Rogue Trader: postmortem
You recently graduated and just started employment at the New York office of one of the Big Four accounting firms. Your first week at the firm included presentations on the organization of the firm, as well as firm policies and procedures. Tomorrow morning, you begin a two-week training program on internal controls and you have a whole binder of information that you must read in preparation for the exercises and role-playing that are included in the training.
You recognize most of the materials in the binder because you studied them in your ACC 409/609 class: The Committee of Sponsoring Organizations Report, Internal Control—Integrated Framework.
You also notice that there are several cases addressing internal control issues. One case is the
Barings Bank collapse and there is a video of this case that you and the other staff auditors will view as part of the training. You want to be prepared for the discussions during the training sessions, so you conduct some research on these topics, especially Barings Bank, because you are not familiar with that case.

The COSO Framework
You search the COSO website and find the 2013 Internal Control—Integrated Framework that outlines five essential components of any internal control system: (1) control environment, (2) risk assessment, (3) control activities, (4) information and communication, and (5) monitoring. This updated version of the Framework introduces 17 principles associated with the five components.
These principles provide clarity for the user in designing and implementing systems of internal control and for understanding requirements for effective internal control. You decide to summarize each of the five components as a first attempt to relate the COSO Framework to the Barings Bank failure. You label your work “Summary of COSO and Barings Bank” (see Exhibit 1). You know you do not have to answer all of these questions, but you think that this summary will help structure your thinking.

Cast of Characters (from Rogue Trader, the movie)
Nick Leeson (the Rogue Trader) is the son of a British plasterer. He rose from the 
position of bank clerk to General Manager (June 1992 to February 1995) of Barings Futures Singapore. About his chosen career, Nick said, “I was told I could either work Foreign Exchange or in the Futures and
Options Division. I opted for Futures and Options, thereby sealing my own future. Since I hadn’t taken the exams at that time, I had no authority to trade on the SIMEX floor itself. But I was in charge of the entire team.”
Lisa Leeson was Nick’s wife. Of his wife, Nick wrote, “she knew nothing. Not even the first thing. Not even the first tiny, tiny error of £20,000 that Kim had made back in 1992, starting it all off.”
Peter Baring was the Chairman of Barings Bank. According to the minutes of a meeting on
September 13, 1993, with the director of the Bank of England, he said, “The recovery in profitability has been amazing, leaving Barings to conclude that it was not actually terribly difficult to make money in the securities business.”
Peter Norris was the CEO of Barings Securities Limited in London.
Simon Jones was Regional Operations Manager of Barings South Asia, the Chief Operating Officer of Barings Securities Singapore and Director of Barings Futures Singapore. He was Nick’s immediate supervisor until the beginning of 1994. Of Jones, Nick said, “he wasn’t interested in the futures and options side of the business. I’d go up to see him in the afternoon, but we mainly talked about football.
As for business, we scarcely talked about it.”

Ron Baker was Head of the Barings Financial Products Group in London. Nick said of Baker, who became Nick’s direct boss at the beginning of 1994, “In due course, Baker began to be excited by the size of the profits I was reporting, and he took 
direct responsibility for me.”
Brenda Granger was in the Settlements Department in London. Nick directly made 
requests for cash to her, and she transferred funds on a daily basis to Singapore to 
meet SIMEX margin payments.
Tony Railton was the Senior Settlement Clerk from the London office. He was sent 
to Singapore in
January 1995. Two days before the Barings Bank scandal hit the headlines, Nick said of Tony, “He was a big, bulky man, running a little too fat, and always anxious to please. I’d see if I could fob him off with another useless chore. He was no nearer finding my account than he was a week ago, and he’d been ferreting around the office for a month now. It was pathetic.”
Ash Lewis was the formidable internal auditor from Barings Bank in London who never did get to do the audit of the Singapore operation.
George Seow was the first trader Nick recruited.
Risselle Sng handled the settlements in the back office in Singapore.
Kim Wong was a novice trader that Nick recruited. According to Nick, “I couldn’t work it out: there was one slip — a sale note for twenty contracts — and I couldn’t see the balancing purchase. I looked at the initials on the slip: it was Kim 
Wong.”
Mui Mui was the external auditor from Coopers & Lybrand who questioned Nick 
about the 7.78 billion yen (50 million pounds) receivable from SIMEX.

