www.pwc.com/advisory

Reducing the risk of erroneous trades Strengthening controls in electronic and highfrequency trading August 2012

Table of Contents Reducing the risk of erroneous trades

2

Key control challenges in high-frequency trading environments

3

A framework for response

5

Observations on current market practices

8

How to move forward

9

Your PwC contacts

10

PwC  Contents

Reducing the risk of erroneous trades Over the last decade we have seen significant growth in trading volumes driven by electronic algorithmic and high frequency trading activity globally. The increasingly dynamic nature of these activities, including continued innovation in the evolution of quantitatively driven trading programs has dramatically increased the risks inherent in these types of activities. The impact of DMA, electronic and high frequency trading on the worlds’ bourses has been significant and as we have seen on several occasions over the last few years there have been technical issues resulting in trading errors and substantial losses. A case in point: a global firm recently experienced a technology issue related to its trading software. This glitch sent numerous erroneous orders in NYSElisted securities, forcing the NYSE to evaluate trading activity on more than 140 stocks. The firm eventually traded out of its entire erroneous trade position, but not without getting hit with pre-tax losses of $440 million. This enormous loss severely impacted the company’s capital base, forcing it to seek additional financing. The erroneous trades also had a disruptive impact on the markets and investor confidence. Many experts predict that this will not be the last instance of an electronic trading crisis. Strengthening risk management These events capture headlines and draw the attention of investors, clients, regulators, and the general public—all of whom are increasingly questioning the effectiveness of existing controls and compliance programs. Going forward, risk management associated with electronic and highfrequency trading is expected to come under greater scrutiny. We believe that it's critical for firms to constantly reassess their businesses, control processes, technology, infrastructure, and people to be confident that they have implemented sufficient governance, control, and compliance practices designed to identify and mitigate the risk of errors and breaches in these types of activities. This includes the existence of: 

Expertise within in-house compliance, risk management, and control functions



Pre-implementation and periodic scenario and stress testing of trading programs



Preventive pre-trade controls; and



Effective trade surveillance

In this paper, we discuss the challenges that exist today with electronic and high-frequency trading, along with current market practices. We also present a framework for use in identifying risks and developing preventive pre-trade controls to reduce the risk of erroneous trades.

2

Key control challenges in high-frequency trading environments While improving electronic and high-frequency trading controls is a shared goal of individual firms, investors, market participants, and regulators, it's not without challenges. Following are common challenges that organizations face when strengthening their electronic and high-frequency trading controls:  Generating the right scenarios to manage risk. Testing of high-frequency trading typically focuses on recreating market-condition-based ‘what-if’ scenarios, which are used to verify and fine tune the performance of an algorithm. However, just as importantly, scenarios should relate to market function—for example, orders being processed in a less-than-ideal environment. This could be as simple as price latency or as complex as partial outages leading to erroneous order filling/ cancelation. In the case of price latency, testing takes place around the science of the algorithm. While there is always room for improvement, such improvements typically affect the algorithm's alpha rather than effectively enhancing disaster prevention. In the case of partial outages, marketfunction testing is designed so the entire process has the right set of controls to prevent, and mitigate, potential disasters going forward. When properly planned, these test scenarios can help put controls in place to limit the algorithm's activity—both intelligently (e.g., the algorithm changes the level of its activity and type due to nonnormal market function) and in brute-force fashion (e.g., the algorithm is shut down). While all the possible ‘what-ifs’ can never be identified, there should be adequate rigor in the risk assessment applied at the trading strategy/program level to identify key risks, so that preventive controls can be deployed to mitigate these risks to an acceptable level.  Establishing effective independent challenge. In an environment where there is constant innovation in trading programs and strategies in the front office, a key challenge in managing and monitoring risk is the adequacy of knowledge in independent control functions. Insufficient knowledge or experience of trading programs and strategies within functions like compliance, control and internal audit, and/or insufficient empowerment of control functions can reduce the effectiveness of independent challenge.  Testing of algorithms in a dynamic environment. Electronic and high-frequency trading programs are constantly being updated and adjusted to keep pace with changing market conditions. Because these adjustments are often made in times of stress and competitive pressure, all too often belowpar rigor and diligence are applied during pre-implementation testing both in front-office and independent functions.  Establishing effective of pre-trade limit controls. Pre-trade controls, such as market order and trading/position limits, can be a critical line of defense against erroneous trades. This is particularly applicable when upstream controls (e.g., pre-implementation testing of algorithms) have failed or have proven to be inadequate. The effectiveness of these controls can often be limited by insufficient depth of controls in an organization's order-management systems or trading platform. Effectiveness can also be limited by how well the controls have been tailored to the underlying trade-execution strategies, programs, and operations.  Creating controls that are sufficiently dynamic. Control gaps often appear when new or enhanced trading programs and strategies are introduced without corresponding changes being made to existing controls (e.g., pre-trade controls). Many firms perform only ad-hoc reviews that are triggered by system upgrades, system replacements, or new business requirements (e.g., when a new algo strategy is introduced). Another challenge facing today’s firms is the gradual deterioration of the quality of controls over time. To achieve continuously effective controls, it is essential to perform regularly scheduled, comprehensive reviews.

