How to manipulate risk forecasts and not get caught

November 19, 2022

It is easy to manipulate risk forecasts. If your regulator or compliance officer sets a risk target you don't like, just tell them what they want to hear while continuing doing what you want.

The following anecdote comes from The Illusion of Control. Suppose my job is to forecast the risk of some portfolio, measured by VaR. One day my boss calls me into her office:

"Jon, the VaR is too high, and you have to lower it. However, our traders are doing a fantastic job, and I want to keep the nice returns. Now go and play with your computers and make it happen. And by the way, don't get caught make sure you comply with all regulations."

It's not difficult to do this, and when I lecture on risk forecasting, I show my students exactly how to do this.

The easiest way to manipulate the risk measurements is to pick a riskometer that delivers a lower number. On my website, extremerisk.org, I forecast risk daily using the most commonly used techniques.

Lets focus on at a recent annual average for the SP-500 index, supposing we have a $1000 portfolio.

So if you want to minimise risk, just pick MA and more than halve the risk. No need to change assets, just pick the right riskometer.

Sadly, it does not meet our criteria for not being detected. The bank's compliance people and the regulators will notice and are likely to take a dim view of such switching of riskometers, especially if done often.

A better way to manipulate is to cherry-pick the assets one puts into the portfolio. Just pick assets that robustly provide the juicy returns we want but do not contribute much to the measured risk.

We are here to search for the riskometers that have the desired properties. Easy enough to do for anyone with moderately good quantitative skills and practically undetectable by the compliance department and the regulators.

When I tried to do this for a sample portfolio, it took me a few minutes to reduce the VaR by over 70% — without changing the expected returns. Yes. This is a little like portfolio optimisation. But here it is optimising against the risk control, not what risk is to me.

The final way to manipulate is to use options. I show a particularly egregious example in Chapter 4 of my book Financial Risk Forecasting. The trick is simply to put a kink in the profit and loss distribution around the risk number you want to manipulate.

Manipulating risk with derivatives

Suppose you buy a put option at strike -VaR1 and write a put at a lower strike price, -VaR2. The effect of the former is to provide risk against the price of the asset falling below -VaR1, while the second exposes you to large losses if the price of the asset drops below -VaR2.

VaR drops significantly, but the risk of large losses increases and overall profits drops slightly. Mission accomplished.

The particular example shown here is, of course, blatant abuse of the bank's risk management system and presumably would be picked up by the risk controllers. However, if one uses more subtle methods, it may be fully non-detectable.

There are many similar ways one can manipulate riskometers. Some are easy to detect, but others are only known to the individual taking the risk.

If you are sceptical and think I am just an academic taking extreme examples that would never see the light of day in the real world, think again. The reason why the UBS bank failed in 2008 was precisely for the reasons I'm describing here. And JP Morgan lost over $6 billion due to the London whale trying to lower reported VaR.

---

---