Blog article
See all stories »

Adoboli and reducing the false-positives

With the Adoboli trial beginning today, please indulge me and allow me to once again look at the stock markets, and more specifically the traders that play within them. I will start with a fairly obvious statement, but one I find particularly pertinent to this case: any system set up to protect an asset is only as good as the people that manage and respond to it. For instance, if a car alarm goes off in the street and no-one responds to it, is it going to help deter a thief from breaking into the car? If you forget to set your burglar alarm and then your house is broken into, do we assume that the burglar alarm is ineffective? In both examples, the system is fully functional and doing its job, but is let down by dependence on human intervention.

Now, with the car alarm example above, I’m certain we’ve all experienced this – it generally instils a sense of hatred for the owner of the car for subjecting you to that infuriating noise, rather than a sense of panic and desire to investigate. This is not the fault of today’s more advanced alarms (with a few exceptions), but actually the conditioning we’ve experienced since the 1980s. Back then the alarms were rudimentary and had a catch-all methodology – easily triggered by a clap of thunder, or someone walking into the car by mistake. This led to a deluge of car alarms going off at all times of the day, in the supermarket car park, in a busy pedestrian area etc; And God help us if it was fireworks night. The net result is that we pay very little attention to the car alarms, and simply ‘walk on by’ in blissful ignorance. Anyway, where am I going with this? Well, let me tell you – it’s all about false-positive ratios.

Every time an alert is triggered that doesn’t lead to something of notable interest, we have a ‘false-positive’ on our hands. Old (I mean 3 years-plus) technology that doesn’t embrace the fraud detection techniques and software/hardware available to us today is almost certainly going to have an unacceptable number of false-positives. False-positives not only waste unnecessary time and resources, but also significantly undermine the effectiveness of the defences. In the case of Adoboli, when the desk supervisor received an alert informing him/her that one of their traders had an abnormal level of ‘fails to deliver’ (non-confirmed trades), it may have been easy for them to only pay it fleeting attention, and accept a half-hearted excuse from Adoboli as to why this may be the case. They would then need to continue looking at the remaining hundred or so alerts generated that day, each of which may not yield anything of interest whatsoever. This really is ‘needle in a haystack’ stuff.

Due to the complex nature of the markets today, taking a simple rules-based approach to identifying errant trader behaviour isn’t going to cut the mustard. A more holistic approach needs to be taken that examines all trader behaviour for anomalies in both real-time and intra-day (physical, systems, comms, network analysis and market activity). If you put together a complete picture of a trader, and see that more than one element of their behaviour is out of context given their past individual behaviour, or behaviours of their peer group, the false-positive ratio will start to plummet. Whilst also making these systems more efficient and accurate, such a holistic approach will also identify undesirable activities that may never have seen before, providing protection against the unknown.

This is why rogue traders can get away with it for so long – not because the warning systems don’t detect it, but because those very systems are generating far too many false-positives, don’t take an aggregated behavioural view and aren’t backed up by a robust human investigation process. Hiding behind forward-settling positions which never confirmed was not a particularly clever way of abusing his position - indeed cancelling and then recreating orders before they hit affirmation or confirmation is a fraudulent technique that is as old as time. However, if we continue running market surveillance systems with obsolete technology and principles, it’s my prediction that we’ll see more of these cases over the next few years – because where there’s an opportunity to defraud, it will always be taken by someone.


Comments: (2)

Ketharaman Swaminathan
Ketharaman Swaminathan - GTM360 Marketing Solutions - Pune 12 September, 2012, 11:13Be the first to give this comment the thumbs up 0 likes

Props for covering a crucial, yet oft-ignored, topic like "false positives". In the aftermath of the GFC, there was a clamor for more comprehensive risk management systems. They ignored the fact that even the existing systems provided enough alarms. It was just that there were so many false positives that they had to be bypassed, especially when taking them seriously would have meant reduced bonuses. Likewise, every time news about yet another incident of online fraud breaks out, we'll hear security gurus advocating yet another layer of authentication, ignoring the possibility that the resultant increase in friction and false positives could block as many genuine transactions as prevent fraudulent ones. 

A Finextra member
A Finextra member 21 September, 2012, 14:58Be the first to give this comment the thumbs up 0 likes

Completely agree - the signs (and alerts) are usually there, but you just need to make sure you don't overload the investigators with too much noise - otherwise, chances are you'll miss the important stuff.