3

 Defining ownership of risks and controls. Typically, multiple departments in a firm—front office, IT, compliance, and the like—share ownership and responsibility for identifying and managing electronic and high-frequency trading risks. Depending on organizational structure and culture, specific ownership varies by firm. But when these responsibilities are shared across functions, the likelihood of gaps in risk-management ownership increases. To establish comprehensive coverage, appropriate segregation, and adequate ownership, each department’s role in the risk-management structure should be clearly defined.

4

A framework for response Common risks in typical high-frequency trade flows Risk-management assessments should be designed to comprehensively identify and document areas of risk and potential points of failure that need to be mitigated. Companies should tailor the assessments to reflect their individual firm's trade-execution strategies and technology platforms. Once created, the assessments should be updated regularly to capture and reflect changes in the underlying business and operations. Figure 1 illustrates common risks throughout each stage of the electronic and high-frequency trading process. Figure 1: Risks associated with high-frequency trading

5

Controls to mitigate common risks Once risk assessments are performed, firms should tailor controls to the underlying business and operational risks that have been identified. This will help mitigate these risks to an acceptable level. Controls should be updated regularly to address changes in a company's risk profile. Following are leading controls designed to prevent and mitigate common risks: Risk

Controls 

Reject, or send for manual follow up at the pre-order acceptance stage, those orders that fail predetermined criteria (e.g., quantity/notional/percentage of average daily volume thresholds).

Errors in communication/ capture of trade parameters



Implement effective/accurate mapping of order parameter fields between order systems.



Have documented accuracy certification/testing of implemented mapping.



Codify order instructions into standardized terminology.

Stale orders



Reject orders if the lag time between order sending and receiving exceeds a pre-determined threshold.

Implementing new algos/changes to existing algos



Document testing procedures for new and changed algos.



Implement testing parameters that identify ‘what-if’ scenarios and conduct stress testing on how the algo reacts under unusual circumstances.



Understand competitor market failures and develop testing to be confident that proper controls are in place to mitigate similar risks.



Retain testing documentation and audit trails for actual testing performed (and the results).



Involve compliance, control, and internal audit departments in the planning and design of testing (including assessment of the adequacy of the testing), as well as in the testing itself.



Establish order-validation checks including:

Fat-finger errors (manual errors in the input of trade execution parameters)

Programmatic algo function errors

- Orders where the quantity exceeds the specified individual or cumulative order limit are identified, flagged, rejected internally (via warning, hard and soft limits).

(occur when trading programs stop functioning correctly or are not under control, resulting in the execution of unintended trades)

- Stop orders if a particular algo receives/sends more than a specified amount of fills/messages over a specified period of time or for a single order (via warning, hard and soft limits). - Stop orders if the aggregate number of child-order quantity (for a given parent order) exceeds the parent quantity. Cumulative child-order notional/quantity tagged to a parent order should not exceed the parent order quantity. - Reasonability (pattern) checks to flag significant deviations from historical trading patterns (e.g., order rates; cancel/replace rates; trading strategy deviation checks, for instance, if a client invests in large caps and order is for small caps). - Position-exposure checks/limits (via warning, soft and hard limits) to evaluate the instantaneous accrued position should the order execute, including the settlement and capital obligations. - Orders where the price is far off market (beyond predetermined limits) or excessively volatile should be identified, flagged, and/or rejected internally (e.g., price collars, price volatility checks, bid-offer spread volatility check).

Stale, inaccurate, or disconnected reference-data feeds



Implement a kill button, providing the ability to simultaneously cancel all existing orders and to prevent new orders from being placed on a firm-wide, desk, or trader level.



Perform periodic system checks (at pre-determined intervals) to validate that price and other key data feeds are being updated on a real-time basis.



Monitor connection 'heartbeat' for key reference data feeds to immediately alert if connection is lost.



Document standardized protocols/procedures to be executed if the data feed is lost and trading needs to be disabled (e.g., halting/canceling orders).

6

Overlooked restrictedentity lists



Reject orders if the symbol is included in restricted lists.



