Connecting Two Credit Union Offices in the South West and West Regions
Nkwen Community Credit Union has its head office in Bamenda and a branch in Bafoussam, 70 km away. Each office has 18 and 9 staff respectively. Loan and savings records are kept in paper ledgers and in separate Excel files on two standalone PCs; month-end consolidation takes three days of telephone calls and email attachments. Each office has a 4G modem with an unstable signal and a 20 GB monthly data bundle. The manager has read about VPNs and cloud accounting, but the board is worried about confidentiality and recurring costs. The union is supervised and must be able to produce accurate daily balances and an audit trail. A fibre link between the towns is quoted at 4,500,000 FCFA installation plus a monthly fee that exceeds the current connectivity budget. The board will meet next week to choose among: a VPN over the existing 4G links, a cloud-based service, or continuing with nightly Excel emails plus a weekly courier of signed printouts. Advise the board.
1. Evaluate the three options against cost, timeliness, reliability, security and staff skills. Recommend a solution (which may combine options) and justify it for this credit union.
Read the worked answer
Nightly Excel email plus courier: lowest recurring cost and familiar, but consolidation remains manual. Balances are at best one day old, version conflicts are likely, and emailed spreadsheets are hard to audit. Courier printouts arrive weekly, too late for daily supervision. It does not meet the daily-balance requirement.
VPN over existing 4G: uses the current SIMs and a router at each end; recurring cost is mainly data. It gives direct access to a server at head office, so entries are visible immediately. But 4G signal is unstable, VPN drops interrupt work, and a public IP or dynamic DNS plus firewall skills are needed. Data overhead on a 20 GB bundle must be monitored.
Cloud service: browser access from both offices; the provider handles backups, uptime and security updates. Timeliness is good when the link works. The recurring foreign-currency subscription and dependence on the 4G link are drawbacks; staff need training.
Recommendation: a cloud-based core system with an offline fallback. Choose a reputable cloud accounting or records service with role-based access, daily export and a pre-agreed paper form for outages. If the board rejects foreign cloud hosting, use a head-office server accessed by VPN, but only if a UPS and a competent technician are funded. Do not keep the courier as the primary method.
Justification: it meets daily balances and audit requirements at the lowest operational effort, and the fallback covers the unstable link.
2. Describe the controls the union should put in place to protect customer financial data under your recommended solution, including access control, transmission security and audit.
Read the worked answer
- Access control: unique accounts per staff member, no shared passwords; role-based rights (teller can enter transactions, supervisor approves, auditor read-only); multi-factor authentication for remote access and cloud administration; least privilege; disable accounts when staff leave.
- Transmission: HTTPS/TLS for cloud services; VPN with strong encryption if using a head-office server; never send customer spreadsheets by ordinary email.
- Audit: system-generated logs recording user, date/time, amount and before/after values; logs stored where staff cannot edit them; monthly review by the supervisor; sequential transaction numbers and dual control over large payments.
- Data protection: encryption at rest on laptops and backups; clean-desk policy; confidentiality clauses; 3-2-1 backup (local encrypted drive plus cloud or offsite copy) with tested restore.
- Physical and endpoint: lockable office, UPS, antivirus, patched PCs, restricted USB use.
Judgement: the biggest risk is not the technology but shared accounts and uncontrolled spreadsheets. Start with unique logins, multi-factor authentication and an audit trail; these are cheap and directly answer the supervisor's daily-balance and audit requirement.
3. Explain what staff should do at month-end if the internet connection fails for two days.
Read the worked answer
- Switch to the pre-agreed offline procedure: pre-numbered paper vouchers or a locked local template, with dual signatures for withdrawals and deposits.
- Record the time and reason for each offline entry; do not backdate silently.
- Use SMS or phone to confirm large transactions with head office where possible.
- Keep all source documents and reconcile them into the system as soon as the link returns; the supervisor reviews and signs the reconciliation.
- Run month-end reports only after reconciliation; mark them 'provisional' until verified.
- Record the outage in an incident log and review whether a second SIM or network provider is justified.
Prevention: keep a printed fallback pack, a charged phone and test the offline procedure quarterly. A backup 4G SIM from a different operator is cheaper than a fibre link and reduces single-provider risk. Judgement: the fallback must be practised before month-end, not invented during the outage.