Banking 101 dictates that dual control is the solution and safeguard against internal theft and fraud. Over and over, we are seeing cases where fraud has been successfully committed over extended periods of time and into the millions of dollars, where the “collusion” of two employees has made it possible. That very thought is the bedrock that bankers use as the stop-gap to preventing it. The story linked below is yet another case of controls being being circumvented and finding a way to outsmart a manual system. When the reward is in the millions of dollars, the motivation is there.
The first hurdle to getting your arms around the risk is take the “person” out of the equation and insert “position” instead. Then look at the position and see what the risks are, as well as how they are controlled and mitigated . Then ask “can those controls be circumvented and is this manual solution effective today?” Take a hard look at what you are controlling with dual control as your solution. In some instances, that solution will work fine – such as in the case of opening/closing procedures, vault access and other physical functions. It’s when you look at what can be done electronically and behind the scenes that the true risk will present itself. Look and see how you are reviewing access to your systems, customer accounts, dormant accounts, statements and alike. Automation exists today that can monitor that activity and show you what at what the staff is looking at, thereby illuminating where the real risk is.
As examples – being able to monitor that your employee is looking at account inquires at a rate of 50 to 1 to others in the department would be a red flag. Knowing that the same employee took screen shots of all those accounts and now the majority of them have had debits made to them would be incredibly powerful intelligence to use in an investigation and to alert you of previously undetected activity.
In the linked story below, a tenured managment person and another employee worked together for years to embezzle funds. Dual control didnt work. Automation can help detect similar cases that are amongst us and provide an impressive ROI with just just the first stopped scheme.
http://www.sunherald.com/pageone/story/1525921.html?storylink=pd
