Your Policies Are Complete — So Why Is Hedging Still Not Working?

If your policies are mature — clean processes, complete reports, internal audit every year, and hedging that has been running all along — yet margin volatility has not narrowed, exposure still cannot be stated, and when something goes wrong you still cannot find the cause, this article is written for you.

This is not unusual. It has a name: the maturity mismatch. A complete policy and a working mechanism are two different things.

The first is achieved by writing documents, and you have almost certainly achieved it. The second only happens when things run inside the real business. Most companies stall in the seam between them: everything is in place, but nothing is running.

Why a complete policy still produces no result

Start from a structural fact. Your resources and capabilities sit on paper: policy, internal controls, approval chains, delegated limits, monitoring dashboards, annual audit — all of it is there.

But the three things that actually determine the outcome are not on paper:

• Does exposure actually move through the business — once a contract is signed, can you compute the exposure?
• Do positions line up with exposure — can each futures fill be traced back to the contract it hedges?
• Does the person who got it right get recognised — in a quarter where hedging worked, does your KPI show it?

If any one of these three does not happen, the effort in the first three layers never reaches the result. Policy answers "is there a rule". Mechanism answers "does the rule get executed".

Where you lose points matters more than the total

A maturity assessment usually scores five dimensions. For a company like yours, the total score carries little information — the position of the lost points carries almost all of it.

The most common pattern is high scores on paper, low scores in practice. Concretely: policy completeness, internal control and audit score well, while delegated limits, tool mix and monitoring score poorly.

That combination says something precise: the policy is well written but never runs inside the real business. The capability is there on paper and missing in operation.

So the questions have to change. Not "do you have an exposure limit" but "how many trades actually triggered the limit last month, and what was the handling rate?" Not "do you produce a daily exposure report" but "is yesterday's number net exposure or futures position, and how far is it from the finance figure?"

There is one more signal worth watching: the blank field. In an assessment report there are always fields you cannot fill in — "enter your revenue and cost structure; your exposure will be calculated here". If that box comes back empty, it means the concept does not yet exist in your management language.

That is not an oversight. It is the most valuable signal in the whole exercise: a concept nobody can articulate is precisely where the room to improve is. Because improving there requires no demolition — only making one vague idea precise.

Six patterns, side by side

The table below is designed to be checked against your own company. The left column is what you may recognise, the middle two are the common misreading and the reality, and the right column is the first question behind each pattern.

Pattern 1: A sensible limit that gets used twice a month

The policy says "exposure above 5 million needs risk approval". If nothing triggered it last month, there are two possibilities: either exposure rarely reaches that level (so the limit is decorative, because the real risk sits elsewhere), or the limit is set too high (so it cannot stop anything).

Either way, that rule is not managing risk. It is only written down.

Pattern 2: A hedge ratio nobody can trace back to an exposure

"Our hedge ratio is 70%." That statement carries no information on its own. The follow-up question is what matters: which exposure was that 70% computed from?

If the answer is "industry practice" or "set by management", then the number has no relationship to the risk you actually carry. It saves you when prices rise and creates a mismatch when they fall — not because 70% is a wrong number, but because it has never been recomputed.

Pattern 3: Internal audit checks compliance, not effectiveness

This is a common and easily missed gap. Internal audit checks whether approvals happened and whether limits were breached. It rarely checks whether the hedging reduced risk.

The result is a high compliance score and an actual risk outcome that has never been tested. Hedge P&L stays in a state of "nobody can explain it": when it earns, it feels like luck; when it loses, it feels like hedging does not work.

Pattern 4: The dashboard shows positions, not exposure

Many companies now run a genuinely modern monitoring screen — futures positions, margin balances, price moves, all in one view. But all of it is futures-side data.

What hedging actually needs to answer is net exposure: the goods you hold, plus signed contracts not yet executed, plus pricing requests in flight, minus existing positions. Most dashboards have no such number, because it requires joining futures data to the contract ledger — and those two usually live apart.

Pattern 5: A dedicated role without the authority to act

There is a risk role, with headcount, and its mandate is in the documents. But if that role has no real influence on business decisions, its working life is producing reports and ticking compliance boxes.

The test is simple: ask whether the role can veto a trade. If the answer is "no, but it raises comments", the role is hollow in practice.

Pattern 6: Hedging is in the KPI set, but the KPI measures P&L

The state to watch is when hedge P&L is folded straight into the business unit's current-period assessment.

On that basis hedging is structurally a negative: it produces mark-to-market losses, and a mark-to-market loss does not distinguish "risk correctly hedged" from "call wrong". A rational business unit will hedge less, or not at all.

The mature approach is to show hedge contribution on its own line: what the hedge saved on one side, what it cost in foregone upside on the other. Only then does hedging stop being a drag on the period number and start being a business action that can be credited.

Three things worth doing for a company like yours

Since the first two layers are already in place, improvement does not have to start with writing more policy. We would focus on three things you have probably not done before — all verification, not construction:

1. Take a historical window (6 to 12 months) and rebuild the net exposure series, then set it against actual margin volatility and answer "if exposure had been zero, what would volatility have looked like?". Many companies change their view on first seeing this, because the real amplitude is usually larger than the impression.
2. Attribute three to five existing hedges trade by trade, splitting the result into direction, basis and execution. Companies that have hedged for years and still cannot say where the P&L came from have almost never run this split.
3. Run one stress scenario: on current positions, assume the price moves 10% or 15% the wrong way, and see which week the margin peak lands in and whether cash flow can carry it. This is the one that convinces management, because it turns risk into a specific date and a specific number.

All three share one property: none of them asks you to admit you are missing something. They only ask what the actual result was.

Why this is worth doing

Worth being clear: the higher your maturity, the more the room for improvement sits in detail rather than in framework. That also means progress tends to be slower than at a company starting from zero.

But the return structure is entirely different. A company starting from zero must first build the policy and then make it run. You only need to make what you already have run. The trust, the processes and the people built over the first two layers are assets already in place — once the remaining part runs, stability and volatility resistance are markedly better than at a newly built system.

That is why we usually suggest a path of "verify first, pilot locally, then roll out": use the smallest possible action to test the assumption that matters most.

Four questions you can answer today

1. How many trades actually triggered an exposure limit last month, and what was the handling rate?
2. Your hedge ratio — which exposure, at what point in time, and how often is it recomputed?
3. On yesterday's exposure report, is the number net exposure or futures position, and how far does it differ from the finance figure?
4. Have the last twelve months of hedge P&L been split into direction, basis and execution?

If you cannot answer three of these four, you can be fairly confident about the diagnosis: what you are missing is not policy, it is mechanism.

And that has one useful piece of good news attached — it does not require starting over. Start by establishing the actual result, then strengthen only the few links that are genuinely live.

Sources and notes

The five maturity dimensions used here (exposure identification, policy and governance, tools and strategy, execution and monitoring, organisation and capability), the method for reading a high paper score against a low practical score, and the identification of gaps in delegated limits and tool mix come from RMC's own diagnostic framework and project observations, with maturity read-outs for mature clients validated across multiple live engagements. No specific client names or data are used, and every self-check question here can be verified by the company itself. Nothing in this article constitutes an endorsement or evaluation of any specific software product.