Have automated controls to identify instances of temporary exchange restrictions on arbitrage trading, and halt such trades in those instances.

Inaccuracies in system clocks



Dynamically validate the accuracy of system clocks against external clocks.



Create periodic (at pre-determined intervals) time synchronization handshakes with order systems, as well as reference data feeds.

Loss of exchange connectivity



Monitor 'heartbeat' in the exchange connection to immediately alert if connection is lost.



Document standardized protocols/procedures to be executed if the exchange connectivity is lost (e.g., how open orders will be deleted, new orders will be rejected, and orders relating to hedge positions or cross-product strategies will be identified and handled).



Share documented continuity procedures with clients, so they are aware of (and accept in advance) how their orders will be handled if a disruption occurs.

Limit governance



Implement governance structures, delegated authorities, and policies/procedures for setting, regularly updating, and approving risk limits.

Conflicts of interest



Establish information barriers and controls throughout the order lifecycle to prevent the misuse of order information (e.g., firewalls, access controls).

7

Observations on current market practices To gauge current market practices, we conducted a survey of selected securities firms with sizable high-frequency trading operations in Japan. Some of the main themes identified from this survey include:  Most participants identified the following areas as posing the highest risk (risk perceptions and rankings were fairly consistent): - Fat-finger errors. - Programmatic algo function errors. - Disconnected reference data feeds (breakdown in price or other data feeds resulting in erroneous execution). - Loss of exchange connectivity.  Most participants indicated that they have implemented base-level controls to mitigate the key risks identified. However, with increasing complexity of trading programs and growing expectations from regulators, this baseline is continually being raised.  Key areas for further enhancement of controls identified across the participant group include: - Implementing dynamic limit controls (e.g., single and cumulative order quantity as a percentage of average daily volume/outstanding shares) to increase effectiveness of quantitative limits across different stocks. - Implementing analytical limit controls (e.g., reasonability/pattern checks) to provide an additional independent screening of orders. - Standardizing crisis-response procedures (e.g., in the event of loss of reference data feeds, exchange connectivity) to decrease potential losses if such events occur. - Monitoring of lag time between order sending and receipt (a leading indicator of potential system problems).

8

How to move forward The evolution of electronic and high-frequency trading introduces some unique underlying risks that are under increasing scrutiny. The time to take action to identify these risks and create effective controls to prevent and mitigate these risks is now. To get started, we recommend that firms first answer the following questions in relation to their electronic and high-frequency trading programs, and then move forward to implement a risk management framework to identify specific risks and create controls:  What market-function scenarios, whether we test for them or not, would lead to situations that require intelligent limits and brute-force controls?  How robust is our process for identifying these market-function ‘what-if’ scenarios? What data is utilized, and who is involved in the scenario development (i.e., internal experience, technology function, external market, stressing at levels)?  What is the quantitative impact that these scenarios provide (frequency and severity of loss)?  Regardless of whether scenarios can be fully tested for, given their likelihood and severity, what mitigating controls (intelligent limits and brute-force controls) have we put into place?  What potential gaps exist in risk mitigation given the above? Given the potential for loss, what areas should management prioritize for further mitigation/controls?  When was the last time we re-assessed our risks and mitigating controls? Was this assessment performed by an independent external party?  Are our pre-trade controls suitably tailored to our trading strategies, programs, and operations?  Have we clearly defined owners for the key risks identified? Are the owners sufficiently accountable?

Obtaining a sound risk-management program that's flexible enough to respond to the dynamic nature of electronic and high-frequency trading programs requires a pragmatic yet forward-looking approach. Firms that create a solid risk framework will be better positioned to prevent and mitigate technical issues that can result in trading errors and financial losses. For more information, or to discuss this topic in more detail, please contact any of the following team members:

9

Your PwC contacts Jeffrey Boyle Partner

+852 2289 5005 [email protected]

Rick Heathcote Partner

+852 2289 1155 [email protected]

James Quinnild Partner

+852 2289 3422 [email protected]

Duncan Fitzgerald Partner

+852 2289 1190 [email protected]

Timothy Clough Partner

+852 2289 1955 [email protected]

Robert Rooks Director

+852 2289 3400 [email protected]

Tony Wood Director

+852 2289 2799 [email protected]

Gregory Profeta Senior Manager

+852 2289 2729 [email protected]

10

© 2012 PwC. All rights reserved. PwC refers to the PwC Network and/or one or more of its member firms, each of which is a separate legal entity. Please see www.pwc.com/structure for further details. This content is for general information purposes only, and should not be used as a substitute for consultation with professional advisors.

11