crises, but one lesson is that such lessons have to be continuously re-learnt. • Societe Generale is tightening computer security, significantly investing in information technology, reinforcing controls and taking more account of the possibility of fraud. • Clearly technology has a major role to play, but it is not a magic bullet. Need to take behavioral issues into account. • Technology can indicate that something is wrong, but it cannot stop risky behavior. • None are as foolish as those willing to be fooled.

28. Tasks Auditors Will Have To Perform • Assess the sufficiency of capital to give a “going concern” opinion and satisfy banking regulation. • Conduct “arms length” valuation of the financial assets of the client and assess the value at risk that they pose. • Develop a methodology for ensuring that complex derivative instruments that pose particular risks are properly recorded when they are created or traded and that controls are in place to monitor how they are utilized.

29. Challenging Audit Environment • Boundaries of business entities are increasingly ill defined with special purpose entities and counterparties impacting the firm’s balance sheets, but which are often outside the scope of existing audit practice. • Difficult to assess VaR from financial instrument and contracts whose underlying assumptions are unclear and whose value depends on market dynamics and market confidence to a degree that only now is being realized. • The interlocked nature of financial entities and instruments that are being measured, assured, and valued separately, and with less control than many had assumed.

30. Challenging Audit Environment Continued • Hedge operations involving numerous instruments are often managed and monitored on nothing more sophisticated than a spreadsheet. Pervasive problem in finance and insurance. • As the Societe Generale case has demonstrated, even seemingly sophisticated real-time controls have weaknesses stemming from their own lack of security, monitoring and alarm handling features. Firms may be monitoring the wrong people and the wrong things and not know what to do with the information that controls are generating. • Application of accounting rules, especially Fair Value, may cause unforeseeable problems, impacting markets, not just providing a neutral measurement.

31. Audit Methodology Behind The Times • External audit methodology is an anachronism. • The periodic, backward looking audit is not designed to monitor fast moving financial operations or detect going concern weaknesses in short periods of times. • Fails to measure integrated risk faced by financial institutions. • Or deal with the fuzzy boundary issues of interlinked financial agents. • Internal audit groups. • Are better positioned to deal with these issues. • But they often do not have the monitoring and control charter. • Need to develop a comfort zone for monitoring and assurance functions to be negotiated among the Basel II, compliance, fraud, Sarbanes-Oxley, and operating groups.

32. Applying Technology To Auditing • Continuous auditing and monitoring: applying technology to the reengineer the audit process in order to enable on-demand auditing with reduced latency between the transaction event and the provision of assurance. • CA = continuous control monitoring + continuous data level assurance. • Continuous auditing and monitoring cannot by themselves prevent crises such as SPM or Societe Generale. • Scope of CA/CM today is too limited, focused on operational control, automation of existing audit processes and fraud detection. • Need to take it to the next level. But note that trading already subject to CA, which indicates need for caution.

33. CA/CM In The Governance Process • Would CA/CM as currently envisaged have prevented the SPM-crisis? Realistically, no. • When there is a systematic failure across the entire governance process, no one part of that process can compensate sufficiently. • Part of the problem is the failure to understand the flawed incentives throughout the governance process, which can lead to even technological alarms to be ignored, as in the case of Societe Generale. • On the other hand, advantage of technology is that it is not swayed by status, income or position. • The point of this conference is to begin the process of taking CA/CM to the level necessary where it will have a real impact.

34. Some Possible Solutions To Explore • A valuation platform that will provide third party valuation of complex financial instruments and a systemic assessment of their critical risks, types and their inter-linkages, and an automated confirmation mechanism (a more sophisticated and broader form of the SWIFT system, using confirmatory extranets) to verify and affirm the existence of the instruments in question. • A library and taxonomy of derivative valuation programs drawn from various sources, both external and internally developed. • A template for a linkage methodology where related derivative instruments part of a coordinated hedge will be linked. • A high level set of risk KPI and monitoring alarming features.

35. Thinking Out Of The Box Continued • A set of analytic continuity equations linking: varied outside market conditions; clearance agents; derivative instrument and security positions, and different views of risk exposures. • A representation of clearance agents, clients, paper issuers, SPEs, and other relevant entities. • An alarming/management methodology to mitigate the danger of rogue trading and unbalanced derivative positions. • Simulation of several alternate conditions/contingencies based on published reports of major frauds at Societe Generale, Citigroup, Barings and so on to test the validity of the proposed approach as a preventive and detective control.

36. Database to database confirmations Counterparty 1 4. high level set of risk KPI and monitoring alarming 3. library of derivative valuation programs 5. Analytic continuity equations 2. A reporting level control panel FI enters in thousands of Derivative transactions 6. alarming/management methodology Counterparty n • Many transactions are multiparty • Similar instruments are actual different • There are tight and loose hedges • Catastrophic changes in markets undermine hedges

37. Discussion Questions • Can a technologically based solution and new audit methodologies be derived to deal with or mitigate these problems? • How good are the current risk management platforms at the financial institutions? • Can a platform just involving one institution without spanning its counterparties be relied upon? • How do we make allowance for incentive issues, especially in the face of enormous temptations to subvert governance. • With XBRL now effectively mandated the question that looms is if version 2.1 is adequate to represent fast moving instruments or will new XML extension languages have to be created to deal with the “live financial report.”