The Teller Who Skipped the Dual Control
A credit union's internal audit finds that at one branch, a teller supervisor has been opening the vault alone, counting cash without a second person, and approving her own teller over/short adjustments. Over six months, the branch's cash variance is $14,200 short, versus $1,100 at comparable branches. The supervisor also has signature authority on the branch's operating account and reconciles the branch's general ledger. No employee has been accused, but the pattern is suspicious. The credit union has a dual-control policy requiring two employees for vault access and reconciliation. The branch manager was on extended leave for most of the period.
1. Identify the internal control failures and the fraud risk they create.
Read the worked answer
This is a segregation-of-duties failure across multiple controls: (1) Vault access - one person opening and counting cash defeats dual control, enabling theft or manipulation of cash counts. (2) Self-approved adjustments - the supervisor approving her own over/short adjustments lets her conceal shortages. (3) Reconciliation - the same person with signature authority reconciling the GL creates the ability to cover discrepancies. (4) Supervisory override - the branch manager's absence removed the layer of review. Fraud risk: the $14,200 variance (vs. $1,100 peer) is a strong red flag for misappropriation, possibly concealed through adjustments. The triangle of fraud - pressure, opportunity, rationalization - is present in the opportunity dimension. The credit union must investigate before concluding, but the control environment is clearly deficient.
2. What immediate and long-term remediation should the credit union implement?
Read the worked answer
Immediate: (1) suspend the supervisor's vault, adjustment, and reconciliation authority pending investigation; (2) conduct a surprise cash count and independent reconciliation; (3) preserve records and involve legal/counsel; (4) if misappropriation is confirmed, follow the bond claim and law enforcement process, and file a SAR if applicable. Long-term: (1) enforce dual control with system logs and periodic audits; (2) separate custody, approval, and reconciliation duties; (3) require manager review of all over/short adjustments above a threshold; (4) rotate assignments and require vacation; (5) restore branch manager oversight and add a second reviewer during absences; (6) train staff and test controls quarterly. Governance: report findings to the audit committee and board; track remediation to closure. The goal is a control environment where the same person cannot both create and conceal a discrepancy.