When the Risk Model Is the Risk: Algorithmic Trading Risk Management, the Institutional Way

At the start of 2012, a portfolio held by JPMorgan Chase’s Chief Investment Office kept breaching its risk limits. Then a new value-at-risk model arrived, and the problem seemed to vanish. Under the new model, the portfolio’s reported risk fell by roughly half.

Within months, the trades later known as the “London Whale” had generated losses of more than $6 billion. The bank’s own internal review found that the new model depended on spreadsheets fed by manual copy-and-paste steps, and that it contained calculation errors.

The trades were risky. More unsettling was the number that declared them safe.

This contradiction sits at the heart of algorithmic trading risk management. Every risk system is itself a model, built by people, coded in software, and capable of being wrong. Surviving institutions have learned to pose a question most traders overlook. Who measures the measurer?

The Trouble With One Number

Value at risk won its popularity by reducing a portfolio’s danger to a single figure. The same simplicity is its greatest weakness. VaR captures losses in ordinary conditions but reveals little about how severe the worst days can become.

Regulators learned this too. The Basel Committee’s revised market risk framework moved bank capital models from VaR to expected shortfall, a measure that asks what the average loss looks like once you are already in the tail.

This principle extends well past the banking sector. Serious quantitative trading research treats risk metrics with the same skepticism it applies to alpha signals. Metrics are tested against historical crises, their assumptions are documented, and any methodological change is independently reviewed. A risk model that cannot be challenged is just an opinion with decimals.

Limit the Execution, Not Just the Exposure

The Flash Crash struck U.S. markets on May 6, 2010. The joint SEC and CFTC report identified a key trigger: a sell program of 75,000 E-mini S&P 500 futures contracts, executed by an algorithm that targeted a share of trading volume without regard to price or time.

Nothing about the position was exotic. The execution simply had no constraints.

Execution limits are now a core part of institutional AI trading system development. These include price collars that block orders far from the prevailing market, participation caps, order-rate throttles, and checks that pause an algorithm when conditions change faster than it was designed to handle. Exposure limits tell you how much you can lose. Execution limits decide how fast.

Stack the Controls

Mature risk architectures seldom depend on a single control. They stack several.

Before an order leaves the firm, pre-trade checks read more reject it if it violates size, price, or credit limits. Intraday monitoring follows positions and losses in real time, using hard limits that stop trading and soft limits that trigger escalation. Post-trade review then compares what happened with what was supposed to happen.

Each layer assumes the one before it might fail. That assumption is not pessimism. It is engineering.

Treat Risk Code as Critical Code

Ordinary software problems contributed to the London Whale model’s failure: manual processes, too little testing, and weak change control. In institutional algorithmic trading software development, risk logic now receives the same rigor as the trading engine itself. Changes are version-controlled and peer-reviewed, and a new model runs in parallel with the old one before it takes over.

Firms also run historical crises back through their systems to confirm that controls actually fire. Here AI trading infrastructure consulting often adds the most value, since an outside team with no attachment to the existing design can test whether safeguards hold under conditions their builders never imagined.

Give Breaches Authority

A limit is only as strong as the response when it is crossed. In disciplined institutions, a breach triggers escalation to people independent of the trading desk, and the default response is to reduce risk, not to revisit the limit.

The riskiest moment in any risk framework comes when someone explains a breach away.

The Four-Question Audit

Before you trust a risk framework, ask four questions:

Was the risk model validated by people independent of its owners?
What does the system do in the tail, not just on an average day?
Can an algorithm lose money faster than a human can intervene?
When a limit is breached, which changes: the portfolio or the limit?
Why Risk Numbers Need Doubt

Risk numbers hold an odd emotional power. They help people sleep and let committees approve. They make uncertainty look like knowledge.

Institutions surround these numbers with doubt for exactly that reason.

The London Whale trades did not hide. They sat in plain view and were measured every day. The danger was never invisible. It was recorded in a number everyone wanted to believe.