The ACE Report is a periodic publication distributed to policyholders and other interested parties as a service by ACE. Its purpose is to address insurance concerns worldwide, as well as present timely information on current developments in liability issues surrounding directors and officers. The Editor of The ACE Report is Dan A. Bailey, a lawyer at Arter & Hadden in Columbus, Ohio, USA and a respected voice in the complex area of directors and officers liability.

Although prepared by professionals, this publication should not be utilized as a substitute for legal counseling in specific situations. Readers should not act upon the information contained herein without professional guidance.

UNDERSTANDING AND REDUCING RISKS FROM FINANCIAL DERIVATIVES
In recent months, concerns about the potential liability exposure from financial derivatives has escalated greatly, due in large part to several highly publicized corporate losses. For example:

• Metallgesellschaft, a German conglomerate, reported its U.S. marketing subsidiary incurred approximately $1 billion of losses in energy derivatives;
• Procter & Gamble reported a $102 million loss from leveraged interest rate derivatives;
• Air Products & Chemicals reported a $60 million loss from leveraged derivative contracts;
• Gibson Greetings, Inc. reported a $3 million loss from its derivative transactions.

Although these numbers evidence the sobering magnitude of potential loss in this area, they pale in comparison to the magnitude of what may be on the horizon. The notational or principal value of financial derivatives today is estimated at $16 trillion. An estimated $10 trillion of that amount represents so-called OTC derivatives, which are tailor-made contracts with mind-boggling complexity.

Because these financial transactions involve huge amounts of money and are so little understood by many boards of directors and senior management, they represent a volatile D&O exposure which is only now being recognized and addressed.

A. WHAT ARE DERIVATIVES?
Derivatives are contracts whose value is "derived" from an underlying asset, such as currencies, stocks, commodities, interest rates or indexes. The derivative instruments are variously called swaps, forwards, futures, puts, calls, swaptions, caps, floors, collars, captions, floortions, spreadtions and look-backs.

The following summarizes the three major types of derivatives:

1. Options. Option contracts grant their purchasers the right but not the obligation to sell a specific amount of the underlying asset at a particular price within a specified period. For example, an invested can purchase a call option on IBM stock, which entitles the investor to buy IBM stock for a specified time at a specified price. The value of the call option during its existence is dependent upon the price of IBM stock at that time. Because the cost of the call option is relatively small, the investor realizes great leverage if the IBM stock price rises, but the call option could become worthless if the stock price falls.
2. Forwards. A forward contract obligates the holder to buy or sell a specific amount or value of an underlying asset on a specified future date. For example, a U.S. importer who contracts to buy certain equipment in six months for a price quoted in German currency can lock-in the dollar cost of that equipment today by purchasing a futures contract pursuant to which German currency will be converted in six months to U.S. dollars at a predetermined exchange rate. Thus, the importer avoids a loss if the dollar cost of German currency increases over the next six months.
3. Swaps. Swaps are agreements between two parties to make periodic payments to each other for a specified period. For example, if one corporation maintains a fixed-rate loan and another corporation maintains a variable-rate loan, the two companies can "swap" their interest positions by agreeing that if interest rates go up, the fixed-rate borrower pays the variable-rate borrower, but if the interest rates go down, the reverse occurs.

Derivatives can serve many roles in one's financial planning strategy. On one hand, derivatives can constitute a conservative hedge to reduce one's exposure to fluctuations in interest rates, currency exchange rates and the prices of equities and commodities. Conversely, depending upon how they are structured, derivatives can also be highly speculative and leveraged investment tools to reduce funding costs and capitalize upon changes in market rates and prices.

These financial products have become routine fixtures in thousands of corporations and have been described as "the basic banking business of the 1990s". Although commonplace, their complexity and potential for enormous loss dictate careful understanding and controls to ensure their use is consistent with a corporation's investment and financial philosophies.

