Berkshire 2008 Annual Letter

Berkshire Hathaway annual letter for 2008 is out. I found this section particularly informative as it relates to mixed incentives and attempting to gain some assurance whilst dealing with complexity:

Derivatives 
Derivatives are dangerous. They have dramatically increased the leverage and risks in our financial 
system. They have made it almost impossible for investors to understand and analyze our largest commercial banks and investment banks. They allowed Fannie Mae and Freddie Mac to engage in massive misstatements of earnings for years. So indecipherable were Freddie and Fannie that their federal regulator, OFHEO, whose more than 100 employees had no job except the oversight of these two institutions, totally missed their cooking of the books. 

Indeed, recent events demonstrate that certain big-name CEOs (or former CEOs) at major financial 
institutions were simply incapable of managing a business with a huge, complex book of derivatives. Include Charlie and me in this hapless group: When Berkshire purchased General Re in 1998, we knew we could not get our minds around its book of 23,218 derivatives contracts, made with 884 counterparties (many of which we had never heard of). So we decided to close up shop. Though we were under no pressure and were operating in benign markets as we exited, it took us five years and more than $400 million in losses to largely complete the task. Upon leaving, our feelings about the business mirrored a line in a country song: “I liked you better before I got to know you so well.” 

Improved “transparency” – a favorite remedy of politicians, commentators and financial regulators for 
averting future train wrecks – won’t cure the problems that derivatives pose. I know of no reporting mechanism that would come close to describing and measuring the risks in a huge and complex portfolio of derivatives. Auditors can’t audit these contracts, and regulators can’t regulate them. When I read the pages of “disclosure” in 10-Ks of companies that are entangled with these instruments, all I end up knowing is that I don’t know what is going on in their portfolios (and then I reach for some aspirin). 

For a case study on regulatory effectiveness, let’s look harder at the Freddie and Fannie example. 
These giant institutions were created by Congress, which retained control over them, dictating what they could and could not do. To aid its oversight, Congress created OFHEO in 1992, admonishing it to make sure the two behemoths were behaving themselves. With that move, Fannie and Freddie became the most intensely-regulated companies of which I am aware, as measured by manpower assigned to the task. 

On June 15, 2003, OFHEO (whose annual reports are available on the Internet) sent its 2002 report to 
Congress – specifically to its four bosses in the Senate and House, among them none other than Messrs. Sarbanes and Oxley. The report’s 127 pages included a self-congratulatory cover-line: “Celebrating 10 Years of Excellence.” The transmittal letter and report were delivered nine days after the CEO and CFO of Freddie had resigned in disgrace and the COO had been fired. No mention of their departures was made in the letter, even while the report concluded, as it always did, that “Both Enterprises were financially sound and well managed.” 

In truth, both enterprises had engaged in massive accounting shenanigans for some time. Finally, in 
2006, OFHEO issued a 340-page scathing chronicle of the sins of Fannie that, more or less, blamed the fiasco on every party but – you guessed it – Congress and OFHEO. 

The Bear Stearns collapse highlights the counterparty problem embedded in derivatives transactions, a 
time bomb I first discussed in Berkshire’s 2002 report. On April 3, 2008, Tim Geithner, then the able president of the New York Fed, explained the need for a rescue: “The sudden discovery by Bear’s derivative counterparties that important financial positions they had put in place to protect themselves from financial risk were no longer operative would have triggered substantial further dislocation in markets. This would have precipitated a rush by Bear’s counterparties to liquidate the collateral they held against those positions and to attempt to replicate those positions in already very fragile markets.” This is Fedspeak for “We stepped in to avoid a financial chain reaction of unpredictable magnitude.” In my opinion, the Fed was right to do so. 

A normal stock or bond trade is completed in a few days with one party getting its cash, the other its 
securities. Counterparty risk therefore quickly disappears, which means credit problems can’t accumulate. This rapid settlement process is key to maintaining the integrity of markets. That, in fact, is a reason for NYSE and NASDAQ shortening the settlement period from five days to three days in 1995. 

Derivatives contracts, in contrast, often go unsettled for years, or even decades, with counterparties 
building up huge claims against each other. “Paper” assets and liabilities – often hard to quantify – become important parts of financial statements though these items will not be validated for many years. Additionally, a frightening web of mutual dependence develops among huge financial institutions. Receivables and payables by the billions become concentrated in the hands of a few large dealers who are apt to be highly-leveraged in other ways as well. Participants seeking to dodge troubles face the same problem as someone seeking to avoid venereal disease: It’s not just whom you sleep with, but also whom they are sleeping with. 

Sleeping around, to continue our metaphor, can actually be useful for large derivatives dealers because 
it assures them government aid if trouble hits. In other words, only companies having problems that can infect the entire neighborhood – I won’t mention names – are certain to become a concern of the state (an outcome, I’m sad to say, that is proper). From this irritating reality comes The First Law of Corporate Survival for ambitious CEOs who pile on leverage and run large and unfathomable derivatives books: Modest incompetence simply won’t do; it’s mindboggling screw-ups that are required. 

Two important takeaways for infosec. First regulation and auditing cannot solve structural problems, this is why we need to be asset focused not auditor focused in infosec. Secondly you can "secure" your link from point a to point b, but its whom the other end is sleeping with that counts, so improving security on the method and data is equally important as the channel. Buffett is one of the best examples we have in thinking about risk, and there is a lot to learn from his writing and actions.

Comments

[Adrian Lane]

Most people don't even know what derivative banking is ... they don't teach it in school, and I never saw it in any macro-econ course I took in college. Basically it is lending money they don't have. But it has gotten so out of hand that the percentage of real money in savings does not represent 1/1000th of the money loaned. There is no money, only debt. So when you fail to underwrite loans with rigor and common sense, your loans fail, and there is no balance in the system to offset the collapse. When new CEO of Freddie-Mac (Moffett) up and quit this morning, it is a pretty telling statement that he does not think he can fix the problems.

Thanks for posting this.

-Adrian