The erroneous order sent to the market

Graduate · enrolled learners

This lesson opens with The Goldman Sachs options error, 20 August 2013.

What happened

A software configuration error in Goldman Sachs's systems caused it, at the market open, to send about 16,000 mispriced options orders to the exchanges in less than an hour, every one priced at one dollar, and about 1.5 million contracts executed within minutes. The orders flooded out because the checks in the path between the system and the exchange were not up to it: the SEC found its price checks for pre-market options orders unreasonably wide, and circuit breakers that would have halted the outgoing orders had been lifted by an employee. Reuters, citing a person familiar with the matter, put Goldman's losses in the tens of millions of dollars, and the exchanges canceled or adjusted many of the erroneous trades, so the realized loss was limited; the SEC nonetheless fined Goldman about 7 million dollars for failing to have adequate pre-trade risk controls. Nothing was hacked; a mistake in a configuration produced a flood of orders no human intended, and there was no working gate to catch that a wave of options priced at a dollar could not possibly be right. The system did exactly what its misconfiguration told it to, and sent every one of those orders because nothing was checking.

The decision point

An automated system will send whatever its logic and configuration produce, including a flood of nonsensical orders caused by an error, unless there is a pre-trade control, a gate that checks each order for sanity, price within bounds, size within limits, before it reaches the market and refuses the ones that are obviously wrong. Goldman is the case: a configuration error generated about 16,000 options orders priced at one dollar, and because its price checks were too wide and its circuit breakers had been lifted, they all went out, costing the firm what Reuters reported as tens of millions of dollars and drawing a regulatory penalty for the inadequate controls, even though the exchanges canceled or adjusted many of the trades. This is the pre-trade-control lesson of execution engineering: the system that generates orders will sometimes generate wrong ones, from a bug, a bad configuration, a fat finger upstream, so there must be an independent check between the order and the market that asks whether this order can possibly be right and blocks it if not. A system without such a gate trusts its own correctness absolutely, and an execution path that assumes its orders are always sane will faithfully transmit a wave of insane ones the moment something upstream goes wrong. So the discipline is to gate every automated order with pre-trade checks, price collars, size and notional limits, rate limits on how many orders can be sent, that sit between the strategy and the exchange and reject anything outside sane bounds, because Goldman showed that the absence of that gate is itself the failure: when the order generator malfunctions, the only thing standing between the mistake and the market is the control that was not there.

Recorded loss

$7,000,000

Orientation and Year One are open: anyone can read them without an account. From Year Two onward the lessons are for enrolled learners, because progress through the later years only means anything if it is tracked against a record.

It is free. We do not sell the list and there is nothing to buy at the end of it.