Writing a Risk Policy

Four kinds of limit, and what each is for

A policy is short, and it is easier to write if the limits are separated by what they constrain. The **per-trade limit** is the fraction of capital put at risk on one idea — 1%, or 0.5% for a beginner or a volatile strategy. This is the limit that does the most work in the whole curriculum, because it is the one that makes the streaks in R7 survivable and it is computed before entry from the stop distance, never chosen afterwards to fit a position you already want. **Size is not a preference; it is the output of the stop and the budget** (R5). The **heat limit** constrains the book rather than the trade: the sum of all open risk may not exceed some fraction of capital, commonly 6%, which together with a 1% per-trade rule implies a ceiling of about six positions. It exists because individual trades that are each correctly sized can still add up to one large bet, and the failure mode of a book is usually the sum rather than the largest term (R11). The **concentration limit** is a subset of the same idea, applied to correlated positions: no cluster of names driven by the same force may risk more than 2.5% of capital, so that eight energy names do not behave like one eight-times-sized position (R10). The **drawdown trigger** is the limit people leave out, and it is the one that changes behaviour. It says what happens when the strategy is losing: halve the risk per trade at a 10% drawdown, stop and review at 20%. Writing it as a rule rather than a decision is the entire point, because a person in a drawdown is a person with an open position, a recent loss and something to prove, and the natural response — increase size to win it back — is the one that turns a losing month into a lost account (R2). The trigger de-risks into the losses, which feels exactly wrong and is deliberate. The four limits on a $200,000 account — Per trade: 1% of capital = $2,000 of risk · Heat: 6% of capital = $12,000 of risk across the book · Concentration: no cluster above 2.5% = $5,000 of related risk ← · Drawdown trigger: halve risk at a 10% fall; stop and review at 20% Write the trigger in both directions. A policy that only ever tightens is a one-way ratchet, and a household that never resumes full risk after a recovery has quietly adopted a smaller strategy than the one it tested.

Why the rules are written down, and what happens when they are not

The case for a written policy is not that rules are more accurate than judgement — it is that **a rule is made by a different person**. The version of you who writes the policy is calm, has just finished the arithmetic, and is looking at a drawdown as a distribution rather than as a wound. The version of you who decides during a 20% drawdown is frightened, is holding positions, and has a strong incentive to interpret the evidence as encouraging. Research on self-control treats this as a commitment problem rather than a knowledge problem, and the solution is to bind the future self while the information and the temperament are better — which is exactly what the numbers do. What goes wrong without it is predictable enough to be worth naming. Sizing drifts upward after a winning streak, because the losing trade is not imagined. A stop moves "just this once" when a position approaches it. The heat cap is discovered to be exceeded only after the fact, when six correlated names have each been judged on their own merits. And size is increased into a drawdown, which is the one response with a majority of the votes and the worst distribution of outcomes. Every one of these is a decision made in the moment by someone who has already been told how it ends, and every one of them is prevented by a sentence written in advance. Two properties make a policy workable rather than decorative. It must be **mechanical**, so that the trigger is a number rather than a mood — a 10% drawdown is a fact, whereas "when it feels bad" is not checkable. And it must be **complete**, so that every level has an answer, including the level beyond the worst one you have experienced: what happens at a 30% drawdown matters more than what happens at 10%, because that is where policies have usually run out. The policy is a short document, it is reviewed on a schedule rather than after a loss, and its value shows up only in the situations where judgement is least reliable. What a policy turns into a number — Risk per trade: a fraction of capital, computed from the stop · Total heat: the sum of open risk, checked before entry · Correlated cluster: related names added together, not each one alone · Drawdown response: halve at 10%, stop and review at 20%, resume on recovery ← A policy reviewed during a drawdown is not a policy. Fix the review date when you write it, and treat any mid-drawdown change as needing a second look the following week rather than an immediate edit.

