Although the NCUA recently announced it is developing new examprocedures to improve the identification of fraud risk indicators,especially at small institutions, experts agree that fighting fraudrequires a team effort that includes active boards, strongsupervisory committees and stiff internal controls.

“Weak internal controls provide a breeding ground forsubstantial losses or even failure,” C. Keith Morton, NCUA RegionIV director, wrote in an article for Cornerstone Credit UnionLeague earlier this year. “Record-keeping problems, out-of-balanceconditions, overdue audits or member account verifications, andmanipulated records create a dangerous environment for fraud totake root and go undiscovered. It may be only one person whocommits the fraud, but lax management oversight, along with afailure of the supervisory committee to perform its vitalfunctions, may allow this individual to embezzle for months, if notyears.”

In its Supervisory Committee Guide, the NCUA cautions creditunions to remain alert for common risk factors such as a lack ofboard approved policies for areas such as lending, investing,borrowing, and operating expenses; lack of segregation of duties;lack of mandatory vacation policy; failure to maintain adequateaudit trails; incomplete or inadequate audits or verifications;inactive supervisory committees; repeated record keeping problems;and manipulated bank reconcilements.

CUNA Mutual Groups and the NCUA's Office of Small Credit UnionInitiatives gave Credit Union Times a preview of itsupcoming webinar entitled Deterring Employee Fraud. The webinarwill take place at 2 p.m. EST on Nov. 14.

“There are many steps that credit unions can take to help deterand detect fraud,” said Joette Colletts, senior manager of riskmanagement for CUNA Mutual. For example, Colletts said, creditunions need to implement a fraud policy, board members need to askmore questions, and supervisory committees need to conduct surpriseaudits.

Colletts said another important fraud prevention task is tocomplete cash counts in the appropriate way.

All cash items should be included, she said, noting that allcash counts don't have to be done in one day. Teller funds,travelers' checks and ATMs counts could be conducted on separatedays. Credit union management should also count cash in thepresence of the employee responsible for maintain the funds in theevent of a shortage. Cash bundles should also be broken down andcash totals should be verified with the general ledger.

“It's important to break down the bundles because there havebeen cases where someone has replaced $100 bills in the center of abundle with $1 bills,” Colletts said.

The NCUA also encourages supervisory committees to reviewemployee and director accounts as well as related family memberaccounts, bank statements and reconciliations. Employees should notbe performing transactions on their own or family member accounts,the NCUA said.

It's also important to keep an eye on dormant and closedaccounts, which are frequently used to perform unauthorizedtransactions, the NCUA said.

In many prior cases involving CEO fraud, the credit union'sperformance has often been poor for many years before the fraudoccurred, according to Tom Glatt Jr., a credit union consultant inWilmington, N.C., who wrote an article earlier this year on“Foolingthe Board: The Embezzlement Bonanza.”

“Boards should not accept consistently poor performance,” Glattsaid. “Board members need to develop proficiency in governing toinclude fully understanding the quality and scale of financialresults.”

Glatt said two simple steps could have helped boards minimizelosses in previous CEO fraud cases.

“First, asking detailed, informed, well-researched questionsabout performance would have perhaps deterred the fraud in thefirst place. When someone is looking over your shoulder you tend tocheat less,” he said. “Second, by asking the right questions, theywould have become disappointed with the performance they werereceiving versus what should have been. This would have led toleadership change and minimization of the impact of the frauditself—simply because it would not have gone on for so long.”

Most experts agree that the war on dishonesty needs to start atthe top.

“With strong leadership and training, credit unions can createan internal culture that deters dishonest acts, detects those thatdo occur, and follows a disciplined investigation and correctionprocess,” said Mike Mossel, a managing director at the consultingfirm McGladrey.

Experts interviewed agreed a credit union board should draft aformal fraud policy, with the assistance of legal counsel, and thepolicy should be updated annually and signed by all employees.

“The deterrent effect upon an employee, who is made aware of thepolicy on the first day of employment and periodically remindedthat such a policy exists, cannot be underestimated,” the NCUAsaid.

Effective fraud policies should address specific items,establish guidelines for investigations and explain consequences,because credit unions can risk litigation if proper procedures arenot followed during fraud investigations, the NCUA said.

In recent cases, small credit unions were looted by managers whowere sole employees.

“The most important internal fraud prevention policy isseparation of duties,” said Christopher Marquet, founder of MarquetInternational Ltd., a Wellesley, Mass., investigative, litigationsupport and due diligence firm that publishes an annual report on embezzlement.

“If a single individual has control over both authorization andexecution of funds transfers, for example, you have a recipe forfraud to occur,” he said. “Conducting regular audits of differentdepartments and functions at random intervals is a strongpreventive and detection policy.”

Other tips include watching for “red flags” among employeesinclude attitude changes, not taking vacations, keeping records indisarray and lifestyle changes such as excessive spending orborrowing.