We use a Jack Henry product for BSA purposes. The product allows us to create specific worklists for our customers. I have 3 specific worklists (wire transfers, ach activity and cash activity). These worklists include employees, directors and owners. The worklisted are reviewed on a monthly basis by a deviation rate, the program establishes.

I think I'm going to suggest revisions to our Employee Account Review Policy and start shopping for software in my "spare" time.

Employee account activity, as is all account activity, is monitored through our BSA/AML software (Banker's Toolbox). If something is unusual, I open an investigation. If something is suspicious, Management is brought in immediately. Assuming of course they aren’t the account holder.

We are on the same page. Any issues I have with an account I first go to HR to discuss.

To all those who currently perform an employee account review, are you in IA?

I was always under the mindset that this should be a management function (as it is a interal control) and IA audits the process.

(Although I can see the argument for IA doing this, as well)

Unfortunately it fall right smack in my lap as IA...As I stated earlier if NA would code them as they set them up or added as an authorized user...I could print out a report, but I need some software that would simplify this process for me!!!

We're a small bank. We don't have an IA dept. I do BSA and Compliance so, I was nominated for this particular task.

I believe that one other person mentioned it almost in passing - besides the payroll and other accounts that are listed as employee, do a search to ensure that you're covering accounts where the person may be an authorized signer. Also do a scan of addresses in the event that a fictitious account was opened up.

We once ran a loan report by address and found 11 consumer loans at one address (residential) - all different names. It was also the address of the branch manager/loan officer. He was making fraudulent loans to pay off the earlier ones when he realized he did not have an exit strategy for the fraud.

rlcarey....What do you suggest for a small institution? Examiners ask for evidence of employee account review to identify potential fraudulent activity.

How do you monitor all your other accounts for fraudulent activity? Your biggest risk is and always has been from the outside.

During an audit of financial institutions, we look to see if they are performing periodic employee account reviews to include all accounts including loans. It is better to review a specified period (ie quarterly) to determine if there are patterns that you would not necessarily notice on a daily review. Community banks typically do not have an IA department and it often falls to the Human Resources individual or senior management. Most clients keep a log of individuals and accounts reviewed along with dates and supporting documentation.

I would challenge anyone to find the review of employee accounts in any of the Federal regulatory agency's examination manuals. Unless this is required by State law or your bonding company, there are many ways to develop internal controls to prevent employee fraud. Reviewing all accounts of every employee, IMHO is probably the most inefficient use of time and resources.

How many years have you been doing it and how many embezzlements or frauds have you uncovered?? And if found, were these directly found by this account review or though some other source? Dual controls and proper account reconciliation processes are probably much more important.

In the state of Oklahoma it is state banking requirement.

While the Federal Reserve does not suggest reviewing the accounts of every employee, it has this to say in the commercial bank exam manual:

Employee Deposit Accounts
Historically, examiners have discovered various
irregularities and potential malfeasance through
review of employee deposit accounts. As a
result, bank policy should establish standards
that segregate or specially encode employee
accounts and should encourage periodic internal
supervisory review. In light of these concerns,
examiners should review related bank procedures
and practices, taking appropriate measures
when warranted.

If not included in the internal or external
audit program, are employees’ and officers’
accounts, accounts of employees’
and officers’ business interests, and accounts
controlled by employees and officers periodically
reviewed for unusual or prohibited
activity?

As an internal auditor, the worst calls we receive are related to employee fraud. I've seen employees pay off their loans using various bank funds and a woman who put her daughter through college. It all relates to poor internal controls, has usually been occuring over a long period and is difficult to research by the time we are called in. It is too often a trusted employee who has been with the bank 10 to 20 years. The majority of internal audit is not regulated - it is largely a judgment call. We make our recommendations based on current "hotspots" with the regulators and known risks. Our reviews are based on "Protect the bank - but also protect your employees." Don't put them in a position to be questioned or tempted.

Mr. A - nice catch in the FRB exam manual - I looked in them all and missed that. But I still believe there are better ways to monitor employee accounts than reviewing each one.