B. RISKS OF DERIVATIVES
Derivatives create five basic areas of risk for a corporation and its D&Os:

1. Credit Risks. The other party to a derivative contract may be financially unable or may refuse to honor its contract obligation, thereby rendering the contract worthless. Because these contracts may span a five or ten year period, a careful evaluation of a party's credit worthiness at the beginning of the contract provides little long-term protection. Of even greater concern is the systemic risk that some event or series of events may cause a "payment gridlock" within the relatively small derivatives market. A sudden failure or abrupt withdrawal from trading of any of the large derivative dealers or some extraneous shock to the market such as a political crisis or natural disaster affecting the global economy, could trigger a liquidity crisis in the market, thereby creating losses for large segments of the market.
2. Market Risks. If the price or value of the underlying asset moves in an unexpected direction, the derivative investor can lose its investment unless its position is adequately hedged. Given the complexity of many derivatives today, adequate hedging is virtually impossible in many instances.
3. Valuation Risks. Even if events occur as expected and the contract is fully honored, the derivative may not be profitable due to the uncertainty of its pricing or valuation. Many derivatives are originally priced and subsequently valued by mathematical models that must include an estimate of what the volatility of the underlying asset will be over the term of the contract. The assumptions which are used to calculate that volatility are somewhat subjective and can change during the term of a contract, with potentially tremendous effects on the profitability of the transaction. The derivative trader may control this valuation determination process, yet the trader has different interests in the transaction than the actual parties, thereby giving rise to at least the suggestion of self-interested decisions by traders. Although reputable traders have appropriate checks and balances to guard against impropriety, the industry is largely unregulated and thus abuses can and undoubtedly do occur and go undetected.
4. Operations Risks. Corporations can also incur derivative losses due to inadequate internal controls, deficient procedures, human error, system failure or fraud. Absent a full understanding and effective maintenance of appropriate policies and procedures concerning their derivative activities, a corporation can be surprised to suddenly realize it has incurred enormous losses arising out of transactions which were originally intended to reduce corporate exposures.
5. Inadequate Disclosures. Even if corporate management adequately understands and anticipates the risks associated with derivative activities, investors likely will not be forewarned. A surprising disclosure to the market of large losses will invariably result in an immediate drop in stock price, which in turn is a magnet for shareholder class action litigation against the corporation and its director and officers. Disclosures relating to derivative activities in annual reports and other documents is virtually worthless, in part because it is not regulated or mandated and in part because derivative activity is so difficult to explain. Even certified financial statements typically do not contain meaningful disclosure because derivative contracts at least initially are off balance sheet items and are recognized in financial statements only as the contract gains a value or becomes a liability. In a 1994 Congressional Report by the U.S. General Accounting Office, the GAO concluded that accounting standards for derivatives were incomplete and inconsistent and have not kept pace with business practices.

These insufficient accounting rules thus increase the likelihood that financial reports will not fairly represent the substance and risk of complex derivative activities to investors.

C. RISK MANAGEMENT PRACTICES
The primary responsibility for managing the risks associated with derivatives rests with a company's board of directors and senior management. Until recently, no comprehensive guidelines existed to assist companies in creating and measuring an effective risk management program. In July, 1993, the Group of Thirty, an international financial policy organization whose members include representatives of central banks, international banks, securities firms and academia, released a study that recommended benchmark risk management practices for the industry. Similarly, in October, 1993, the Comptroller of the Currency issued a Banking Circular to provide guidance on risk management practices to national banks

engaged in financial derivative activities. The following summarizes some of the primary risk management practices identified in those documents.

