Meridian Asset Management: Framework Redesign After a Rogue-Trading Loss
Meridian Asset Management oversees $310bn across equities, fixed income and alternatives. After a $48m loss from unauthorized derivatives positions in its emerging-markets desk, the new CRO reviews the risk framework. The risk register contains 1,240 entries, most owned by first-line managers and updated annually. The board risk appetite statement says the firm seeks 'prudent risk-taking' and lists only one quantitative limit: a 5% monthly drawdown at firm level. Business units set their own limits with little aggregation. KRIs are mostly backward-looking: past-due reconciliations and prior-month VaR breaches. The three lines of defense exist on paper, but second-line risk sits within the CFO's function and internal audit reports to the audit committee only twice a year. The CEO wants a 'lighter' framework and argues that the loss was a single rogue trader. The CRO has six months before the next regulatory review.
1. Diagnose the most material weaknesses in Meridian's risk framework, distinguishing design from operating effectiveness.
Read the worked answer
The most material weakness is not the number of register entries but their ownership and cadence. 1,240 entries updated annually by first-line managers suggests a compliance inventory, not a live risk profile; the rogue-trader loss was not surfaced as a plausible scenario. The appetite statement is qualitative and has one firm-level drawdown limit. That does not constrain desk-level risk, so business units can set limits that aggregate to an unintended firm position. KRIs are backward-looking, so they confirm breaches after loss rather than signal rising risk. The second line sits under the CFO, creating a conflict between risk challenge and financial targets. Internal audit's twice-yearly reporting to the audit committee is too infrequent for a $310bn manager and may not cover emerging-markets derivatives. These are design weaknesses, but the loss also shows operating ineffectiveness: limits, surveillance and escalation did not work. The CEO's 'single rogue trader' framing is a symptom description, not a root cause.
2. Propose a target framework with specific changes to risk appetite, risk register, and three-lines independence. What would you do in the first 90 days?
Read the worked answer
In the first 90 days, reset the risk appetite into a hierarchy: firm-level drawdown, desk-level limits, concentration and liquidity limits, and qualitative prohibitions for unauthorized products. Replace the 1,240-entry register with a smaller set of material risks owned by business heads and challenged by second line; require quarterly attestation and scenario linkage. Move the CRO out of the CFO's line and give direct access to the board risk committee. Strengthen internal audit independence and frequency. For the three lines, define first-line ownership, second-line challenge and third-line assurance; add a new-products and derivatives approval gate. In 90 days I would complete a risk taxonomy, limit redesign, and a targeted review of emerging-markets controls; the full register and KRI suite can follow in six months. The test is whether the framework changes decisions, not whether it produces more documentation.
3. How should the CRO respond to the CEO's 'single rogue trader' argument and measure whether the new framework works?
Read the worked answer
The 'single rogue trader' argument is partly true but irrelevant to framework adequacy: one person exploited weak limits, surveillance and supervision. A robust framework assumes some individuals will try to evade controls. The CRO should respond with evidence: how the position was hidden, which limit or reconciliation failed, and whether similar exposures exist elsewhere. Measure effectiveness through leading indicators: limit breaches, override counts, new-product approvals, KRI trends, time-to-escalate, audit issue closure, and scenario-testing results. Also track risk-adjusted outcomes and whether business units change behaviour after challenge. The CEO's desire for a lighter framework should be reframed: a lighter framework can be simpler, but not weaker. The regulator will look for evidence of board challenge, independent second line and timely escalation. If the CEO resists, the CRO should document the disagreement and escalate to the board risk committee.