Although no one tactic, procedure or product can protect acredit union entirely from internal fraud, experts in the fieldreported credit unions can deploy a set of policies and proceduresthat can make internal fraud riskier and more difficult for theculprit to carry out.

|

“Internal fraud often reflects what we have come to call a fraudtriangle,” ACL Services Ltd. Vice President of Product Dan Zittingexplained.

|

Based in Vancouver, Canada, ACL Services has written softwarethat monitors financial institutions and other corporate computerand financial systems for signs of fraud.

|

Pressure comprises the base of the triangle that Zittingdescribed. This might refer to some sort of financial trouble or anaddiction issue that would cause an otherwise trusted employee toneed money, he explained.

|

The triangle's left side represents the opportunity to commitfraud, he said. Fraud opportunities might arise from a set oftoo-lax internal controls or a failure to implement procedures thatexist on paper but not in day-to-day practice.

|

The triangle's right side, Zitting described, stands forrationalization or motivation. The rationalization part of fraud iswhere the employee – who might be a long-term, highly trusted staffmember – explains his actions to himself.

|

“Rationalization could be anything from, 'I am not stealing themoney because I am going to put it back when I can,' to, 'Theyshouldn't have passed over me for that promotion or treated me sounfairly,'” Zitting said.

|

Countering internal fraud often comes down to the measures acredit union has in place to break up that triangle, if it alreadyexists, or keep it from forming in the first place, he said, addingthat opportunity is usually the easiest side of the triangle toattack first.

Which of these measures has your creditunion taken to reduce internal fraud risk: (Check all thatapply)

Employees that handle money or approve loans musttake at least one uninterrupted week-long vacation everyyear.Rotate employeesbetween branches. Rotate theemployees involved in hiring and setting up new vendors.Periodicallyupdate background checks and/or credit reports on key executivesand board members. Publicizeanti-fraud policies to employees. None of theabove OtherPlease Specify:

PollMaker

 

For example, Zitting endorsed the policy of ensuring theemployees at the credit union who approve loans or handle cash taketwo weeks' vacation each year in one single stretch as ananti-fraud measure.

|

“This is one of the single, best and simplest things creditunions can do to counter some types of internal fraud,” Zittingsaid, explaining that taking the person away from their stationmeans they will not be able to hide ongoing fraud.

|

Another policy he suggests for attacking the opportunity side ofthe triangle is making sure tellers and branch managers rotate frombranch to branch at least once every five years, and in some placesas frequently as every 18 months.

|

Zitting also suggested rotating tellers, branch managers andloan officers who know each other so they consistently do new typesof work together, and to make sure more than one person is involvedwith approving loans or handling cash.

|

Many credit unions understand the wisdom behind having oneperson take a loan application and another approve it, Zittingpointed out, but not as many recognize this principle can apply toother processes as well, such as adding new vendors.

|

“The person who requests to hire a vendor should not be the sameperson who approves that hire or the same person who brings them onboard with a credit union's system,” Zitting said.

|

|

He related the following story that took place when he consultedwith a bank on internal fraud prevention: While assisting the bankwith launching a program that compared the addresses of the bank'svendors with the addresses of its employees, he flagged instanceswhere the addresses were almost the same. Just doing that, he said,had revealed a couple of situations that raised fraud concerns, anda couple of others where the bank had hired an employee or familymember as a consultant, which led to conflict of interest risk.

|

“Every case wasn't fraud,” he said. “But just looking andchecking up about it let everyone know the bank was looking out forfraud.”

|

When it came to the pressure side of the triangle, Zitting saidit would be a good idea for a credit union to routinely redobackground or credit checks on high ranking employees withsensitive jobs every three to five years to confirm that theircircumstances have not significantly changed.

|

“Particularly in the cases of high level people such as chiefinformation officer or CFO,” he said. “It makes since to updatetheir checks from time to time to make sure nothing has happenedthat could make them a bigger fraud risk,” he said.

|

Finally, Zitting said it's completely acceptable for a creditunion to be up front with employees about having these policies inplace and to let them know the credit union has, as part of itsstandard operations, procedures in place for detecting fraud.

|

“Just the knowledge that someone cared and was looking out forfraud provided a key deterrent,” he added.

|

Alma Angotti, managing director for global investigations forthe Chicago-based Navigant Consulting, advised that credit unionsoften didn't need to set up entirely new sets of procedures formonitoring internal fraud, and that many of the rules set up fordetecting money laundering and other types of external fraud can beadapted for internal fraud protection.

|

“It's important to be sure to have someone at the credit unionwho is responsible for looking, and that they know what they arelooking for,” she said.

|

She suggested credit unions routinely look for “outliers” oraccounts that have stopped acting in predictable ways. Likewise,she said to keep an eye out for patterns and ask whether there havebeen a significant number of loan losses stemming from a certainbranch or loans that are tied to a specific appraiser. It might notbe significant, but such a pattern could be a sign of kickbacks orother irregularities, she warned.

|

She agreed with Zitting in that credit unions should be openabout putting a fraud detection office or officer in place, andthat these individuals regularly check data and information.

|

In addition to having policies and procedures in place to makeitself less of a fraud target, credit unions should be aware of therationalization side of the fraud triangle, Greg Mancusi-Ungaro,Chief Marketing Officer for the Toronto, Canada-based firmBrandProtect, argued.

|

“Typically, when employees decide to 'go rogue' and use theirinsider status to take illegal actions to defraud their employer,the situation is triggered by some event: A transfer, a change inresponsibilities, being passed over for a promotion, or losing outon an expected raise or bonus,” Mancusi-Ungara wrote in anemail.

|

“Whatever the cause of the situation, the employees findthemselves under emotional or financial pressure,” he continued.“But, long before such an event occurs – particularly in afinancial institution – HR, IT and security teams should considertheir options to monitoring internal and external online actions,including printer use, network access, building access and externalactivities (public postings on social media sites) to create abehavioral baseline for their employees. Following a triggeringevent, the credit union or bank should watch those same forums forthe telltale changes in behavior, as changes in online behavior areoften indicators of an imminent insider threat.”