An ₹18.6 Lakh Shortage, Two Revived Dormant Accounts and an Unopened Whistleblower Email
During a surprise cash verification on a Saturday, the concurrent auditor at a semi-urban branch finds physical cash ₹18.60 lakh short of the book balance. The cash officer is on leave. The DVR retains only nine days of footage against the 90 days required by the bank's own manual; the vault register shows the joint custodian's signature obtained in bulk on the first of every month. Two savings accounts with no customer-initiated transaction for four years each received ₹50,000 on the same day, and both amounts were withdrawn in cash by a person describing himself as the account holder's 'authorised representative'. Three loans disbursed eleven months ago under a government-sponsored scheme show the same mobile number and the same electricity bill as proof of address. The cash officer has 19 years of service and 11 months to retirement. The branch manager calls the shortage a 'counting error'. A whistleblower email from a clerk dated three weeks ago has not been opened by the vigilance desk.
1. Is this a cash shortage, a fraud, or both? Set out the evidence-preservation and investigation steps for the first seven days.
Read the worked answer
Both - and the shortage is the smallest part of it. A ₹18.60 lakh difference between book and physical cash may, standing alone, be a counting error or a kiting gap; a denomination-wise recount before two officers and a sealed memo will settle that. But three other findings cannot be explained by counting: two dormant accounts reactivated with ₹50,000 credits each and withdrawn in cash by an 'authorised representative' with no registered mandate; three sponsored-scheme loans sharing one mobile number and one electricity bill (the classic ghost-borrower signature); and a vault register whose joint-custodian signature is collected in bulk monthly, meaning joint custody exists only on paper.
Fraud test. Ask the two standard questions: was there misappropriation, and was there intent? Missing cash plus dummy dormant accounts plus fictitious borrowers is a pattern. Classify the case as suspected fraud and investigate on that footing, while keeping the counting-error explanation open until the recount is documented.
First seven days. (1) Preserve, most urgently the CCTV - issue a written hold to the DVR vendor today, before the nine-day cycle overwrites it - and secure the vault register, cash books, dormant-account reactivation forms, loan files and system access logs for the cash officer's ID. (2) Sequester: place the cash officer on leave, withdraw system access, and keep him away from branch records; extend the same to the manager if the 'counting error' line persists. (3) Hand over to the fraud investigation cell with a dated scope; verify the three loan accounts by independent field visit. (4) Test kiting: match same-day cash deposits at other branches against withdrawals here. (5) Report within the week to the MD and the board's audit committee.
2. What are the reporting obligations and timelines, and in what sequence should they be discharged?
Read the worked answer
Regulatory. (a) RBI: frauds must be reported in the prescribed format within the timeline set by the Master Direction on frauds (three weeks from detection in the ordinary course) - report provisionally if the amount is still being established and file supplementary returns later. (b) Central Fraud Registry and CRILC: the involved accounts must be reported so other lenders see them, and the ghost-borrower loans must be classified as fraud, not allowed to drift into NPA. (c) FIU-IND: if the dormant-account credits show layering, an STR follows.
Criminal. File an FIR or police complaint once preliminary findings show misappropriation; departmental proceedings do not substitute for a police complaint, and supervisors read non-filing as a cover-up indicator. For the sponsored-scheme accounts, report to the sponsoring government department and lodge the guarantee or insurance claim within the scheme's stipulated window, because late claims fail on procedure rather than merits.
Internal. Audit committee and vigilance committee within prescribed limits. The unopened whistleblower email is itself a reportable finding: a channel that goes unanswered for three weeks must be reported to the board as a control failure, not buried in the branch report.
Sequencing point. Do not wait for the investigation to conclude before filing statutory reports. File on the facts as they stand, mark them provisional where the amount is not final, and update. A late filing is a breach even when the eventual figure is correct.
3. Recommend preventive-vigilance measures to the board's vigilance committee, given that the whistleblower email was never opened.
Read the worked answer
Diagnose the controls that failed, then fix each with an owner and a date.
- Custody and vault. Bulk monthly signatures, a single custodian and an absent officer at the time of the count show custody on paper only. Fix: per-transaction joint signatures, biometric strong-room access, quarterly surprise verification by an officer independent of the branch, and a rule that cash is counted by two persons, neither of whom is the custodian.
- Retention of evidence. A nine-day DVR against a 90-day manual is a policy breach of the same family as an untested backup tape. Fix: a CCTV service-level agreement with monthly retention verification by the concurrent auditor and an exception report to the regional office on failure.
- Dormant accounts. Reactivation must require in-person verification with fresh photograph and signature, and cash withdrawal by an 'authorised representative' must require a registered mandate. Fix: a system block - no reactivation without regional-office maker-checker - and an automatic alert to the fraud control unit whenever a credit in an account dormant over two years is followed by a cash withdrawal within seven days.
- Whistleblower and rotation. The unopened email is the most serious finding: a channel that does not acknowledge within a defined period will never be used again. Fix: an acknowledgement SLA, a direct reporting line to the vigilance officer rather than the branch, anti-retaliation protection, and mandatory reporting of every complaint to the audit committee. Add mandatory rotation of staff in cash and custody roles after three years at one branch and ten days of continuous block leave, so any ongoing manipulation surfaces while the officer is away.
Board message. Preventive vigilance is not posters; it is the number of controls that depend on one person. Here that number was too high, and the branch manager's 'counting error' line is itself evidence that accountability has not been fixed.