When the Risk Model Is the Risk: Algorithmic Trading Risk Management, the Institutional Way

At the start of 2012, a portfolio held by JPMorgan Chase’s Chief Investment Office kept breaching its risk limits. Then a new value-at-risk model was introduced, and the problem appeared to disappear. The new model roughly halved the portfolio’s reported risk.

Months afterward, the trades that came to be called the “London Whale” had lost more than $6 billion. An internal review by the bank later found that the new model relied on spreadsheets populated through manual copy-and-paste steps and contained calculation errors.

The trades were risky. More unsettling was the number that declared them safe.

Here lies the paradox at the center of algorithmic trading risk management. Every risk system is itself a model, built by people, coded in software, and capable of being wrong. Institutions that survive have learned to ask a question most traders never consider: who measures the measurer?

Why VaR Is Not Enough

Value at risk won its popularity by reducing a portfolio’s danger to a single figure. Its simplicity is also its flaw. VaR describes losses under ordinary conditions and says little about how bad the worst days can be.

Regulators have taken the point. The Basel Committee’s revised market risk framework replaced VaR with expected shortfall in bank capital models. Expected shortfall asks a harder question: once you are in the tail, what does the average loss look like?

The principle applies far beyond banking. Serious quantitative trading research treats risk metrics with the same skepticism it applies to alpha signals. Metrics are tested against historical crises, their assumptions are documented, and any methodological change is independently reviewed. A risk model that cannot be challenged is just an opinion with decimals.

Limit the Execution, Not Just the Exposure

The Flash Crash struck U.S. markets on May 6, 2010. A joint SEC and CFTC report pointed to a key trigger, a sell program of 75,000 E-mini S&P 500 futures contracts executed by an algorithm that targeted a share of trading volume without regard to price or time.

The position was ordinary. Its execution was not constrained.

Institutions now build execution limits directly into AI trading system development. Typical controls include price collars that block orders far from the prevailing market, participation caps, order-rate throttles, and checks that pause an algorithm when conditions shift faster than it was built to handle. Exposure limits govern the size of a loss. Execution limits govern its speed.

Defense in Layers

No mature risk architecture trusts a single control. Controls are stacked.

At the first here layer, pre-trade checks stop orders that break size, price, or credit limits before they leave the firm. Intraday monitoring tracks positions and losses in real time, with hard limits that halt trading and soft limits that trigger escalation. Afterward, post-trade review reconciles what actually happened against what was meant to happen.

Each layer is built on the assumption that the layer before it could fail. That assumption is not pessimism; it is engineering.

Risk Logic Deserves Production Rigor

Ordinary software problems contributed to the London Whale model’s failure: manual processes, too little testing, and weak change control. In institutional algorithmic trading software development, risk logic now receives the same rigor as the trading engine itself. Every change goes through version control and peer review, and new models run alongside old ones before any switch is made.

Firms also run historical crises back through their systems to confirm that controls actually fire. Here AI trading infrastructure consulting often adds the most value, since an outside team with no attachment to the existing design can test whether safeguards hold under conditions their builders never imagined.

When a Limit Breaks

A limit is only as strong as the response when it is crossed. In disciplined institutions, a breach triggers escalation to people independent of the trading desk, and the default response is to reduce risk, not to revisit the limit.

The riskiest moment in any risk framework comes when someone explains a breach away.

The Four-Question Audit

Before trusting any risk framework, ask:

Was the risk model validated by people independent of its owners?
How does the system behave in the tail, not merely on an average day?
Can an algorithm lose money faster than a human can intervene?
When a limit breaks, does the portfolio change, or does the limit?
Why Risk Numbers Need Doubt

Risk numbers carry a strange emotional power. They let people sleep. They let committees approve. They turn uncertainty into something that looks like knowledge.

That comfort is precisely why institutions surround such numbers with doubt.

Nothing about the London Whale trades was concealed. They were in plain view and measured daily. The danger was never invisible. It was recorded in a number everyone wanted to believe.