Governance for Derivative Use Policies

Derivative governance frameworks define who can authorize trades, what instruments are permitted, how risks are monitored, and how compliance is enforced. Without clear governance, organizations expose themselves to unauthorized speculation, regulatory violations, and the kind of unchecked risk-taking that has produced some of the most expensive blowups in financial history. The practical foundation isn't complexity—it's clarity of authority, limits, and escalation.

TL;DR: Effective derivative governance requires a documented policy with explicit approval authorities, position limits, and a three-lines-of-defense monitoring structure. The goal is preventing unauthorized risk-taking while still allowing timely hedging execution.

Definition and Key Concepts (What Governance Actually Covers)

Governance for derivative use policies is the formal framework an organization builds to control its derivative activities. This isn't a single document—it's an interconnected system of policies, authorities, limits, monitoring, and reporting that together determine how derivatives get used (and how misuse gets caught).

The core components:

• Policy documentation establishes what's permitted and what's prohibited. This is the foundation—without a clear written policy, everything else breaks down.
• Approval authorities specify exactly who can authorize trades at each size and complexity level. Ambiguity here is where rogue trading starts.
• Oversight structure assigns monitoring responsibilities across independent functions. The key word is independent—the people checking limits should not report to the people executing trades.
• Reporting requirements ensure transparency to senior management, the board, and regulators. What gets reported gets managed.
• Compliance monitoring verifies that actual behavior matches written policy. A policy nobody enforces is worse than no policy at all (because it creates false comfort).

The point is: governance isn't bureaucracy for its own sake. It's the mechanism that converts risk appetite from an abstract board statement into concrete, enforceable constraints on daily trading activity.

The Three Lines of Defense (Why Independence Matters)

The standard governance model uses three independent lines of defense, each with distinct responsibilities:

First line—Trading and Treasury. These teams execute transactions within policy boundaries and perform daily position monitoring. They own the risk directly. Their job is to operate within the limits they've been given, flag issues immediately, and never assume that "close to the limit" means "still fine."

Second line—Risk Management. This function provides independent oversight, performs its own valuations (not relying on trader marks), monitors limit utilization, and escalates breaches. The critical requirement: Risk Management must report independently from Treasury. If the risk team reports to the CFO who also oversees trading, you don't have independence—you have a structural conflict.

Third line—Internal Audit. Audit conducts periodic reviews of the entire governance framework, tests whether policies are actually being followed, and evaluates whether controls are designed effectively. Audit doesn't monitor daily—it validates that the monitoring system works.

Why this matters: every major derivatives disaster (Barings, Orange County, MF Global) involved a breakdown in at least one of these lines. Usually the second—independent risk management was either absent, understaffed, or structurally compromised.

Policy Framework Elements (The Non-Negotiable Components)

A complete derivative policy addresses seven elements. Missing any one creates a gap that unauthorized activity can exploit:

The point is: each element reinforces the others. A policy that permits instruments but doesn't set limits, or sets limits but doesn't require reporting, has structural holes.

How It Works in Practice (Building a Real Policy)

Defining Authorized Instruments (The Permission Matrix)

The most important governance decision is what instruments are permitted, restricted, or prohibited. The classification should reflect both the organization's hedging needs and its operational capacity to monitor and value each instrument type.

A typical permission matrix:

"Restricted" means the instrument can be used but requires approval above the normal authority level—typically Risk Committee or CFO sign-off. "Prohibited" means no one in the organization can execute that trade, regardless of authority level. This distinction matters enormously (a "restricted" instrument with a sufficiently senior approver is still available; a prohibited instrument requires a policy change to use).

Approval Authority Matrix (Who Signs Off on What)

Approval authorities should scale with transaction size, tenor, and complexity. Larger, longer-duration, or more complex transactions require more senior approval:

The core principle: the authority matrix should be conservative enough to prevent unauthorized risk-taking but practical enough that routine hedging doesn't require board approval. If every hedge needs CFO sign-off, either the limits are too tight or the program is too large for the current governance structure.

Setting Risk Limits (Notional, VaR, and Concentration)

Effective limit frameworks use multiple overlapping metrics, because no single measure captures all risk dimensions:

Notional limits cap the gross size of positions:

Risk-based limits constrain actual exposure:

Why this matters: notional limits alone are insufficient. A $100 million interest rate swap and a $100 million equity variance swap have the same notional but vastly different risk profiles. VaR and DV01 limits capture what notional limits miss—the actual risk content of positions.

A sample hedge ratio calculation illustrates this: if you hold a $500 million fixed-rate bond portfolio and execute $450 million in interest rate swaps, your hedge ratio is $450M / $500M = 90%. That ratio, combined with DV01 analysis, tells you whether your residual interest rate risk is within appetite.