Barings Bank and Singapore Operations 

Barings Bank activated its seat on the Singapore International Monetary Exchange (SIMEX) in 1992.
According to Nick, “not only did the powers-that-be really want me [in Singapore], but they probably wouldn’t go ahead without me. They wanted me to set up the operation and run it. I would recruit traders and back office staff and make money.” More information from Nick: “We had just set up shop in SIMEX, and I had no authority to trade myself. I was there just to fill Fernando’s orders from Tokyo.
I would take his orders over the phone, signal them to George, and tell Fernando whether we’d completed them.” 
According to Leeson, the deals were very simple. They were doing something called arbitraging. Fernando would watch the futures contract in Osaka, the center for Nikkei futures trading, and Leeson would tell him every two seconds what was going on in Singapore. Sometimes a local trader would be buying in one market without the ability to trade in the other, and he might have an order that pushed up the whole market price in SIMEX. For a few seconds a difference would open up between the Osaka and Singapore prices, and that is when Fernando and Leeson went into action. Leeson claimed that arbitraging futures and options was, technically speaking, a low-risk business. The only real risk was the split second it took for Fernando to tell Leeson what he wanted to do, for Leeson to tell George (Nick’s trader on the floor of SIMEX), and then for George to do it. 
Nick
Leeson soon observed that “people in Barings were more interested in the bottom line than they were in how it had been reached. They just looked at the balance sheet to satisfy themselves that they were in control of the operation and left it at that.” Leeson explained that Barings Bank managers were focused mainly on the profit and loss account, since this account spelled out the profits which drove their salaries and bonuses. 
In reviewing the collapse of the Barings Bank, many lapses and violations were evident. The central violation was Nick Leeson’s practice of trading with the bank’s money, which he was able to cover up by lies, false entries, and forgery. He ran up losses of $1.4 billion through derivatives trading, and in the aftermath of an earthquake, his losses were discovered.
Subsequently, Barings Bank was sold for £1.

Case Requirements
Your firm’s trainer assigned a written report. Toward the end of your training, there will be a discussion of the COSO framework and the Barings Bank failure. Your task is to use the COSO framework and the notes you collected from viewing the movie Rogue Trader to write a report that identifies the internal control problems that were evident at the Barings Bank. Apparently, several of the firm’s partners intend to sit in on this session and will be given copies of your work, so you will want to give this report your best effort.
1. In all organizations, senior executives and managers are very busy and will not spend time reading a report that is of no interest to them. If your title and the opening paragraphs of your report do not quickly capture their interest, they will most likely move to the next project. With this in mind, make up a “catchy” title for your report and a compelling introduction that will intrigue the partners and capture their attention.
2. Your report must have the following seven sections (in bold font): Introduction, Control
Environment, Risk Assessment, Control Activities, Information and Communication, Monitoring, and Conclusion.
3. Your Introduction section should be succinct and informative, and it should motivate the partners to read further.
4. In the Control Activities section, consider the controls for corporate governance that you would expect to be in place at the Barings U.K. head office. Include any IT general controls and/or IT application controls that you believe are relevant. After dealing with the head office control activities, drill down to the Barings Singapore operation and discuss the control activities of the
Singapore trading operations and information process. Review Exhibit 1 and then identify controls at various levels using your textbook.
5. Your Conclusion should clearly indicate what your firm can learn from the Barings Bank case.
Structure this section around the three key elements of the fraud triangle.
6. Within the seven sections mentioned above, be sure to include a discussion of the following issues regarding Barings Bank:
• Describe the internal control environment.
• What basic internal control principle was violated?
• What other control weaknesses allowed Nick Leeson to engage in fraudulent activities?
• What motivated Leeson to engage in these activities?
• Did the reward structure encourage risk taking?
• What was the “tone at the top” and why is this important?
• Was Nick treated differently than other employees?
• What were some of the red flags that management ignored, and why did they ignore them?
• How did Nick conceal his fraudulent activities?
• What controls should have been in place to prevent the fraud from occurring?
• What other factors caused Barings Bank to go bankrupt?
7. Type your report using Times New Roman, 12-point font, 1-inch margins, and double-spacing.
Grammatical or spelling errors will not impress the partners. Furthermore, they are very busy, so your report should not include redundant or unclear prose. Once you finish your draft, proofread your report and revise it as necessary.

