Control: Lehman Brothers

Unit 3, Professor Eugene Soltes, Control: Lehman Brothers and Repo 105.

In another class the same day, Frances Frei asks whether service is something you design. This class asks about control — the audit firm, the law firm, management: what role did each of them play? In this story, every piece of paper is in order. What's missing is the number behind the paper.

Here goes — enjoy:

Case Summary

May 2008: Matthew Lee had been at Lehman for fourteen years. He was a senior vice president in the finance division, responsible for the balance sheets of more than a thousand legal entities worldwide. He read the company's Code of Ethics over and over: if you discover a possible violation, you have a duty to report it immediately; good-faith reporting will not be met with retaliation. He hesitated for a long time. After seeing a lawyer, he decided it was his duty. On May 16, his letter reached the controller, the CFO and the chief risk officer. It made six points: at month-end there was roughly US$5 billion of net assets on the books that no one was really managing; there were billions of dollars of accounts worldwide that didn't reconcile; there were billions of dollars of inventory that, at current market prices and at the volumes they held, probably could be neither bought nor sold. The systems couldn't keep up with the expansion. The finance function in Mumbai might be efficiently distributing wrong numbers. Some senior internal audit staff were not equipped for a job that had become complicated.

The words "Repo 105" did not appear anywhere in the letter.

About two weeks later, his boss called him in: you've been laid off, as part of a larger downsizing. No other reason was given. He fought it, then accepted a severance agreement with a confidentiality clause. Lehman went bankrupt in September, and he never received all the money in the agreement. The audit firm said afterward that the company had investigated the letter itself and reported to the audit committee in July, concluding that the allegations were unfounded and there were no material issues. The firm's own review was never finished — the company no longer existed.

Lehman was founded in 1850, one of Wall Street's oldest and, at one time, most profitable investment banks. In 1984 it was sold to Shearson/American Express; in 1994 it went independent through an IPO. Richard Fuld, a former trader, became chairman and CEO. Its historical strength was fixed income. Investors worried that its fixed-income exposure was too large, so the firm diversified: fixed income fell from 55% of revenue in 1995 to 39% in 2007. In the mid-2000s it deliberately pursued faster growth, shifting from a low-risk brokerage model to a high-risk banking model — the balance sheet went from "passing through" to "holding on." From 2004 to 2007, assets grew by roughly US$300 billion while equity grew by only US$6 billion. The high profits came from riskier things: packaging and trading exotic mortgage-backed securities. In 2007, it posted record revenue of US$19.3 billion and profit of US$4.2 billion. Fuld said:

Smart risk management is never putting yourself in a position where you can't live to fight another day.

It had no retail deposits to fall back on; it relied on short-term loans that were constantly rolled over. Once creditors panicked, the funding would stop. In 1998, when Long-Term Capital Management nearly collapsed, rumors were already going around that Lehman was finished. Fuld quelled that crisis of confidence at the time, and it came to be seen as the defining moment of his career.

In March 2008, Bear Stearns, equally highly leveraged, collapsed. Since mid-2007, analysts and rating agencies had been watching investment bank leverage. After Bear Stearns, it became an urgent task: the market had to see leverage coming down. CFO Erin Callan said she was fighting hand-to-hand combat against the rumors. On March 18 she told the earnings call: we have deliberately brought leverage down; net leverage is 15.4x, versus 16.1 at year-end. On June 2, S&P cut its rating from A+ to A, while still praising its strong funding and liquidity profile. Less than a week later, Lehman pre-announced its first quarterly loss since going public, US$2.8 billion, replaced its CFO, and announced its third equity raise of the year, US$6 billion. The new CFO said: gross leverage has fallen from 31.7 to 24.3, net leverage from 15.4 to 12; the right leverage for now is in the low double digits; we will run the business conservatively.

Not everyone believed it. Hedge fund manager David Einhorn had been shorting the stock since July 2007, and was especially skeptical of the published leverage numbers — about 40x on tangible equity, and holding things that should never have been levered at all. By June 2008, Lehman was the most heavily shorted investment bank on Wall Street. In August it cut 1,500 jobs. Over the first eight months the stock fell 73%. On September 10 it reported another loss, of US$3.9 billion. Three days later, the president of the New York Fed called Wall Street together and made it clear the government would not bail it out. That weekend, there was no buyer. On September 15, Lehman filed for bankruptcy. Its assets exceeded US$600 billion. The largest in American history.

