Trade secrets

The Allied Irish Bank debacle has brought the issue of internal control and risk management to the fore once again. Deborah Talbot reports on what went wrong

The publication of a preliminary report into the activities of 'rogue trader' John Rusnak and how he was able to incur losses of more than £490m for his employer Allied Irish Bank (AIB), has served as a stark reminder of the importance of establishing and, perhaps more critically, maintaining adequate internal control and risk management systems.
The 57-page report, which is the culmination of Eugene Ludwig's 30-day investigation into AIB, is by no means definitive, and investigation into the affair is still in its infancy. However, Ludwig is confident that a number of conclusions can already be drawn. The report is decisive in declaring Rusnak to be “primarily responsible for the losses”. It is also highly critical of the internal control systems in place at AIB and its subsidiary Allfirst (where Rusnak worked), which allowed him to exploit weaknesses and accumulate extensive losses over a five-year period.
As Ireland's largest bank, AIB is fortunate to be in a strong financial position. This means that it will not only survive these losses, but may even make a profit this year. However, other organisations have not been so lucky, notably Barings Bank, which collapsed in the 1990s after trader Nick Leeson ran up losses of more than £800m.
It is still not clear whether Rusnak actually stole any money from AIB for his own gain. Preliminary findings suggest that the losses began to accumulate after Rusnak, a foreign exchange dealer, wrongly predicted that the yen would strengthen against the dollar, when, in fact, it weakened. There are suggestions that the losses grew as Rusnak attempted to cover up these bad trades and hide his tracks by falsifying key bank records and documents. Because of these circumstances, many believe that the money has been lost to the market, rather than lining Rusnak's pockets.
Whatever the extent of the AIB fraud and Rusnak's motives in pursuing it, the fact that the company's control system allowed it to happen is a major concern. It will set alarm bells ringing in the mind of anyone involved in the management of high-risk financial activities, as the system deficiencies identified at AIB are unlikely to be unique to foreign exchange trading. The incident provides an ideal opportunity for organisations to pause to consider the internal risk management systems that they currently have in place. The question should then be asked: Are these systems sufficient to prevent and expose any potential fraud?
As AIB discovered all too late, its answer to this question was a resounding “no”. Ludwig's report has confirmed that Rusnak was able to “circumvent the controls that were intended to prevent any such fraud”. AIB group chairman Lochlann Quinn has also admitted that it was “a serious breakdown in our controls that enabled these losses to occur”.
The report is clear that there is no “definitive basis to conclude at this point” that anyone at AIB or Allfirst had actual knowledge of Rusnak's fraudulent trading activities. However, Ludwig's report points to a number of identifiable system control deficiencies: a lack of close scrutiny of an individual's trading activities; a lack of appreciation by senior managers and others of the risks associated with the particular styles of trading that were taking place; an excessive reliance on one individual to scrutinise trading activities (in this case, the Allfirst treasurer); and a failure to respond quickly enough, or at all, to evidence of possible impropriety.
It is suggested in Ludwig's report that internal audits at AIB were insufficient, and that the transactions selected for closer scrutiny were inadequate to detect any wrongdoing. As a result, an individual's trading activities could go largely unsupervised, their strategies were rarely discussed, and rudimentary checks – such as taping telephone conversations or undertaking daily trading checks – were infrequently made. It was a lack of adequate supervision that allowed Rusnak to continue with the risky trading strategy that led to such high losses.
Even where issues and concerns were raised in relation to Rusnak's trading activities, reaction at AIB was slow or virtually non-existent. It is noted in Ludwig's report that there were insufficient numbers of properly trained staff at AIB to respond appropriately and enforce procedures – factors which may have contributed to the fraud continuing for so long.
Assumptions at senior management level may also have played a part in allowing Rusnak's activities to go undetected. Ludwig's report suggests that all trading activities are high risk, no matter how small the activity may appear, and outlines the risk management steps that should have been taken. There is nothing unusual in the suggestions that Ludwig makes – focusing on the importance of supervision, closer monitoring, better internal communication and more rigorous risk assessment.
Owing to a series of system deficiencies that, AIB has paid dearly. A number of senior executives and managers have been dismissed; the FBI is conducting a criminal investigation into the affair; shareholders have begun preparations for possible legal action against AIB; and, of course, it is almost £500m worse off. The only way in which AIB's financial situation might be improved is if the suggestion in Ludwig's report that “Rusnak's activities may have been facilitated by individuals in other firms” is proved. If AIB can show that the money was stolen rather than traded away, and that other institutions are also liable, it may be able to claim up to £140m from its insurers.
Any organisation keen to avoid the same fate needs to have a thorough review of its risk management procedures and consider the control of high-risk transactions. The AIB saga has made it clear that there is no room for complacency and that the existence and subsequent exploitation of deficiencies in any system can be devastating.
Deborah Talbot is group editor for specialist products at Lawtel.