There are a few keys to creating a well-designed system of internal control:

The system must be documented. Documenting your internal control system includes identifying the key controls you intend to rely on in each area of the credit union, so you can test them and ensure they are in place, effective and operating as expected.
Responsibility for the system of internal control has to rest with the CEO. The buck stops at the CEO's desk.
Your board must hold the CEO accountable for the design, implementation and maintenance of the system of internal control.
The CEO can and should assign the day to day work of internal control to an internal auditor(s) (either on staff or outsourced). Smaller credit unions will need to rely on help from their bond carrier or CPA to do the work that an internal auditor does for a larger credit union.
An active supervisory committee is critical (or if there is no supervisory committee, an active board audit committee). The supervisory committee must conduct an annual audit with a well-qualified CPA firm. It should also make sure that all audit findings are addressed by the board and CEO (this includes any findings from external consultants, insurance providers, examiners and internal auditors). No audit finding should be closed without the agreement of the supervisory committee and the board. Unresolved audit findings should be documented and assigned to a member of staff with a deadline for completion. The supervisory committee should verify that the system of internal control is in place, operating and effective (and documented).
You must have a data processing system that is well documented and reviewed annually for SAS 70 security risks. Most of a credit union's transactions are completed through the data processing – it must record an audit trail, and all controls within the system must be documented and annually assessed.
A working and effective vendor management program is essential. Credit unions rely on vendors to provide many of their services; vendors' work can have an impact on their internal controls, and affect member balances or the credit union's safety and soundness.

I was a credit union CEO for 32 years, a credit union CFO for five years, a CPA, a member of the CUMIS Risk Management Committee, a member of the California Department of Corporations Credit Union Advisory Committee and the volunteer chairman of a supervisory committee. Just as it takes a village to raise a child, it takes a coordinated and cooperative effort among a credit union's key players – the CEO, CFO, board, supervisory committee, CPA, bond insurer and examiner – to prevent fraud (and errors). Here are some examples of what I learned in 37 years of credit union service and three years as a CPA to a number of credit unions:

Instant Insights /

Internal Control Benefits Go Beyond Fraud Detection

Related Stories

Recommended For You