All its peers used repos for short-term funding. An ordinary repo is borrowing: a 2% haircut, the assets stay on the balance sheet, and cash and liabilities rise together. The accounting standards are clear: with collateral between 98% and 102%, you retain effective control and can't treat it as a sale. Lehman invented Repo 105: raise the haircut to 5% or 8%, claim that it had surrendered control, and therefore book it as a sale. Treated as a sale, assets on the balance sheet go down, the cash received pays off other liabilities, equity stays the same, and leverage appears to fall. The case includes an illustrative table: the same US$5 billion, treated as financing, leaves net leverage at 17.6 after paying down debt; treated as a sale, it drops to 15.6.

From Q4 2007 to the end of Q2 2008, this practice cumulatively reduced net assets by more than US$138 billion. Usage ramped up in the days before reporting periods. It used US$24.5 billion at the end of 2006 and US$50.4 billion in Q2 2008. It was never publicly disclosed. In the financial statements it was folded into the derivatives notes. Readers couldn't see that the company was obliged to repurchase tens of billions of dollars of securities within a short period.

American law firms refused to characterize this as a sale. The British law firm Linklaters would, under strict conditions — the securities had to be located in the UK, and the transactions had to be done under English law. So American securities were transferred to an affiliate in London, made the round trip, and were transferred back after the reporting date.

From mid-2007, what the market watched shifted from revenue to the balance sheet. Chief risk officer Madelyn Antoncic had already been urging caution at the executive committee in late 2006. In 2007 she was sidelined — whenever a tense risk topic came up, Fuld had her leave the room along with the deal team. When traders found that sticky assets were hard to sell, and didn't want to sell them at a discount, they could "rent the balance sheet": use Repo 105 to move inventory off temporarily and still hit their net leverage targets. In March 2008 Fuld appointed veteran Bart McDade as "balance sheet czar." McDade wanted traders to be disciplined. In an email he wrote:

another drug we [are] on.

His position: sell the inventory. To those in power, Repo 105 counted as shrinking the balance sheet. Lehman took its laundered ratios to the three rating agencies to argue that it shouldn't face negative action. Repo 105 was nowhere in the materials. The New York Fed and the SEC didn't know either.

The audit firm had audited Lehman's books since it went independent in 1994. Over ten years its fees exceeded US$185 million, and for seven straight years Lehman was one of its fifteen largest clients. In 2001 Lehman showed its internal accounting policy to the engagement partner, hoping to use Repo 105. The audit firm approved it. An internal memo from 2001 put it bluntly: this treatment lets Lehman net down its balance sheet. Lehman initially said the program would be capped at US$20 to 30 billion. In 2007 it started exceeding the cap. The new controller told the engagement partner: usage spikes at every quarter-end; the rationale for treating it as a sale is legalistic and form-driven. The audit firm still felt comfortable with the treatment under the standards. Its own workpapers defined materiality as: a 0.1 move in net leverage, which typically corresponded to US$1.8 billion. US$50.4 billion was 28 times that threshold.

Lee's letter reached the audit firm. The engagement partner immediately told the chair of the audit committee and insisted that management inform regulators. The committee chair asked them to meet Lee and report back every allegation that came up in the investigation — whether or not it was in the letter. The interview was on June 12. On the spot, Lee added something that wasn't in the letter: at the end of Q2, Lehman had used Repo 105 to take US$50 billion of fixed-income securities off the balance sheet, and put them back a few days later.

The next day, the engagement partner briefed the audit committee. He did not mention Repo 105. At the July 8 meeting, and at the July 22 meeting where internal audit reported "no material issues found," he stayed silent. On July 10, the audit firm issued an unqualified review report on the quarterly filing. Less than a month after the interview. The audit committee never knew about Repo 105, never knew American securities were being sent to the UK to do it, and never knew that its scale and quarter-end timing had been raised as a problem.

The audit firm's CEO later gave an interview. In the end, he said, we feel good about the work we did at Lehman. These repos probably would only have changed leverage from 31x to 32x. Lehman would still have been the bank with the third-highest leverage.

Beyond the case, Soltes has us read two other things. One is a letter he received from prison years ago: Stephen Richards, former global head of sales at Computer Associates, served seven years for recognizing contracts two or three days early. In the letter he wrote that executives spend most of their lives in the gray, and that it is a dangerous place. The other is the preface to his new book. The title already states the whole argument: Designing Process Versus Measuring Outcomes. Compliance programs often fail not for lack of effort, but because they measure effectiveness by process inputs — was the training completed, was the policy signed — rather than by whether behavior actually changed.