1. Approval. Any derivatives activity should be approved by the company's board of directors, by a committee of the board or by appropriate senior management specifically designated by the board. In evaluating whether to approve the proposed activity, senior management and the board should fully understand the nature of the proposed derivatives, the goals and business strategies intended to be accomplished, the ability and costs of establishing effective risk management systems with respect to the activity, the ability to attract qualified professionals with derivative expertise, the nature of the risks and any legal restrictions associated with the activity, and the accounting treatment to be given the activity. Following initial approval, any material changes in the derivative activity or new types of activity should also be approved by the board, a committee of the board or designated senior management.
2. Policies and Procedures. Comprehensive written policies and procedures should be developed to govern the use of derivatives. The board of directors should initially approve these policies and procedures and senior management and the board should periodically review these policies and procedures for continuing adequacy in light of the scope, size and complexity of the company's derivative activities. At a minimum, these policies and procedures should identify managerial oversight and responsibilities, the scope of authorized derivative activities, limitations on amount of risk to be incurred, identification of risk measurement and reporting processes, and operational controls.
3. Risk Monitoring. A specific individual or department should be responsible for measuring and reporting risk exposures and compliance with policies and risk limitations. This individual or department should be independent from those individuals or the department conducting the derivative trading, yet should have sufficient experience to understand and communicate the derivative activities and their implications to senior management and the board of directors. Among other things, this individual or department should regularly perform stress simulations to determine how the derivative portfolio would perform under various possible stress conditions. These stress simulations should reflect both historical events and future possibilities. Appropriate contingency plans should be developed in light of the results of the stress tests. This monitoring and control function should be supported with sufficient technical and financial resources and necessary corporate authority and credibility to ensure effective oversight.
4. Risk Management Systems. Adequate systems should be maintained to ensure that market factors affecting risk exposures are properly measured, monitored and controlled. These factors include changes in interest and currency exchange rates, commodity and equity prices and their associated volatilities, changes in the credit quality of parties to the derivative transaction, changes in market liquidity and the potential for major market disruptions. Among other things, a comprehensive risk management system should incorporate procedures to timely identify and quantify the levels of risk, limits and controls over the amount of risk, and to periodically report to senior management and the board of directors concerning the nature and level of risk and compliance with approved policies and limitations.
5. Audit. Sufficient auditing procedures should be adopted to ensure timely identification of internal control weaknesses and system deficiencies. These audits should be performed by competent and independent professionals who are knowledgeable about the derivative transactions and risks associated with those transactions. The degree of audit activity should be commensurate with the company's level of risk and derivative involvement. Among other things, the audit scope should include an appraisal of the soundness and adequacy of accounting, operating, legal and risk controls, as well as testing for irregularities in compliance with established policies and procedures.
6. Proper Resources. The board of directors and senior management should ensure the proper dedication of financial and personnel resources to support the development and maintenance of appropriate operations and systems relating to derivative activities. The magnitude and sophistication of resources devoted to the derivative activity should be commensurate with the size and complexity of the derivative activity. Knowledgeable and experienced personnel should be employed. Appropriate operational systems should be designed and maintained to provide accurate and timely processing of the transactions and to allow for proper risk exposure monitoring. Mechanisms should exist to ensure that derivative transaction documentation is confirmed, maintained and safeguarded and documentation exceptions are properly monitored and reviewed by senior management and legal counsel.
7. 7. Adequate Disclosure. Disclosure statements should contain sufficient information about the company's use of derivatives to provide an understanding of the purposes for which the transactions are undertaken, the extent of the transactions, the degree of risk involved, and how the transactions are reflected in financial statements. Derivative transactions should be marked to market on at least a daily basis, although more frequent marking to market can be helpful in some instances. Changes in value should be immediately reflected in the company's financial statements.

D. CONCLUSIONS
Although derivative transactions in various forms have been a part of financial commerce for centuries, their popularity has mushroomed in recent years due in large part to the recent capability through sophisticated information systems to create extremely complex transactions that are tailor-made to a particular situation and perceived need. Many of these transactions can be created and implemented only through use of large mainframe computers, which constantly track the various elements of the transaction and adjust the rights and obligations of the parties in light of those constantly changing variables. Not surprisingly, these transactions are frequently well understood by the board of directors, senior management, shareholders or regulators, thus creating a problematic environment when the transactions result in unexpected and sometimes enormous losses.

In a macro sense, financial derivatives are just one example of the emerging D&O exposures relating to the explosive use and virtually total reliance on complex information systems. The recent attention to derivatives foreshadows an even more troubling area of risk-loss exposures associated with these massive information systems. In most organizations, if a central computer system fails or is compromised for one of a multitude of reasons (including hardware or software malfunctions or damage, power interruption, espionage, etc.), or if the system was misunderstood and thus misused, massive detrimental consequences could occur to the company. To date, many corporate risk management programs have not adequately addressed the constantly changing and increasingly catastrophic risks inherent in the new information-technology age. Recent examples in the financial derivative area should serve as a "wake-up" call to corporations and their risk managers that creative new risk management programs should be developed to address these emerging and complex issues.