A bank discovers that a trader hid losses that grew from Rs 50 crore to Rs 900 crore over eighteen months using fictitious offsetting trades, while reporting steady profits. From the incident file, identify the control failures, show how the loss grew and present what should change.

Five controls failed in sequence: unconfirmed trades were not chased, leave was never enforced, funding needs were not reconciled to a flat book, profits too smooth for a hedged strategy were not questioned, and a former back office employee kept the knowledge to defeat the checks. The loss grew about 27% a month as the trader doubled up to recover, so each month of delay cost more than the last. Catching it at month 6 would have cost Rs 50 crore, not Rs 900 crore.

Think of a gambler who hides a loss from his family and then bets bigger to win it back before anyone notices. Hidden losses grow faster than open ones because the person hiding them has every reason to take more risk to close the hole. Ostrova's losses went from Rs 50 crore to Rs 300 crore in six months, six times, then to Rs 900 crore in the next six. Across the year from month 6 to month 18 that is about 27% a month. In the last six months the hole grew by about Rs 100 crore a month, while the trader reported Rs 4 crore a month of profit.

Walk the file in time order, because the committee will ask when the bank could first have known. No single control had to be perfect; any one of five working normally would have caught the fraud while the loss was a fraction of Rs 900 crore. The fictitious trades had no counterparty, so they could never be confirmed, and unconfirmed trades should age into escalation within days. The trader never took block leave, which is exactly the control designed to let someone else run a book for two weeks and find what does not reconcile. His real positions needed margin and funding that a flat book should not need. His profits were too smooth for the strategy. And his segregation of dutiesSplitting a process so that no one person can both carry out and check the same transaction. was weakened by what he knew from the back office about how bookings were checked.

Put the numbers against the control points. Caught at month 6 the loss is Rs 50 crore; at month 12, Rs 300 crore; at month 18, Rs 900 crore, so the same fraud costs eighteen times more for being found a year later. This is why operational risk cares about detection speed as much as prevention. A control that catches a fraud in weeks turns a capital event into an embarrassing loss; one that catches it in eighteen months turns it into a question about the bank's survival.

Group the fixes by what they protect. Detection: every unconfirmed trade chased and escalated by age, reconciliation of margin and funding to reported risk, and an alert on returns that are too smooth for the strategy the desk says it runs. Prevention: two weeks of block leave each year for every trader, with the book run by someone else, access rights removed when staff move from operations to the desk, and gross as well as net position limits, so a book that is large but looks flat is still visible. Culture: a steady earner should get more questions, not fewer. Close by saying which of these would have caught this case first, trade confirmations, because the committee will fund the fix it believes.