The three questions in front of this class:

1. If you were a Lehman investor, how would you assess the risk of this business?
2. Why did Lehman use Repo 105?
3. Which institutions, if any, bear responsibility for the use of Repo 105? How would you improve those institutions?

My Thinking

Investors shouldn't look at net leverage, but at what keeps this company alive

I wouldn't start with the 12.1x they quoted publicly. I'd first ask: how would this company die?

It had no stable retail deposits. It rolled over short-term loans every day. The 1998 rumors had already shown how fast this kind of funding can collapse. Once Bear Stearns fell in March 2008, this was no longer a hypothetical enemy. Then look at what was sitting on that thin layer of equity. Over three years, US$300 billion more in assets and US$6 billion more in equity: every new dollar going in was levered 50 times. That record profit in 2007 came from high-margin mortgage-backed securities it held itself. Fuld said never put yourself where you can't fight another day. The balance sheet said the opposite.

Lee put the internal version in his letter. US$5 billion extra at month-end that no one was managing. Billions in accounts that didn't reconcile. Billions in inventory that couldn't be sold at market prices. These aren't footnotes. This is the risk: a business that lives on confidence, funds itself overnight, and sits on sticky valuations.

Einhorn had been short since July 2007. He might not have been able to name Repo 105. He picked the right target — the published ratio, and what lay beneath it. By June, it was the most shorted investment bank. On June 2, S&P was still praising its liquidity profile; a week later the company pre-announced its first quarterly loss since going public.

My own take: a ratio that's only true on the reporting date isn't a risk metric — it's a press-release metric. The investor's scorecard really has just three lines: what keeps it alive, what it holds, and the governance of that number. Repo 105 is the evidence for the third line. Even if you couldn't yet name it at the time, the first two lines were enough.

Repo 105 wasn't financing; it was a drug for the market's benefit

Ordinary repos could already provide funding. What they wanted wasn't cash. They wanted the net leverage number to come down, without having to sell sticky assets at their real prices.

From mid-2007, the market stopped watching revenue and started watching the balance sheet. Fuld made McDade czar. The businesses were ordered to shrink the balance sheet, to avoid a downgrade. McDade wanted them to sell inventory. The traders couldn't sell, or didn't want to eat the discount. So they rented the balance sheet: move things off for a few days, use the cash to pay down debt, leave equity untouched, and the printed ratio comes out lower. McDade gave it the right name — another drug. To those in power, this dose counted as shrinking the balance sheet.

The accounting trick was small and specific. An extra 3 points of haircut bought a "sale." The illustrative table in the case writes the cosmetics in two figures: 17.6 becomes 15.6. Then they hid the product. The sentence American law firms refused to write, they went to London to buy. American securities took a round trip through the London affiliate and were transferred back after the reporting date. The dose rose from US$24.5 billion to US$50.4 billion. Across the last three quarter-ends, US$138 billion in total. Ramped up in the days before the reporting date. Laundered ratios taken to the rating agencies. The term nowhere in the materials.

My own leaning is that the motive has to be stated plainly. This wasn't clever financing. It was window dressing under pressure. Richards wrote about the same slippery slope from prison: once you start managing the number, change the procedure even a little and you and the whole organization are exposed. Lehman's "little" was the extra 3 points, plus an opinion letter from London. After that, every quarter needed a bigger dose.

By the time the form passes, the function has already failed

The headline of this class is the audit firm, the law firm, management. I won't just single out one villain. This system let the form pass and let the function fail.

Management first. They designed the drug, upped the dose, never disclosed it, and took the numbers to the rating agencies. McDade at least called it a drug while in the room. The risk officer had already been shown the door.

The law firm was the ticket. American lawyers refused to call this a sale. That refusal was itself information. Lehman's response was to go buy an answer in a jurisdiction willing to say yes. In the controller's own words: legalistic, form-driven. A legal opinion like that isn't a control. It's a ticket that makes the form stand.

The audit firm approved the policy and knew as early as 2001 that its purpose was to net down the balance sheet. In 2006 someone on the team raised reputational risk; the email stopped at a manager. The controller told the engagement partner that usage spiked at quarter-end. On June 12, the whistleblower said in person that US$50 billion had been moved off and put back a few days later. The committee chair had given the order: report every allegation. The engagement partner was silent on June 13, silent on July 8, silent on July 22. On July 10 he issued an unqualified review. What they measured was whether they were comfortable with the accounting standards. They didn't measure whether the board had heard the ugly sentence.

