OPS Risk Case Study: Societe Generale

In the aftermath of alleged fraud at French bank Societe Generale the Operational Risk Management team are shaking their heads. Was this an internal fraud? In analyzing the time line of events so far one has to read between the lines:

Preliminary charges have been filed against Jerome Kerviel, the trader blamed for huge losses at French bank Societe Generale.

He will be investigated for breach of trust, falsifying documents and breaching computer security - but not for fraud.

His lawyer, Elisabeth Meyer, called the judges' decision a "great victory" as Mr Kerviel was released on bail.

Societe Generale says his actions cost it 4.9bn euros ($7bn; £3.7bn).

Under French law, a formal investigation does not automatically guarantee that a trial will follow.

Societe General and Paris prosecutors had been pressing for a more serious charge of fraud against Mr Kerviel, but this accusation was thrown out by the judges tasked with investigating this case.

Risk Management 101 and "Segregation of Duties" will be at the forefront of OPS Risk discussions as the facts come out from the digital forensics examinations. The "Insider" has once again made the headlines and the book of lessons learned:

He said Mr. Kerviel claimed to have made his first fictitious transactions at Société Générale in late 2005, shortly after moving to the bank’s trading desk from a previous job in the risk-management department.

Three years ago it all began. And so goes the typical story line on the epic tales of fraud in the years past and the decades to come. Effective oversight and risk management walks a fine line between enabling innovation and insight and mitigating errors, omissions and significant losses. One thing is certain, the "Insider" threat in your organization exists today, tomorrow and next week. It's not going away regardless of the number of controls, personnel or systems put in place to eradicate it's existence in your institution.

Whether this incident will end up in the Fraud Museum is yet to be determined. What is more certain is that traders around the globe are under a new spot light and renewed scrutiny by oversight investigators. The goal now is to make sure that the combination of people, processes, and systems are fine tuned to the right tolerance levels and triggers for alerts. Only then will the correct balance occur between risk and reward.

What will certainly be an outcome of the investigation is the number of other people that will be implicated, either directly or indirectly by the incident itself. Stay tuned to this "Operational Risk Management" case study for more lessons learned.