To provide a frame of reference, an analysis was prepared on all the articles on embezzlement and fraud that have been published in CU Times over the past 15 months. To this figure, bond claims that I have filed for credit unions that never made the press or are currently being handled by the FBI were added. The sorting and analysis of this information has provided some surprising, but not necessarily unexpected results. This selection process provided a total of 63 credit unions; 16 were more than $100 million in assets and 47 were under. The total losses were estimated to be $181.7 million, ranging from a low of $25,000 to $25.3 million, with 22, or more than one-third, exceeding $1 million. The breakout for small credit unions was $143.8 million for an average of $3.1 million, and $37.9 million for large credit unions with the average being $2.4 million. The average length of time that the embezzlement took place before being discovered, was 5.75 years for small credit unions and 4.50 years for large credit unions. You would think that in the small credit unions, that length of time for the fraud to be ongoing would be higher but the loss amount would be lower. These averages were somewhat similar. However, the most telling result was that for the larger credit unions, zero were merged or liquidated. For 21 or 45% of the smaller credit unions, the fraud resulted in the elimination of the credit union through either liquidation or a merger. While the impact for a smaller credit union is more devastating, this is not just a small credit union problem. It also points out that if red flags are identified, they are being ignored.

Even if the NCUA should not require credit unions to perform this assessment, it would be hard for a supervisory committee to justify not including this review as part of their internal audit procedures, or at a minimum as a topic added for discussion at a committee meeting. The committee could have a brainstorming session to identify fraud risks. If an internal audit function is in place, it might pose the following questions:

1. What fraud risks are being monitored by the internal audit team? How were these risks determined? What is the policy for the continuous auditing of these credit/lending and fraud risks?

2. What specific procedures does the internal audit perform to address management override of internal controls? Does this include looking at internal security policies to look at separation of duties, access controls and authorization controls?

3. Has anything occurred that would lead internal audit to change its assessment of the risk of management override of internal controls?

4. Is anything done for additional monitoring when an employee appears to be living beyond their means, exhibits financial difficulties, or does not take appropriate vacations?

5. Is appropriate screening of staff occurring prior to be hired? Are insurance bond ability checks and fingerprinting taking place?

The committee could look into the three elements of the fraud triangle: Incentives/pressure to commit fraud, opportunities and attitudes/rationalizations, and determine where their credit union stands.

Fraud triangle checklists are available, which can be tailored to the credit union industry to consider: Incentives or pressures on management within their job, opportunities that staff and or management can exploit, and attitudes or rationalizations exhibited by management.

For more on the fraud triangle, see this short video. Pages 7-5 of the NCUA Examiners Guide also has a list of fraud red flags as they relate to management, which can be reviewed as another aide. Examiners also have a short red flags checklist.

Checklists are also available from the Federal Financial Institutions Examination Council, Association of Certified Fraud Examiners and American College of Forensic Examiners Institute. While none of these checklists are banking or credit union specific or directly related to a fraud risk assessment, they could be adapted with the assistance of a forensic specialist.

One process or procedure will not fit all credit unions, as the internal control system and overall credit union philosophy will differ. A member of the supervisory committee or an outside professional versed in these procedures would be recommended for the initial assessment. Fraud prevention is an ongoing, dynamic progress that will require continuous evaluation and improvement. If you do not proactively identify and manage your fraud risks, would your credit union be able to absorb the fallout? If management does not agree or does not see the need for a fraud risk assessment, does this not by itself raise a red flag?

David Legge is president/CEO at Legge Group. He can be reached at 703-257-1364 or [email protected]. Check out part two of his series on internal fraud, “Tools for Preventing Internal Fraud,” in the July 29, 2015 issue of CU Times.