The audit committee had every chair Sarbanes-Oxley calls for filled: independence, financial experts, executive sessions without management present. They still didn't know the three syllables of Repo 105. You can't oversee a number no one has told you is synthetic.

My own take: no single institution invented this lie. Each one stamped its own small slice of the form, so no one owned the function. In class, it's enough to put two pieces of arithmetic side by side: in the audit firm's workpapers, a 0.1 move in net leverage corresponded to US$1.8 billion; US$50.4 billion was 28 times that. What was later used as a defense was 31 becoming 32 on a different ratio.

The person who can create discomfort is the control

Soltes's preface is titled Designing Process Versus Measuring Outcomes. Measure compliance by process inputs — training completion rates, policy sign-offs, whether a hotline exists — and every box on the paper gets ticked. Lehman had all of it. A Code of Ethics that required reporting and promised no retaliation. An independent audit committee. A Big Four auditor. An opinion letter from a Magic Circle law firm. Lee did exactly what the paper said. The result: laid off, gagged, and after the bankruptcy, never fully paid.

In the book he writes about a gap that matches this letter. Ask employees whether they'd report misconduct if they saw it, and more than 90% say yes. Ask whether they actually reported it in the past six months, and it usually drops below 50%. Forty percentage points. Many compliance programs pretend this gap doesn't exist. Lee was one person inside that gap.

Richards, from another company and another "it's just timing" case, wrote about the gray. Computer Associates recognized contracts two or three days early. In one quarter, legitimate revenue was inflated by 53%. Announced earnings per share were US$0.60; without the accelerated recognition, only US$0.05 was left. He too had comfort letters from a Big Four firm. He too had an investigation by the in-house general counsel that found nothing. Until the board brought in a different law firm, which recovered 23 boxes of missing documents and dug up the emails. In the letter he wrote: one minute you're doing an outstanding job, the next minute you've crossed an imaginary line. The world isn't black and white. Executives spend most of their lives in the gray.

My own take is that the gray isn't somewhere you visit. It's where the quarter gets closed. The person who can create what Soltes calls uncomfortable dissonance — someone outside the inner circle who can still kill the deal — is the control. Antoncic was that person, and she was shown out of the room. Lee was that person, and he was laid off. The person on the audit team who wrote down reputational risk had their email stop at a manager. If that person can't survive the quarter, the rest of the program is paper.

Improving these institutions doesn't mean writing another version of the code. It means changing what they count as success. Once you take the drug away, is the number the CEO quotes on the earnings call still the same number? Is the person who says it isn't still at the table? Those two things are the outcomes.

Takeaways for Arcus42

Reading this case, what comes to mind isn't one investment bank's bankruptcy. It's how any well-written set of controls can turn into window dressing on reporting day.

First, having a code doesn't mean anyone dares to speak. Lehman's paper required reporting and promised no retaliation. Measuring training, sign-offs and whether the hotline exists can't measure Lee being laid off two weeks later. There are only two outcome metrics for speak-up: the person is still here, and the facts reached the table they should have reached.

Second, a number that's only true on reporting day isn't risk control. Portfolios, proposals, progress — anything that only gets tidied up in the three days before a report, first ask McDade's question: are we selling inventory, or are we on drugs? The story we tell externally should still be the same story once you strip out the last three days' maneuvers.

Third, legal opinions should state the purpose, not just whether something can be done. The sentence American lawyers refused to write was the most useful risk-control opinion of the day. Go buy one in another jurisdiction that will write it, and the form will stand. The question for the buyer is: if the only purpose of this move is to make some statement look good, do we still do it?

Fourth, the committee needs to hear the ugly sentence. Setting out the right chairs — independence, expertise, executive sessions — isn't enough. When information is being filtered, oversight is already over. The standard materials should include a mid-quarter versus quarter-end comparison, and every "the form passes" opinion currently in use. If an auditor says a letter looks bad on its face but shouldn't lead to material issues, that sentence is itself the problem.

Fifth, once the gray becomes well-trodden, you need an outsider. Richards wrote that it is a dangerous place. Don't pretend the world is black and white. There has to be someone who doesn't get shown out of the room, who is allowed to say "legalistic, form-driven" out loud. If control serves only the form, it becomes part of the window dressing.

Final Thoughts

Before class, the line I identified with most was "another drug."