Does anyone have a sample framework for reviewing employee accounts for evidence of insider abuse/fraud? I'm trying to formalize this audit process and would sincerely appreciate any help. Please e-mail to mrathbun@alliedfirst.com.

I review for unusual amount of deposits. I also make sure that the deposits have been processed and validated by a teller. All employee transactions have to be processed by a teller. I also check that tellers are not processing their own transactions. TGIF!

We maintain a worksheet for every employee in a huge binder. Each sheet covers a twelve month period. The number of debits and credits, beginning and ending balance, overdrafts, and any unusual exceptions are noted on this sheet. This allows us to visually determine is there have been any unusual changes to the accounts.

We also keep an eye out for kiting.

We presently review each employee account once per year. I look at EVERY transaction and for deposits, I look at their offsets. I make sure that tellers do not process their own transactions. I also look for any unusual transactions that may be an clue to kiting. I keep copies of all statements and copies of items in a "banker's box".

For those of you that go though all that trouble of reviewing every employee's account and keeping copious records, how many frauds have you uncovered? It just seems to be a little overkill. I would think that other controls would sufficiently reduce the risk to only warrant random sampling. If you are in a bank of any size at all, you are talking about a huge on-going effort to monitor every employee in this manner.

What if they don't bank with you? Seems like overkill when they do. Are employees aware of all the documentation that is under analysis and retained? Don't you have system exception reports that would indicate unusual activity, even when an employee account is involved?

Our blanket bond requires monitoring of officer accounts, not all employees. Been doing it for 15 years and have yet to uncover any suspicious activity, but it is one of those things that takes on a life of its own when you have done it this long. And of course the examiners ask for it every year.

Has reviewing employee accounts now become a standard review procedure in an IT audit?

We sample employee accounts (including loan accounts) quarterly. Sometimes we filter out those with a large number of deposits or other unusual activity for more of a risk-based review. In addition, during each regular audit, we may look at employee accounts for that particular area for a more focused look. While we haven't found any direct fraud through this review, we have uncovered a number of abuses and policy exceptions that would otherwise have been uncovered. Assuming that you have an appropriate internal control structure in place, I agree that a review of all employee accounts every month is overkill based on the risk invoved.

It was strongly recommended to me by the OCC at a previous exam to review ALL employee accounts at least quarterly. The bank was in excess of $500M w/ 350 employees. I really balked at the thought and did not expect to find much, but implemented the procedures. In almost every review, we found either fraud or a policy violation of some sort. I was extremely surprised at the results knowing the employees knew they would be reviewed at some point.

Recently at my current place of employment, a rather large case of insider embezzlment was uncovered that had been going on for awhile, and if procedures to review the account were taken more seriously it could have been detected much sooner. I am a believer in the process! There are several ways to review them timely and effectively, but it should be done by someone who can recognize unusual activity and should include review of any account the employee has signatory authority over.

Lil Bit, in the instances where you discovered fraud during the account review, were internal controls missing or did the fraud slip through the cracks?

Actually both. The larger, more recent incident was due to lack of controls, but I consider the non-existence of employee account review in that statement also. It could have at least served as a second, if not third line of defense or detection when the primary controls were not properly carried out.

I did however have at least 2-3 other situations at my previous f/i that were not necessarily preventable through internal controls. One case for instance, was a Sr. L/O personally lending money to a large cml borrower to payoff a non-accrual loan. Further investigation led to some other not so up-n-up transactions.

A second case was an employee who had borrowed money from an elderly, fairly incompetent person on several occasions. The she decided to take the money from the customers account without asking on several occasions.

A third case involved depositing money orders purchased at another f/i by forging his/her grandmothers signature on checks drawn on that bank. They would deposit the money orders and then write a check a few days later off of their own account to pay back the grandmother. I have to admit unless the employees mother also worked at the bank we might not have uncovered this whole story.

A fourth case involved a bookkeeper that refunded herself and her brother in-law nsf fees charged to their accounts. We first noticed hers and more research brought up the other account.

I agree controls are your first and best defense, but they are never guartanteed. The larger the bank the more stringent your controls should become, but you have to consider efficiencies also. One compensating control I found to be effective when other controls are no longer efficient is an automated effective review of employee accounts. I have also found that a separate disclosure to all employees annually reminding them their accounts will be reviewed, along with the requirement to provide a list of all accounts to which they have access, can serve somewhat as a deterent. I implemented that requirement after we started finding several issues at the prev f/i and at my current f/i when I first accepted employment to implement the audit department. The looks you get from some when they are asked to complete the form and return to I/A can also be scarry...

Are all accounts reviewed, or just a sample of accounts?

I now use exception reports that provide information such as number of debits and credits, avg balance, etc., to flag accounts with unusual characteristics. Those accounts and Exec Officer are looked at in detail, while other accounts may be reviewed at random. After implementing this method, I ran reports using previous stmt periods to see if the above situations would have been targeted and all were except for the L/O situation, however, that was found when looking at Exec Ofcr statments.

One more consideration is to check your state banking code for guideance. In Oklahoma we don't have a choice, we have to check ALL employee accounts. They recently amended the law where it only has to be conducted quarterly, but since we are considered a small bank we elected to continue the process monthly.

We have uncovered multiple kiting schemes. We have found numerous violations of bank policy. This would include, refunding of fees for a buddy, cashing checks for their own account, one friend lending money to another friend so they would not be in an overdraft situation, etc....

In Oklahoma you do not have to disclose your review process to the employees. Most of them know about it though simply because they have been in banking for a while.

Employees knows that their accounts are being montiored by the auditors and they are too carful.