Bank shortfall: eleven channels and three disagreeing clocks
A district cooperative bank branch in Bathinda finds a cash shortfall of ₹1,82,000 during end-of-day reconciliation on Friday, 14 March, and fixes the review window as 09:00 to 18:00 that day. You are asked to review eleven channels covering the teller counters, the vault anteroom, the back office and the entrance. Before viewing any footage you compare clocks: the channel covering teller counter 3 runs 7 minutes fast, the vault anteroom camera is 3 minutes slow, and the NVR itself is 2 minutes ahead of the bank's network time server. At 14:22 the back-office door channel shows 'no video' for 38 minutes, although the recording schedule says it should have been recording, and the bank's transaction log shows three vault entries between 14:00 and 15:00. The branch manager wants a name by Monday and has already told two staff members they are 'suspects'.
1. Explain how you reconcile the clock offsets and construct a defensible timeline for the review window.
Read the worked answer
Build one conversion table before looking at any event.
First state what each offset is measured against - this is where most audits fail. If the 7-minute and 3-minute figures were read against the NVR display, total correction to real time is camera offset + NVR offset (2 min). Worked example: counter 3 displays 14:30:00 → subtract 7 min → 14:23:00 NVR time → subtract 2 min → 14:21:00 IST. Vault anteroom displays 14:50:00 → add 3 min → 14:53:00 → subtract 2 min → 14:51:00 IST.
Confirm the offsets empirically. A clock setting is a claim; a shared event is proof. Pick two or three people who appear in sequence on several channels (entrance → counter → back office) and check whether their transit time is physically plausible after correction. If it is not, the offsets were measured against the wrong reference and must be re-derived.
Then build the timeline. Enter every relevant event twice: the raw on-screen time as it appears in the file, and the converted IST time. The exported video is never retimed or re-stamped; the correction lives only in the spreadsheet so the original stays defensible.
Disclose the method. Attach the conversion table and the reference-event check as an annexure. Investigators and disciplinary panels accept a documented uncertainty of a few seconds; they will not accept timestamps that shift unexplained between pages of a report.
2. The transaction log shows three vault entries between 14:00 and 15:00, one of which falls inside the 38-minute blackout. How do you record these events, and how do you handle the recording gap?
Read the worked answer
Log what is provable and grade the confidence.
For each vault entry, identify the nearest anteroom events, apply the conversion, and describe actions neutrally: 'at 14:51:10 IST a person entered the anteroom carrying a rectangular object; derived time, uncertainty ±10 s'.
Use three labels: observed (clearly visible), consistent with (matches on timing or appearance but not conclusive), not determinable (the gap covers it). At least one of the three entries cannot be visually confirmed at all - say so, rather than allowing an empty frame to imply nothing happened.
Do not identify people from a face at this resolution. Describe clothing, build, badge colour and direction of travel. Identification is a decision for the bank's disciplinary process, not a finding for the auditor.
Treat the 38-minute gap as a separate integrity finding. It is not normal overwrite, because retention is 21+ days. Possible causes: schedule error, channel disabled, port or disk failure, or a deliberate configuration change. Preserve NVR logs, configuration exports and the system event list before anyone reboots the unit, and list the gap as an open issue requiring an IT explanation.
Address the manager's 'suspects' comment. Record that two staff were told they are suspects before the review finished; it contaminates statements and creates real defamation exposure. Advise that your report is factual and that the bank's HR process handles attribution.