The erroneous order sent to the market

Graduate · enrolled learners

This lesson opens with The Goldman Sachs options error, 20 August 2013.

What happened

A software configuration error in Goldman Sachs's systems caused it, at the market open, to send thousands of erroneous options orders into the market, many priced at values, such as one dollar, that were obviously wrong. The orders flooded out because nothing in the path between the system and the exchange checked whether they were sane before they were sent. The potential exposure was estimated at around 100 million dollars, but the exchanges canceled or adjusted most of the erroneous trades, so the realized loss was limited; the SEC nonetheless fined Goldman about 7 million dollars for failing to have adequate pre-trade risk controls. Nothing was hacked; a mistake in a configuration produced a flood of orders no human intended, and there was no gate to catch that a wave of options priced at a dollar could not possibly be right. The system did exactly what its misconfiguration told it to, and sent every one of those orders because nothing was checking.

The decision point

An automated system will send whatever its logic and configuration produce, including a flood of nonsensical orders caused by an error, unless there is a pre-trade control, a gate that checks each order for sanity, price within bounds, size within limits, before it reaches the market and refuses the ones that are obviously wrong. Goldman is the case: a configuration error generated thousands of mispriced options orders, and because nothing checked them for sanity before sending, they all went out, exposing the firm to an estimated 100 million dollars and drawing a regulatory penalty for the missing controls, even though the exchanges busted most of the trades. This is the pre-trade-control lesson of execution engineering: the system that generates orders will sometimes generate wrong ones, from a bug, a bad configuration, a fat finger upstream, so there must be an independent check between the order and the market that asks whether this order can possibly be right and blocks it if not. A system without such a gate trusts its own correctness absolutely, and an execution path that assumes its orders are always sane will faithfully transmit a wave of insane ones the moment something upstream goes wrong. So the discipline is to gate every automated order with pre-trade checks, price collars, size and notional limits, rate limits on how many orders can be sent, that sit between the strategy and the exchange and reject anything outside sane bounds, because Goldman showed that the absence of that gate is itself the failure: when the order generator malfunctions, the only thing standing between the mistake and the market is the control that was not there.

Recorded loss

$7,000,000

Orientation and Year One are open: anyone can read them without an account. From Year Two onward the lessons are for enrolled learners, because progress through the later years only means anything if it is tracked against a record.

It is free. We do not sell the list and there is nothing to buy at the end of it.