MADISON, Wisc. – After a couple decades investigating fraud, Joette Colletts has pretty much been there, seen that. Colletts, senior risk management specialist with CUNA Mutual Group, has learned even longtime, trusted credit union employees may commit fraud. She can readily cite examples. In one case, a 20-year employee ranking in upper management received a travel advance to attend a conference at a ski resort. She traveled to the resort with her family, but didn't attend the conference. What really struck Colletts was the woman requested a refund for the conference from the sponsoring organization. Would they please send the reimbursement to her at her home address? It turned out this same individual was charging personal expenses on her corporate credit card. Nobody was reviewing those bills. When Colletts reported her findings to the credit union, the board and top management at first were upset with Colletts. Then, when they saw the documentation, they immediately fired the employee. That doesn't always happen. Colletts has learned another scenario can evolve when internal fraud is uncovered. The credit union makes excuses for the employee – he won't do it again, he'll pay it back, this is the first time in his 25 years anything like this has happened. "The problem with that is, if you keep this person what kind of a message are you sending to the other employees or to the employee himself?," Colletts asks. "In the future, if you find another employee doing something dishonest and terminate that person, is there preferential treatment or discrimination?" A situation at another credit union involved creation of fictitious loans. A loan officer, also a longtime employee, was taking out loans in the names of his minor children. This employee had the ability to take an application for a loan, approve the loan, disperse the loan and put the loan on the system. There was no separation of duties. That provided opportunity. In this case a gambling habit created the motive. "The board was shocked. It was so hard for them to believe. But the documentation spoke for itself. They were still reluctant to do anything immediately. They needed time to really absorb the information and talk among themselves," Colletts recalls. " Sometimes they're waiting for our bondability department to review the documentation and get back to them. If the employee isn't bondable, they would have to deal with NCUA." Still a third situation, encountered at several credit unions, involved credit card clerks who set up fictitious credit cards or increased their own or family members limits. This can occur if the person is a loan officer who can approve a new credit card, enter the card into the system, and perhaps also perform maintenance transactions such as increasing the limit. There are audit reports available, Colletts notes, but sometimes that same person is responsible for reviewing those reports. All three cases, she adds, exhibited a lack of internal controls. " There's a recipe for fraud. Need, or perceived need, is the first ingredient. The person has a need whether it's drugs, gambling, excessive spending habits, or the financial impact of a divorce. The second thing is opportunity, created by poor internal controls, weak audit procedures, the wrong person reviewing reports. "The third ingredient is rationalization. A lot of times it's, `I need it and I'll pay it back.' Sometimes it escalates so they can't pay it back. They feel they should have gotten a raise and didn't. If they're getting away with it, unfortunately the rationalization seems to make sense to them. An employee might see another employee overdrafting their checking account or reversing fees. They think, `They're getting away with it, so that makes it okay for me,' even though they know it's wrong," Colletts says. All three individuals in the examples she cites were long-term employees. All were fired. But new employees can also present a fraud risk. "Credit unions have to be cautious in the hiring process," Colletts warns. "One thing I suggest they all do is run a credit report. That will tell you a lot. If the credit report is derogatory, the question should be in their minds, `Do I want somebody like this working in my credit union, counseling my members on lending or taking transactions at the teller line when they can't control their own finances?' "I do have to say that within the last two years more and more credit unions are running a credit report and doing other background checks before they hire an employee." On another positive note, today's technology offers more audit tools, controls and reports. The problem is there are still some credit unions who either don't know about or simply don't use those tools. The reports also need to be reviewed by a non-user of the system, somebody without transaction authority, perhaps the supervisory committee or an internal auditor. When in a credit union with an internal auditor, Colletts asks if that person has transaction authority. The answer should be, "No." The volume of internal fraud has remained pretty constant, Colletts says. "It's not going away, that's for sure," she states. She offers some pointers from the internal fraud cases she's investigated. * Be proactive. * You do need to trust your employees. Don't hire somebody you wouldn't trust. * At the same time, it's equally important to have good internal controls and audit procedures in place. You want to make sure you have accountability and responsibility for everything in the credit union. * All employees should sign a fraud policy annually. It should be part of their personnel file. It sets the tone from the top that fraud will not be tolerated. * Enforce computer security. Each employee should have a separate user identification number and a password known only to the employee. Passwords should be changed periodically. If an employee loses sight of their terminal, they should sign off. * Separation of duties is important. One person should not be able to handle a loan from start to finish. -

[email protected]