Institutional investors typically rely on ratings from at least two companies before they put significant money into a new financial product. Standard & Poor's had previously rated CPDOs with its highest AAA rating, and stood by its evaluation.

Moody's AAA rating provided the critical second rating that spurred investors to begin purchasing CPDOs. But other bond-ratings firms didn't rate CPDO transactions as highly; John Schiavetta, head of global structured credit at Derivative Fitch in New York, was quoted in the Financial Times in April 2007, saying, "We think the first generation of CPDO transactions are overrated."

Among the U.S.-based financial institutions that put together CPDO portfolios, trying to cash in on what, in late 2006, seemed to be a gold rush in investments, were Lehman Brothers, Merrill Lynch, and J.P. Morgan.

When first reported this past May, the Financial Times story described the bug in Moody's rating system as "nothing more than a mathematical typo—a small glitch in a line of computer code." But this glitch may have contributed in some measure to the disastrous financial situation all around us.

It's kind of hard to come up with a snarky one-liner for a foul-up like that.

Testing tip: When testing something as critical as this, run commonsense trials: Throw variations of data at the formula, and make sure you get the expected result each time. You also have to audit your code periodically with an outside firm, to ensure that a vested insider hasn't "accidentally" inserted a mathematical error that nets the insider millions. There's no indication that such an inside job happened in this case, but such a scenario isn't so far-fetched that it's beyond the realm of possibility.

Sorry, Mr. Smith, you have cancer. Oh, you're not Mr. Smith?

Testing oversight: Mismatched contact information in insurer's customer database
Consequence: Blue Cross/Blue Shield sends 202,000 printed letters containing patient information and Social Security numbers to the wrong patients.

Of course, it sounded like a good idea at the time: Georgia's largest health insurance company, with 3.1 million members, designed a system that would send patients information about how each visit was covered by their insurance.

The EOB (explanation of benefits) letters would provide sensitive patient information, including payment and coverage details, as well as the name of the doctor or medical facility visited and the patient's insurance ID number.

Most insurance companies send out EOBs after people receive medical treatment or visit a doctor, but the Georgia Blue Cross/Blue Shield system so muddled up its medical data management functionality that its members were sent other members' sensitive patient information.