A policy needs a change process

A written policy is a commitment, and commitments are tested at exactly the moment they are hardest to keep: inside a drawdown. The danger is not the policy’s content but its revision — loosening a limit after a loss converts the limit into a suggestion, and doing it once makes the next time easier. The countermeasure is to decide in advance *when* the policy can change and *how*: a scheduled review, on a fixed cadence, using the record rather than the current mood, with changes written down and dated like the original. The failure modes run in both directions. A policy that is too tight — a daily loss limit small enough to be hit by ordinary noise — produces constant interventions that get overridden, and an overridden policy is worse than none because it teaches the trader that the rules are optional. A policy that is too loose is not a policy. Calibration is empirical: if the daily limit has been breached on most days, it is measuring noise, not risk; if it has never been breached, it is not doing any work. Two metrics tell you whether the policy is functioning. **Adherence** — the share of decisions that followed the rule, which should be near total and is the only part fully under your control. And the **gap between the worst drawdown the policy allowed and the worst that occurred**, which tells you whether the limits were sized for reality. A policy that is followed and sized to the actual distribution of losses is doing its job; one that is either ignored or never invoked is a document, not a limit. Revising a policy while a loss is open is not review, it is negotiation. If the change cannot wait for the scheduled date, note it and wait anyway.

Making the policy enforceable: the check, the breach protocol and the change log

A policy that is not checked is a document, and the reason it goes unchecked is that checking is work. The design principle that fixes this is to make each limit **computable from records you already keep**. The per-trade limit is computable at entry from the stop distance, so it belongs in the order ticket rather than in a review. Heat is a sum of current stop distances, so it needs a position list with live stops rather than a spreadsheet updated weekly. The drawdown trigger needs the equity curve against a stated high-water mark, which the broker reports. And the concentration cap needs the current market values, which the broker also reports. Every one of those is available from an account statement plus a position list, which means the check can be a five-minute task rather than an audit — and if a limit cannot be computed that way, the limit is probably too vague to be useful and should be rewritten until it can be. The **breach protocol** is the part a policy usually omits, and its absence is what turns a breach into an improvisation. Three things have to be written down before the first breach. What counts as a breach — is exceeding the heat cap by two percent a breach, or is there a tolerance band, and is the band measured at the close or intraday. What the action is — trimming to the cap by the next session, halting new entries until the level is back inside, or nothing but a written note, and the action has to be something mechanical enough to perform under stress. And who checks — a second person, a scheduled date, or an automated alert, because the only reader of a policy during a drawdown is the person who most wants it to say something else. The convention worth borrowing from risk desks is that a breach recorded and explained is not a failure; a breach absorbed silently is, because the next one will be larger and the policy will by then have been renegotiated by events. The last element is the **change log**, which sounds bureaucratic and is the specific defence against the failure this whole subject keeps naming. Policies drift, and drift is invisible because each amendment is locally reasonable: this one setup deserves a larger size; the heat cap was set before the volatility regime changed; the drawdown trigger has not fired in a year, so perhaps it is too tight. Recorded as a dated line — what changed, when, and what evidence justified it — the pattern becomes visible, and the pattern is the diagnosis. Three increases in the risk fraction within one quarter is a fact that a single amended sentence is not. The rule that makes the log useful is a simple one: no change during a drawdown, and no change without a full review cycle, so that adjustments happen on a schedule written in advance rather than in the week they are most desired. That converts the policy from a description of intent into a mechanism with an audit trail, which is the difference between a document a person wrote once and a constraint a person actually runs. • Every limit should be computable from a statement and a position list — otherwise it will not be checked. • Write the breach definition, the tolerance band and the action before the first breach. • Name who checks, because the only reader during a drawdown is the person most motivated to reinterpret it. • Keep a change log: what changed, when, and the evidence — the pattern of amendments is the finding. • No changes during a drawdown, and none outside a scheduled review. The link to the psychology half of the curriculum is the reason this read exists at all: the rules are not there because the trader lacks knowledge, they are there because the states in which the rules matter are the states in which judgement is least reliable. A policy with a check, a protocol and a log is the version of that insight that survives contact with a bad month.

Sources

• Pre-commitment and rules that bind a future selfThaler & Shefrin, "An Economic Theory of Self-Control" (1981)
• Risk limits, drawdown triggers and de-risking in practiceProfessional risk-policy templates and Managed Futures drawdown controls
• Written rules as a defence against in-the-moment biasKahneman, "Thinking, Fast and Slow" (2011)
• Position sizing as the primary risk controlVan Tharp, "Trade Your Way to Financial Freedom"