Articles on fraud prevention have been on my mind for awhile. Every time a mention of another credit union fraud ispublished or a national study on fraud is released, it raises theissue again. Over the past few years, the expansion of thephilosophy of the need for risk assessments as an analytical toolcontinues to increase, especially for financial institutions.Annual risk assessments are now required for Bank Secrecy Act andAutomated Clearing House procedures. The NCUA's examinationprocedures require time for analyzing and assessing transactionrisk, credit risk, interest rate risk, compliance risk andreputation risk. Then within smaller breakout areas, such asinvestments and lending, you have diversification, pricing,default, liquidity and Asset Liability Management matching risks,and risk-based lending and concentration risk to name a few. Withall the risk analysis being performed, why not a strong analysis offraud risk?

In discussions with directors of the Office of Small CreditUnion Initiatives at the NCUA, it has been stated that one of theleading causes of liquidation of small credit unions is fraud.Current NCUA Board Member Mark McWatters earlier this year hasstated that agency data showed approximately 58% of share insurancefraud losses over the past five years were attributable to fraud.NCUA CFO Mary Ann Woodson indicated that for 2014, this figure was94%. Michael E. Fryzel, former NCUA chairman, has questioned whymore is not being done in this area. The NCUA has added proceduresfor fraud into the examination scope for small credit unions, whichmay help if the red flags identified are properly investigated andor addressed.

In the most recent 2014 Association of Certified Fraud Examinersannual “Report to the Nation on Occupational Fraud and Abuse,”losses due to fraud for all businesses were estimated to be 5% ofgross revenue. Carried to the bottom line, this would cause mostcredit unions to operate at a loss. Financial institutions onceagain lead the way with the highest number of cases. This could besomewhat skewed because of the regulatory requirements to fileSuspicious Activity Reports that other industries do not haveregulations for. The number of SARs filed on employees of creditunions continues to increase at alarming rates.

Some may argue that these observations appear to be a smallcredit union problem, because, one, they do not have the human andtechnical resources or quality of personnel to establish effectiveinternal controls; two, are more susceptible to management overridedue to a lack of adequate segregation of duties and or controls;three, do not have an internal audit function and use lessqualified individuals to perform audits or agreed-upon procedureexams; and four, do not have board of directors and supervisorycommittee members who recognize the potential higher risk of fraudin their credit union. We can argue what the asset cut-off size asmall credit union should be, but for the purpose of this articlewe will use the new NCUA figure of $100 million.

To provide a frame of reference, an analysis was prepared on allthe articles on embezzlement and fraud that have been published inCU Times over the past 15 months. To this figure, bondclaims that I have filed for credit unions that never made thepress or are currently being handled by the FBI were added. Thesorting and analysis of this information has provided somesurprising, but not necessarily unexpected results. This selectionprocess provided a total of 63 credit unions; 16 were more than$100 million in assets and 47 were under. The total losses wereestimated to be $181.7 million, ranging from a low of $25,000 to$25.3 million, with 22, or more than one-third, exceeding $1million. The breakout for small credit unions was $143.8 millionfor an average of $3.1 million, and $37.9 million for large creditunions with the average being $2.4 million. The average length oftime that the embezzlement took place before being discovered, was5.75 years for small credit unions and 4.50 years for large creditunions. You would think that in the small credit unions, thatlength of time for the fraud to be ongoing would be higher but theloss amount would be lower. These averages were somewhat similar.However, the most telling result was that for the larger creditunions, zero were merged or liquidated. For 21 or 45% of thesmaller credit unions, the fraud resulted in the elimination of thecredit union through either liquidation or a merger. While theimpact for a smaller credit union is more devastating, this is notjust a small credit union problem. It also points out that if redflags are identified, they are being ignored.

Even if the NCUA should not require credit unions to performthis assessment, it would be hard for a supervisory committee tojustify not including this review as part of their internal auditprocedures, or at a minimum as a topic added for discussion at acommittee meeting. The committee could have a brainstorming sessionto identify fraud risks. If an internal audit function is in place,it might pose the following questions:

1. What fraud risks are being monitored by the internal auditteam? How were these risks determined? What is the policy for thecontinuous auditing of these credit/lending and fraud risks?

2. What specific procedures does the internal audit perform toaddress management override of internal controls? Does this includelooking at internal security policies to look at separation ofduties, access controls and authorization controls?

3. Has anything occurred that would lead internal audit tochange its assessment of the risk of management override ofinternal controls?

4. Is anything done for additional monitoring when an employeeappears to be living beyond their means, exhibits financialdifficulties, or does not take appropriate vacations?

5. Is appropriate screening of staff occurring prior to behired? Are insurance bond ability checks and fingerprinting takingplace?

The committee could look into the three elements of the fraudtriangle: Incentives/pressure to commit fraud, opportunities andattitudes/rationalizations, and determine where their credit unionstands.

Fraud triangle checklists are available, which can be tailoredto the credit union industry to consider: Incentives or pressureson management within their job, opportunities that staff and ormanagement can exploit, and attitudes or rationalizations exhibitedby management.

For more on the fraud triangle, see this short video. Pages 7-5 of the NCUA Examiners Guide alsohas a list of fraud red flags as they relate to management, whichcan be reviewed as another aide. Examiners also have a short redflags checklist.

Checklists are also available from the Federal FinancialInstitutions Examination Council, Association of Certified FraudExaminers and American College of Forensic Examiners Institute.While none of these checklists are banking or credit union specificor directly related to a fraud risk assessment, they could beadapted with the assistance of a forensic specialist.

One process or procedure will not fit all credit unions, as theinternal control system and overall credit union philosophy willdiffer. A member of the supervisory committee or an outsideprofessional versed in these procedures would be recommended forthe initial assessment. Fraud prevention is an ongoing, dynamicprogress that will require continuous evaluation and improvement.If you do not proactively identify and manage your fraud risks,would your credit union be able to absorb the fallout? Ifmanagement does not agree or does not see the need for a fraud riskassessment, does this not by itself raise a red flag?

David Legge is president/CEO at Legge Group. He can bereached at 703-257-1364 or [email protected].Check out part two of his series on internal fraud, “Tools forPreventing Internal Fraud,” in the July 29, 2015 issue of CUTimes.