The Reconciliation That Never Closes
A payments processor's operations team reconciles customer settlement accounts daily. For the past 11 business days, the automated reconciliation has failed to balance, with an unexplained variance oscillating between $40,000 and $120,000. The team has been booking the variance to a 'suspense' account and manually clearing it the next morning, so customer balances have stayed correct. The operations manager says this is a known 'timing issue' and has not escalated. The suspense account now holds $1.1M of unresolved items. A junior analyst notices that two of the manual clearing entries were posted by the same employee who has approval rights over the suspense account, and that employee is on leave. The bank's operational risk policy requires escalation of any unexplained variance above $25,000 within one business day and a root-cause analysis within five.
1. Classify and assess the operational risk event, and identify the control failures.
Read the worked answer
This is a processing and reconciliation failure with a potential internal-fraud indicator, sitting in the 'execution, delivery, and process management' risk category. The financial exposure is the $1.1M suspense balance plus the $40k-$120k daily variance; the operational exposure includes customer harm if balances are wrong, regulatory reporting risk, and reputational damage.
Control failures: (1) Escalation control failed - 11 days of breaches above the $25k threshold with no escalation, a clear policy violation. (2) Segregation of duties failed - the employee posting manual clearing entries also holds approval rights over the suspense account, so the same person can create and approve a correction. (3) Reconciliation control is ineffective - booking to suspense and clearing next day masks the underlying break rather than resolving it. (4) Detective monitoring failed - nobody reviewed the growing suspense balance until a junior analyst noticed. (5) Key-person risk - the only person who understands the manual entries is on leave, which is itself a sign the process is not documented or controlled. The 'timing issue' explanation is unsupported because the variance oscillates rather than trending, which is inconsistent with pure timing.
2. What immediate and root-cause actions should risk management take?
Read the worked answer
Immediate: freeze manual clearing entries to the suspense account, require dual approval on any further postings, and place the account under enhanced monitoring. Reconcile the $1.1M suspense balance item by item with a full audit trail. Because an employee with approval rights is implicated, refer to internal audit and, depending on findings, to the fraud team; preserve access logs and entry records before they are altered. Notify the operations head and compliance, and assess whether any customer balances were actually misstated - the claim that they stayed correct must be independently verified, not accepted.
Root cause: rebuild the reconciliation with documented break-resolution rules, a hard stop that prevents next-day clearing without a root-cause code, and segregation between entry posting and approval. Set automated alerts at the $25k threshold so escalation cannot be skipped. Add a suspense-account aging report reviewed weekly by someone outside operations. Finally, cross-train staff and document the process to remove key-person dependency. The exam judgement is that 'customer balances are correct' does not neutralize the control failure - the inability to explain the variance is the risk.