FRM Exam Part II · Madoff: A Riot of Red Flags

Madoff: SEC Failures, Markopolos Warnings and Lessons

Updated 11 October 2026 · Fact-checked

This topic asks why regulators and investors missed Madoff's Ponzi scheme despite repeated warnings, and what controls would have caught it. Solve questions by naming the red flag, the failed control (verification, skepticism, independence), and the fix: independent confirmation of assets, trades and custody, plus operational due diligence.

Understand Regulatory Failures and Lessons for Risk Managers

Bernard Madoff ran a Ponzi scheme: returns paid to earlier investors came from the money of newer investors, not from real trading. The reported strategy was a split-strike conversion (stocks plus options collars). Reported returns were smooth and consistent, which real strategies of that kind could not produce.

Harry Markopolos, an independent analyst, warned the SEC several times over about a decade, starting in 2000. He showed that the reported numbers were mathematically implausible. For example, the strategy would have needed more options than existed in the market. The SEC examined Madoff more than once but did not catch the fraud. The failures were mainly about process and skill, not a lack of data: examiners did not verify trades with independent third parties, such as the Depository Trust Company or option counterparties. They accepted documents that Madoff supplied.

The weaknesses were also organisational. Examination and enforcement teams lacked derivatives expertise. Tips were not escalated or tied together. Madoff's reputation and his standing in the industry created deference. Investors and feeder funds made the same error: they relied on his name and on past performance instead of testing his claims.

The lessons for risk managers and investors are practical. Verify independently. Be sceptical when results look too good. Insist on separation of roles: an independent custodian, an independent administrator and a reputable auditor. Treat operational risk as seriously as investment risk, and do operational due diligence before investing, not afterwards.

Key formulas to remember

Ponzi test: Cash paid out to investors > Cash earned from real investments → scheme depends on new inflows; A scheme survives only while new deposits exceed redemptions. A wave of redemptions, as in late 2008, exposes it.
Independent verification rule: Claim = Trusted only if confirmed by an independent third party; Confirm assets with the custodian, trades with the clearing house or counterparty, and returns with the administrator. Never rely only on manager-provided records.
Operational due diligence checklist: Custodian + Administrator + Auditor + Governance + Valuation + Service-provider independence; Each item should be independent of the manager. In Madoff's case the broker-dealer, adviser and custodian functions were all under one roof.
Plausibility check on returns: Sharpe ratio = (Rp − Rf) ÷ σp; An unusually high Sharpe ratio with very few down months is a warning sign, not proof of skill.

How to solve Regulatory Failures and Lessons for Risk Managers questions

Use the same sequence for any question on Madoff, regulators or lessons. It keeps your answer tied to the exact failure and the exact control.

1Read the scenario and identify who is acting: the SEC, a feeder fund, an investor or a risk manager.
2Name the red flag shown: implausible returns, opaque strategy, auditor mismatch, no independent custodian, secrecy or fee structure.
3Identify which control should have caught it: independent verification, expertise, escalation, segregation of duties or due diligence.
4Decide whether the failure was one of data, skill, process or incentives. Madoff failures were mostly process and skill.
5Match the fix to the failure: third-party confirmation for verification, a specialist team for expertise, a tip-escalation process for ignored warnings.
6Check the answer options. Choose the one that gives an independent, verifiable action, not one that relies on the manager's reputation or documents.
7Confirm the answer addresses operational risk, not just investment performance.

Quickest way: Red flag to control matching

When to use it: Use this when an MCQ lists several red flags or several possible actions and time is short.

Underline the one fact in the stem that looks too good or too opaque.
Ask: who is confirming this, and are they independent of the manager?
Eliminate options that accept manager-supplied evidence or rely on reputation.
Pick the option that adds independent verification or specialist scrutiny.

Common mistakes in Regulatory Failures and Lessons for Risk Managers

Saying the SEC lacked information about Madoff.
Students forget that Markopolos delivered detailed analysis several times.
Fix: Say the SEC had the information but failed to verify, escalate and act on it, partly through weak expertise and process.
Treating the fraud as an investment risk problem.
The topic seems to be about returns and strategy.
Fix: Frame it as an operational and governance failure: custody, administration, audit and independence.
Accepting strong past performance as evidence of safety.
Track record feels like proof.
Fix: Treat very smooth returns with low volatility as a trigger for deeper testing, not comfort.
Recommending more document review as the fix.
It sounds thorough.
Fix: Documents from the manager are not independent. The fix is third-party confirmation of trades, assets and custody.
Blaming only the auditor or only the regulator.
Students look for a single culprit.
Fix: Spread responsibility: the SEC, feeder-fund managers, investors and the small, unknown auditor all failed to challenge.

Worked examples

Example 1

An investor considers a fund with returns that are steady month after month, a strategy described only as proprietary, and an unknown three-person audit firm. The manager also acts as custodian and broker. Which action best reflects the lessons from Madoff?

Show the solution

Identify the red flags: steady returns, opaque strategy, small unknown auditor, and the manager holding custody and trading roles.
Identify the missing control: independence of custody and verification.
Choose the fix: require an independent custodian and administrator, and confirm trades and holdings directly with third parties.
Reject options that rely on past returns or the manager's reputation.

Answer: Require independent custody and administration and verify holdings and trades with third parties before investing, or decline to invest if the manager refuses.

Example 2

A regulator examines an adviser, reviews the records the adviser supplies, finds them consistent, and closes the exam without contacting any counterparty or clearing house. Which Madoff-era failure does this show, and what would have corrected it?

Show the solution

Note the evidence source: only manager-supplied records.
Link to the Madoff case: examiners did not verify trading with independent third parties.
Name the failure: no independent verification.
State the fix: obtain confirmations from the clearing house, custodian and option counterparties, and test them against the adviser's records.

Answer: The failure is lack of independent verification. Examiners should have confirmed trades and assets directly with third parties and reconciled them to the adviser's records.

Exam tips

Expect case-style questions that describe a fund and ask which red flag or control matters most. Match red flag to control.
When two options both sound sensible, prefer the one involving an independent third party.
Remember that the Madoff lessons are mostly operational and governance lessons. Look for custody, administration, audit and separation of duties.
Do not claim the SEC had no warnings. Use wording such as 'warnings were not acted on or properly investigated'.
Treat implausibly smooth returns as a prompt for testing, not as proof of fraud.

Practice questions from Madoff: A Riot of Red Flags

Regulatory Failures and Lessons for Risk Managers: frequently asked questions

What did Markopolos warn the SEC about?

He argued that Madoff's reported returns and options strategy were mathematically implausible and that the numbers pointed to fraud, probably a Ponzi scheme. He submitted his analysis to the SEC several times over about a decade.

Why did the SEC fail to catch Madoff?

The main causes were failure to independently verify trades and assets, limited derivatives expertise, and weak follow-up of tips and examination findings. Madoff's reputation also made examiners less sceptical.

What are the key lessons from Madoff for risk managers?

Verify with independent third parties, be sceptical of returns that look too good, insist on separate custodian, administrator and auditor, and treat operational risk as a core part of due diligence.

What should an operational due diligence checklist include?

It should cover custody, administration, audit quality, governance and independence, valuation procedures, trade confirmation, service-provider relationships, and the manager's controls and background.