One of the tried and true internal controls is "Tellers should not have access to signature cards". While I understand why you would not want tellers to have this access, I am having a hard time convincing Management of this. I need some ammunition. Also, we are on an image system where not everybody can pull an image but everyone can print an image - so in essence tellers do have access to the customer's signature. Also, when tellers are taking checks from the customer, they could get by with making a copy. So - why I understand this standard control - there are ways around it. So how do I convince management that it is a good control?

I am not absolutely sure why you would not want tellers to have "access" to signature cards. My institution has image software and all tellers have access to this software. It allows them to compare signatures to source documents (ie cashed checks, etc.) if need be. There are certain signature cards they don't have access to such as dormant accounts, but active accounts they do. How else would they compare signatures?

I think you would be most concerned with accounts that weren't having regular activity (those classified inactive/dormant, or about to be) - and tellers wouldn't be taking signatures for those. We have the same issue with imaged cards. The solution is to have IT develop different access levels, and be prepared for a battle there.

Okay - I agree. The problem is this. Our Branches maintain a copy of the signature cards at their branch. While dormant account cards are handled by Operations - Operations does not given the information to the bank so they can properly handle their cards. Also, many of these cards are kept behind the teller line and are not locked up at night - thereby giving the cleaning crew access to customer information. So I guess the only suggestion for a compensating control would be to have Operations give the branches the information to have the inactive copies pulled. The way I have always seen it is that Operations maintains the signature cards. If there was a question regarding a signature, then the branch would fax the check to Operations for a comparison. Most of our branches know their customers, so this would not be occurring very often. Anyway, it is going to have to be communication between operations and the branches.

Roun
This is the same procedure we use, the only difference is that we are a small bank with only 3 branches and when we pull Dormant cards we lock them up under dual control in a safe deposit box. If the customer comes in then operations can pull the card out of the box.

I do agree that teller have to have access to signature cards whether in a hard copy format or via image because they have to be able to verify signatures. As far as considerations for information security, are they kept is a locked room at night? Have you obtained a signed confidentiality agmt with your cleaning crew? Would it be too costly to obtain cabinets that could be locked?

Each Branch has a vault - so that should not be a problem for them to lock them up. During our branch audits we check this. Some do lock them up and other don't - but I guess that would be the responsiblity of the Branch Manager to ensure that they are secured.

Back to the signature cards - if the branch did not pull the dormant cards - but each transaction on a dormant account has to have Branch Manager approval - do you think that is enough of a compensating control?

I don't think that would be enough of a control because tellers would still be able to make transactions on dormant accounts without Managers approval. (Just don't let the manager know about it)

We pull hard copies of dormant account sig cards and maintain under dual control. Our software allows us to assign security levels, meaning that tellers aren't able to see dormant cards. Also on our platform system, we restrict teller sign on's by not allowing balance information on dormant accounts to be displayed.

All transactions to dormant accounts unpost; therefore, operations reviews these transactions to ensure that it contains the proper approval.

In the old days, the contract was part of the signature card. You can look at images, but the contract was intact.

Many years ago, there was a fraud, where an account was being syphoned-off. All of the signatures on the withdrawals were the same, but none matched the signature card. All the tellers (but one) processed the transactions. The lone teller was placed under surveylance.

Before lunch one day, the suspect teller went to the signature card cabinet and was seen swapping cards. She took out the original signature card and replaced it with a card with the same account name and number, but a different signature. While the teller was at lunch, her friend came into the bank and made a withdrawal from the account writing the accountholder's name in her own handwriting. When the teller came back from lunch, she swapped the fraudulent card for the original (- except, she was caught with both cards.)

That may be one reason not to have cards lying around.

Imaged signatures are restricted from branch access. This is to prevent fraud.

However, active account signatures are available for viewing in order to process check cashing and withdrawal transactions. We are a very large institution and very often, our tellers do not know the customers.