CDOs and Risk Management

If you ever talk to quants *gasp* or traders, you may occasionally hear them refer to structured securities such as CDOs using terms like “ratings agency arbitrage”. As usual, the word “arbitrage” is totally inappropriate in this context. What they essentially mean is that the structures are designed to take advantage of the weaknesses in the way the ratings agency do their job. This is part of what a former colleague of mine refers to as the “quant arms race”.

Now we are beginning to see how inappropriate the ratings agencies methods are in the context of subprime CDOs (see here and here). With ratings agencies rethinking the ratings on these securities, there will obviously be market impacts as some institutions become forced sellers, etc etc, but the thing on my mind is risk management.

Instead of “ratings agency arbitrage”, I think a better (yet still inappropriate) name would be “risk management arbitrage”. As far as I’m concerned, CDOs and most structured securities represent a total blind spot for risk management systems. CDOs are designed to push losses out into the”tails” of the return distribution, i.e. as long as things remain fairly “normal”, then they will perform well. It takes a significant unlikely event before losses accumulate. However, those are precisely the types of events modern risk management systems are designed NOT to catch.

This is a fairly standard criticism of the common risk metric called “value at risk”. Value at risk (VaR) is a number measured in units of currency (USD in the US, EUR in the Eurozone, etc) that is intended to give you some idea of the maximum expected loss over a given time horizon with a given confidence level. For example, you may hear expressions like

The 99% 10-day VaR was $10M.

This means that according to some whacky quant model, there is a 99% certainty that over the next 10-days the portfolio will not lose more than $10M. What VaR DOESN’T tell you is how much you could lose if a “tail event” happens, i.e. what if an event occurs that was in that 1% region?

CDOs are designed to take advantage of weaknesses in risk management systems that allow banks and other institutions to take on more risk than they probably should.

The actions by the ratings agencies are significant. The events of the past few weeks are going to force a lot of people to rethink their risk models. Not only that, it will be interesting to see what the reaction of these risk models will be to increased volatility over the last quarter in light of several years of decreasing market volatility.