The suspense account, the envelope and the probation
Vikram joined a mid-sized private bank as an internal auditor eight months ago on a 12-month probation, and has just taken a home loan from the same bank. During a routine review of a suburban branch he finds five suspense-account entries between ₹6.2 lakh and ₹9.5 lakh, totalling ₹47.6 lakh over six months, each reversed within 48 hours. All five were keyed by a clerk, Ronit, and authorised by the operations manager, S. Menon, who is Ronit's maternal uncle. Both terminals use the same password, so the maker-checker trail is effectively broken. Menon explains that the money was 'parked overnight for a festival advance for staff' and will be 'regularised'. A colleague tells Vikram that the regional head 'already knows and has asked us not to create noise'. The bank's whistle-blower policy names the Audit Committee Chairman and a third-party hotline and promises confidentiality and protection from retaliation, but says nothing about probationers. On his desk on Monday is an envelope containing ₹2 lakh in cash.
1. Explain why these entries are a fraud indicator rather than harmless book-keeping, and identify the specific control and ethical failures involved.
Read the worked answer
The pattern. A suspense account is a transit account for unidentified or unreconciled items awaiting clearance. It is never a lending account for staff. Five round-sum, high-value entries, each reversed within 48 hours, is the classic signature of 'teeming and lading' or temporary misappropriation: funds are taken out and put back before the reconciliation catches them. The reversal restores the cash position; it does not cure the conduct. Menon's 'festival advance' explanation is an unverifiable narrative offered only after detection, and the absence of any approval, scheme or interest record contradicts it.
Control failures
- A shared terminal password defeats maker-checker entirely; the authorisation is fictional.
- The authoriser is the keyer's uncle, so independence is absent even on paper.
- No independent reconciliation flagged five large, round-sum entries over six months.
Ethical failures
- Integrity of records - the ledger no longer tells the truth.
- Normalising concealment - 'the regional head knows, don't create noise' converts an unreported fraud into a conspiracy, and a fraud known but not recorded is itself a concealment offence.
- The cash envelope moves the matter from a control lapse to attempted bribery, and potentially to criminal conspiracy.
The auditor's duty is to the truth of the records, not to the comfort of the branch.
2. What should Vikram do in the first 72 hours - on evidence, channel and wording? Address the cash envelope and the fact that he is on probation.
Read the worked answer
The cash
- Do not use it, do not store it in a drawer, do not return it quietly and privately. Count it in front of a witness, note denominations, and hand it to the Vigilance/Compliance head under written acknowledgment - or return it to the person who left it with a written note copied to Compliance. Either way, the fact of the offer must be documented.
The evidence
- Screenshots of the five suspense entries with timestamps, the authorisation trail, and the shared-password configuration; a dated note of what Menon and the colleague said, in their words; the branch's reconciliation records.
- Do not investigate alone, do not confront Menon again, do not circulate the file.
The report, within 24 hours
- To the Audit Committee Chairman through the whistle-blower hotline, and to the Chief Vigilance Officer, in writing, factual and non-conclusory: 'I observed these five entries; the authorisation trail appears to be shared; I am reporting them as required by the policy.' Ask for a complaint reference number.
Probation
- Irrelevant to the duty to report. The policy applies to all employees, and in a listed company a vigil mechanism is required under Section 177(9) of the Companies Act, 2013. Protection under a genuine whistle-blower policy is not conditional on confirmation or on being proved right - it is conditional on good faith.
3. Six weeks later his probation is not confirmed, with 'performance' cited. What should he do, and what does this reveal about whistle-blower protection in practice?
Read the worked answer
Immediate steps
- Write to the Audit Committee Chairman and the hotline at once, referencing the earlier complaint and its reference number and the timing of the non-confirmation. Retaliation against a bona fide whistle-blower is itself a breach of the policy and is separately reportable.
- Ask HR for the specific performance metrics and the appraisal record in writing; a decision citing 'performance' must be capable of being tested against targets set before the complaint.
- Keep copies of every document - the complaint, the acknowledgment, the appraisal, the emails - in a personal file, not only on the office system.
- Escalate to the Audit Committee/Nomination and Remuneration Committee and take legal advice on victimisation.
What the case reveals
- Protection is procedural, not automatic. A policy promise is only as strong as the record a whistle-blower creates and the speed with which he creates it. A contemporaneous, factual, dated complaint is his best defence; an anonymous tip from a single possible source protects no one.
- The timing is the evidence. Six weeks after the report, a 'performance' exit needs a documented trail to be credible.
- His own conduct matters. Had he accepted the ₹2 lakh, or waited to 'confirm more' before reporting, his credibility would have been destroyed and the evidence likely gone. The ethical course and the self-protective course are the same one, taken early and in writing.