Worked Example: Regional Bank Derivative Program (A Mini Case)

Organization: Regional bank, $10 billion in total assets

Derivative program:

• Interest rate risk management via $3.0 billion in interest rate swap notional
• Foreign exchange hedging via $400 million in FX forward notional
• Mortgage pipeline hedging via $500 million in options notional
• Total program notional: $3.9 billion (against a $4.0 billion limit)

Governance Structure in Action

Board of Directors approves the derivative policy annually, sets the risk appetite statement (including maximum VaR tolerance), and receives quarterly exposure reports. The board does not approve individual trades unless they exceed $500 million.

Risk Committee (management level) meets monthly to review all derivative positions, approves transactions exceeding $100 million, monitors limit utilization trends, and escalates concerns to the board. This committee includes the CFO, Chief Risk Officer, Treasurer, and head of Internal Audit (as observer).

Treasury Department executes trades within its delegated authority, manages day-to-day hedging decisions, and reports positions to Risk Management daily. Treasury can execute trades up to $25 million without additional approval.

Risk Management performs independent valuation of all positions (using its own models and market data, not trader marks), monitors all limits in real time, generates exception reports for any limit breach, and reports directly to the CRO—not to the CFO who oversees Treasury.

The Daily Risk Dashboard

Here's what the Risk Committee sees at its monthly meeting, based on the most recent daily snapshot:

Actions triggered:

1. Total notional at 98%—no new trades until existing positions mature or are unwound. Treasury must present a rebalancing plan within 5 business days.
2. Largest counterparty at 85%—next trade must be directed to a different counterparty. Risk Management to review whether the $100 million single-counterparty limit remains appropriate given the program's growth.

The practical point: the dashboard doesn't just display numbers—it triggers specific, pre-defined actions. Every amber and red status should have an associated response protocol (documented in the policy, not improvised in the moment).

Quarterly VaR Reporting to the Board

Q3 breach analysis (the kind of documentation the board should expect):

• Date: August 15
• VaR level: $5.2 million (limit: $5.0 million)
• Cause: Sudden spike in interest rate volatility following unexpected central bank commentary
• Duration: 1 trading day (VaR returned below limit on August 16)
• Action taken: Reduced interest rate swap notional by $200 million within 48 hours
• Policy response: Breach reported to CRO same day, Risk Committee notified within 24 hours, board notified in quarterly report with full analysis

The point is: a single 1-day breach, quickly resolved, is normal operating experience. The governance test isn't "do breaches ever occur" but "are breaches detected immediately, escalated properly, and resolved within the defined timeframe."

Risks, Limitations, and Tradeoffs (Where Governance Fails)

Common Governance Failures

The Central Tradeoff: Control vs. Speed

Every governance framework balances control against execution speed:

Tighter governance means more approval layers, smaller delegated authorities, and more reporting. This reduces operational risk and unauthorized activity but slows hedging execution—potentially causing the organization to miss hedging windows or execute at worse prices.

Looser governance means broader delegated authority and fewer approval requirements. This enables faster response to market conditions but increases the risk of unauthorized or poorly considered trades.

The practical resolution: calibrate governance tightness to the organization's derivative complexity and risk tolerance. A corporate treasury hedging plain-vanilla FX forwards needs less governance overhead than a financial institution running a multi-asset derivative book. The governance should match the program's risk profile, not a generic template.

Regulatory Requirements (The External Constraints)

Governance frameworks don't exist in isolation—they must satisfy regulatory expectations:

Why this matters: regulatory requirements establish a minimum floor for governance. Organizations should build governance that serves their risk management needs, not just regulatory compliance. The best governance frameworks exceed regulatory minimums because the organization's own risk appetite demands it.

Mitigation Checklist (Tiered by Impact)

Essential (high ROI—these prevent 80% of governance failures)

• Document all permitted instruments with explicit permitted/restricted/prohibited classifications
• Establish tiered approval authorities with dollar and tenor thresholds—no ambiguity about who approves what
• Set overlapping risk limits (notional, VaR, DV01, counterparty concentration) with daily monitoring
• Ensure Risk Management independence—the risk function must not report to anyone who also oversees trading

High-Impact (systematic governance)

• Build a daily risk dashboard with pre-defined action triggers for amber and red statuses
• Establish a formal exception process requiring written justification and senior approval for any policy deviation
• Conduct annual policy reviews aligned with changes in risk appetite, regulatory requirements, and program scope
• Implement independent valuation by Risk Management using separate models and market data from trading

Ongoing Maintenance (preventing governance decay)

• Train all participants annually—traders on policy and limits, risk managers on valuation and monitoring, board members on derivative fundamentals
• Track and trend exceptions—if exceptions become routine, the policy needs updating (not more exceptions)
• Test controls periodically through Internal Audit, including simulated limit breaches and escalation scenarios
• Update for regulatory changes as new requirements emerge across jurisdictions

Documentation Retention Standards

The takeaway: governance frameworks work only when they're actively maintained, consistently enforced, and genuinely independent. A well-written policy that nobody follows is worse than no policy at all—it creates an illusion of control while risk accumulates unchecked.

Related reading:

• For liquidity management within hedging programs, see Liquidity Considerations in Hedging Programs
• For automating hedge monitoring and rebalancing, see Automation and Monitoring of Hedge Ratios