Australian regulatory body Aptra (Australian Prudential Regulatory Authority) has ordered National Australia Bank to undertake an urgent review of IT system within its trading operations following the loss of A$360 million by rogue traders on the bank's currency options desk.
In yet another damning report of management, culture, and technology at NAB, Apra recommends that the bank revisit plans for system implementation within its trading operations to see "if the timeframe for implementation of system upgrades, including development of better system interfaces, should be accelerated".
In particular, Apra requires NAB to undertake an internal review of the processes followed in the development, implementation and upgrades of the Horizon system - the risk management and pricing system that was exploited by currency options traders to mask their unauthorised dealings.
Horizon was initially developed by Sydney software company Triaxia. The bank has been unable to produce any documentation relating to upgrades to the system following installation in 2000.
Apra is particularly critical of the failings, and says NAB should work to "identify any non-compliance with NAB policies on user acceptance testing and system change control processes".
While Apra's investigation focussed on control issues concerning currency options trading, the regulator has ordered NAB's internal audit to probe for similar weaknesses at other trading desks and report back "as a matter of urgency".
In a further sign of anger at NAB's lax procedures, Apra has raised NAB's capital reserve target to 10% and withdrawn approval for the use of internal models in the determination of market risk capital.
National CEO John Stewart says the bank will act as quickly as possible to implement all of the remedial actions proposed by Apra, including suspension of the current share buy-back programme.
"We have already started to implement a series of actions to enhance our policies and systems," he says. "We will continue to work co-operatively with APRA, and other regulatory authorities, to implement all remedial actions within agreed timelines."