Casinos Manage Risk Better than the Likes of SocGen

By Chris Brady

Current regulatory and risk management systems are designed to retrospectively identify at what point a thief stole your money, not to alert you when he is actually stealing it

If responses to the Societe Generale (SocGen) scandal sound familiar, it's because they are. The usual remedies -- new guidelines for derivatives trading, tighter trading controls and higher fines -- have been trotted out after every debacle since Enron. Unfortunately, they will be no more successful this time than last, because they all mistake a managerial failure for a systemic one.

The truth is that current regulatory and risk management systems are designed to retrospectively identify at what point a thief stole your money, not to alert you when he is actually stealing it. Asking a group of investment bankers to investigate a fraud perpetrated against systems designed by investment bankers is unlikely to generate a new approach. Rather than saying "it won't happen here" (as the French did after Parmalat), or "it won't happen again" (after Enron, WorldCom, et al), we should be asking: Are there lessons to be learnt from other industries?

"The gambling known as business looks with austere disfavor upon the business known as gambling," wrote Ambrose Bierce in The Devil's Dictionary. Gambling is highly regulated, but does not rely on regulation to manage its internal risk; it takes that on itself.

With risk as its primary product, gambling works on the assumption that, given the chance, everyone wants to take money out of it -- customers and staff. It also assumes most robberies are inside jobs. Consequently, it concludes, the organization should be watching the people with working knowledge of the systems -- such as Jerome Kerviel and Nick Leeson, who were familiar with their back-office set-ups -- and not the systems themselves.

PIT BOSSES

Casino surveillance cameras are trained on croupiers as well as punters. Watching the croupiers are the "pit bosses," who are also being watched. All are monitored for behavioral changes and unusual patterns, whether winning or losing. When a change is seen, managers investigate until they are satisfied with the explanation. Some large insurance companies are doing something similar, using "stress-detector" technology to screen claims. Only claimants whose voice patterns exhibit anomalies are investigated.

When Kerviel's behavioral anomalies were reported, he was apparently able to shrug them off with minimal explanation, as Leeson had at Barings. Management wasn't managing: Those in charge were either "player-managers" more concerned with their own performance, or so far up the chain as to be disconnected from the game.

Perhaps the most damning comment in the Barings affair was that of a very senior official who saw no reason for concern because Leeson's trading showed "nothing extraordinary." Actually, his results were so contrary to both his own previous results and that of his peers that he warranted immediate investigation. The senior manager had no idea his results were unusual -- he just saw them as good. The same was true of John Rusnak, the currency trader who lost ?354 million (US$689 million) at Allied Irish, of Kerviel, and no doubt many others.

According to the investigation by the governor of France's central bank, Christian Noyer, SocGen's controls were "not followed up appropriately." In other words, there were no "floor walkers" or "pit bosses." Even if the surveillance systems were effective, management's actions were not.

This is a direct consequence of the flattening of organizational structures.

What has been flattened, by and large, is the "monitoring" function traditionally carried out by long-serving middle-managers with elephant-like corporate memories who could intuitively spot behavioral inconsistencies.

Psychologist Gary Klein calls this "recognition-primed decisions" (you might know it as "experience.") The gambling industry relies on this monitoring function to bolster its technical systems and guarantee its internal risk management. It is the manager who activates the deep investigation, not the system.

Gambling has another invaluable lesson for the financial markets: the simplicity of its terminology. For example, it has only one term for all the activities it covers -- betting. A government supposedly dedicated to educating the public in the intricacies of financial services would do well to copy this approach. Whether you "invest" in a building society, derivatives, credit derivatives, options or futures, you are betting that the return will outweigh the risk. In casinos, everyone understands that there is no such thing as zero risk and no such thing as guaranteed returns.

Perhaps the sharpest lesson from gambling is that if someone is playing with my money, I watch them especially carefully. I was once asked to follow a colleague at a small bookmakers where I worked and report on his movements. It turned out that he was the "runner" who "laid off" big bets. When the shop took a bet it couldn't cover if the horse won, it off-loaded the risk to other bookies by betting a proportion of the punter's money on the same horse with them. If the horse lost, all the bookies made money; if it won, the losses were "spread" and thus manageable. Call it "hedging."

My boss suspected that the runner wasn't laying off the money with other bookies -- he was gambling that the horse would lose and he could pocket the money. If it won, of course, my boss would be exposed and probably out of business. Such a business-critical activity was, therefore, carefully monitored.

Kerviel decided not to hedge his bets. The markets turned, and his actions might eventually mean the sale of SocGen. Some years ago I wrote that the financial market was the biggest casino in the world. It seems that I was traducing casinos; they appear to be better regulated and better managed.

Chris Brady is dean of the Business School at Bournemouth University and professor of management studies.