The timing of a collaboration between two of the industry'swell-known entities to fight employee dishonesty could not havecome soon enough.

The NCUA and CUNA Mutual Group recently announced that they willinclude fraud mitigation sessions for a series of workshops andround tables the regulator will host this year. Among the hotbutton topics credit unions, particularly the smaller ones, willlearn more about are fraudulent deposits and wire transfers andemployee dishonesty.

The announcement also comes a month after William Liddle, a former lending officer at the $231 millionAEA Federal Credit Union, was found guilty of nearly 60 countsof fraud for his role in a $1 million business loan kickbackscheme. Liddle worked at the Yuma, Ariz.-based credit union forfive years, but it was only after he left the financial institutionin 2009 that his transgressions were discovered. 

Liddle's fraudulent activity, along with other loan portfoliotroubles, led to AEA being placed in conservatorship by theNCUA.

It's difficult to track a hard figure, but the millions ofdollars credit unions lose each year to employee dishonesty andfraud and the subsequent hits to the NCUA's NCUSIF remain a growingconcern. Experts continue to push for stronger internal controlsand a clearer segregation of duties.

Brad Mundine, senior manager of risk management services at CUNAMutual Group, is among those who urge credit unions to continue tobe vigilant and proactive. 

“First and foremost, it really comes down to internal controlsat the operational level,” Mundine said. “All of these cases haveone thing in common–opportunity. Any time you have only one personin control over everything it provides an opportunity.”

Mundine applauds those credit unions that have effectiveprocedures and policies in place. However, the oversight gaps tendto occur at different levels of operation, and this is where someare not receiving the assistance they should. 

The red flags that fly over internal controls run the gamut, butthere are a few that are common and may be easier to spot. Withloan approvals, an increase in fictitious or unauthorized loansresults when loan approval and disbursement are handled by the sameemployee. To minimize exposure, credit unions should separate loanapproval and disbursement duties.

Mundine is a proponent of segregation of duties. Mosttransactions can be broken down into the origination, posting and audit, according to a CUNA Mutual white paper on riskmanagement. One employee should not have complete control over theentire transaction.

A regular review of data processing and nonfinancial reports canhelp discover any discrepancies. Mundine recommends these checks bedone on a monthly basis. Changes in an interest rate or a paymentdue date most likely will need some scrutiny, he added. A due dateadvancement, in most cases, such as when credit unions implement askip a payment campaign around the holidays, is legitimate. Ifthere isn't adequate documentation to support why the advancementis in place, Mundine said a review is certainly inorder. 

“From an internal controls standpoint, a credit union should ask'can my internal controls be circumvented?'” Mundine said. “If so,you need to ask why.”

In the AEA case, it appears that Liddle had most of theoversight of the business lending division. To prevent thatexclusive power, a rotation of duties has both internal control andcross-training benefits, according to CUNA Mutual. 

A compulsory one-week vacation forces individuals to relinquishtheir duties to someone else at which time irregularities orunauthorized manipulations may surface, CUNA Mutual said. Alongwith detection, the compulsory vacation acts as a deterrent.

At the $5 billion Suncoast Schools Federal Credit Union inTampa, Fla., there are several layers of authority  thatexist in divisions such as business lending, said Jim Simon, seniorvice president, loss and risk mitigation and vice president ofmember business lending. 

Any loan above $250,000 goes before a business loan committeethat includes Simon, the chief financial officer, a senior vicepresident and several others, Simon explained. “If loans go bad,it's going to be a challenge to get the collateral,” Simon said.“An outside loan review group can go over the documentation,including how the loan is underwritten.”

That outside pair of eyes can go far especially for smallercredit unions that may not have the resources to be as diligent asthey would like. In the end, regardless of size, credit unions mayhave a shared instinct when it comes to fraud detection.

“Even in smaller organizations, there is a commonality inlending–there's a gut thing,” Simon said. “The nice thing aboutloan committees is there are several channels that are reviewingloans.”

At the very least, an annual audit with a verification of factscan help ensure that a loan portfolio is receiving an unbiasedreview, said Guy Messick, an attorney with Messick & LauerP.C., who has worked extensively with credit unions and CUSOs onmatters involving loan participation agreements, business lending,governance issues and privacy law compliance.

“This way, you don't have anyone [in the organization] lookingover your shoulder,” Messick said of an outside review. “You runthe risk of employees hiding things, and by then it's toolate.”

When credit unions enter into business lending, Messick saidsome set up their divisions as one-person shops, which puts muchfaith in one person. There must be different roles assigned todifferent people to oversee areas such as credit analysis,underwriting and approval recommendations. 

Messick acknowledged that some business development officers whoare wearing several hats may cut corners but not out of ill will.In those cases, it's more proof that an outside audit is the way togo. As general counsel to NACUSO, he, of course, is an advocate ofcollaborating with CUSOs to fill any voids credit unions may haveto ensure due diligence within their lendingoperations. 

“You want that relationship with the borrower but you don't wantthat relationship to cause you to make a poor lending decision,”Messick said.

With all of its benefits of speed and accessibility, technologycan still be another outlet to commit fraud.  According toCUNA Mutual, data processing facilities easily accessible tounauthorized persons create more internal control problems. Tothwart those potential invasions, buffer zones, which are thoseareas around data processing facilities restricted to authorizedemployees, provide an effective enhancement to a credit union'saccess control efforts. 

The beauty with technology is there is an inherent deterrent todishonesty when a reliable and visible audit trail can be tracedback to individual operators, CUNA Mutual said. Still, creditunions should know that the dangers can also come from anotherdirection.

“In this day and age of high technology, some credit unions arenot grasping the severity of the bad things that can be done bysmart crooks,” said Bob Schumacher, senior consultant with TheParagon Consulting Group, a Portland, Ore.-based strategic planningfirm. “Taking enterprise risk management to heart and implementingthese policies and procedures will [keep] bad things from happeningin a big way.”

Credit unions are going to need more dual control systems in allareas of operations, especially lending, to be as diligent aspossible, Schumacher said. What was once an onerous task forlending and other areas is now necessary to prevent bad guys fromsucceeding, he added.

Schumacher said another red flag is a lack of security systemsin all the right places. Being able to see what is happening withinthe walls of each office is paramount, he offered. As other expertshave said, he also encourages credit unions to engage in morethird-party auditing activities than those that are currentlyrequired.

“It may sound old school, but we need to stay in tune with allemployees to see if behaviors, personal situations or other redflags are being waved. Tough economic times can create all kinds ofincentives for unwanted behavior,” Schumacher said.