EXHIBIT 1
 - Summary of COSO and Barings Bank
1. The “Control Environment” establishes the tone of a company and influences the control awareness of the employees. It is the foundation for all the other internal control components and provides discipline and structure for the entire business operation.
Questions relating to the Control Environment
• Do board members and senior executives set a consistent example of high integrity and ethical behavior? • Is there a written code of conduct for employees, and is it reinforced by training, top down communications, and requirements for periodic written statements of compliance from key employees? • Are performance and incentive compensation targets reasonable and realistic?
• Is it clear that fraudulent financial reporting at any level and in any form will not be tolerated?
• Are ethics woven into criteria that are used to evaluate individual and business unit performance?
• Does management react appropriately when receiving bad news from subordinates and business units?
• When instances of noncompliance are reported, do board members and senior executives 
take appropriate action and ensure effective action through testing?
• Does a process exist to resolve close ethical calls?
• Do board members and senior executives receive internal and external information from accounting and other information systems to make informed and timely decisions?
2. The 
purpose of “Risk Assessment” is to identify organizational risks, analyze their potential in terms of costs and likelihood of occurrence, and install those controls whose projected benefits outweigh their costs.
Questions relating to Risk Assessment:
• Are business risks identified and candidly discussed with the board of directors?
• Do the board and management properly evaluate risks with regard to new personnel and new or expanding lines of business activities?
• Do the board and management discuss and appropriately consider control issues when entering new markets?
• Are there sufficient personnel who are competent and knowledgeable to manage current and new business activities, and have they been provided with adequate resources?
• Do the board and management involve auditors or other internal control experts in the risk assessment process?
3. “Control Activities” are the policies and procedures that an organization develops to help protect the assets of the firm.
Questions relating to Control Activities:
• Do board members and senior executives demonstrate that they accept control responsibility, and not merely delegate that responsibility to financial and audit staff?
• Does management clearly assign responsibilities for employee training and monitoring of internal controls?
• Are periodic, systematic evaluations of control systems conducted and documented by personnel with appropriate responsibilities, experience, and knowledge?

•
•
•

Are control deficiencies reported to higher levels of management and corrected on a timely basis? Are appropriate controls built in as new information systems are designed and implemented?
Are key risk-taking activities segregated from reconciliation activities?

4. “Information and Communication” include the methods that management uses to record, process, and exchange information within the firm so that employees understand their roles and responsibilities pertaining to internal control. 

Questions relating to Information and Communication:
• Do accounting systems properly identify, assemble, analyze, classify, record, and report the institution’s transactions in accordance with GAAP?
• Are the reports generated for operational, financial, managerial, and compliance-related activities sufficient to properly manage and control the institution?
• Do accounting, information, and communication systems ensure that risk-taking activities were within policy guidelines?
• Do all personnel understand their roles in the control system?
• Do all personnel understand their accountability for the activities they conduct?
5. The “Monitoring” process is a management responsibility that assesses the quality of internal control performance over time. Questions relating to Monitoring:
• Does internal auditing have the support of board members and senior executives?
• Is the organizational relationship between internal auditing and senior executives appropriate?
• Are audit reports covering the right subjects distributed to the right people in a timely 
manner?
• Do audit personnel possess an appropriate level of expertise?
• Are managers held accountable if they do not effectively follow up on control weaknesses?