Forged Bills of Lading at Nelum Bank
Nelum Bank plc, a mid-sized licensed commercial bank, approved its enterprise risk management framework 14 months ago. Its risk appetite statement caps trade finance losses at LKR 150 million a year. Last quarter the trade finance unit honoured three export bills totalling LKR 410 million against bills of lading later found to be forged; the shipping line had no record of the containers. The investigation found that one relationship manager had handled all three, each sized just below the LKR 150 million senior-credit approval threshold; the documentary-check checklist contains no step to verify bill-of-lading numbers with the carrier; the unit was three of nine staff short and had been told to clear a backlog after a service complaint; and compliance last reviewed trade finance 26 months ago. The board risk committee has asked for a root-cause analysis and a revised risk response before the next reporting cycle.
1. Assess the failures against the COSO internal control components and the three lines model. Distinguish control design failure from control operation failure.
Read the worked answer
Mapping the failures
| Component | What failed | Design or operation? |
|---|---|---|
| Control environment | Management's response to a service complaint was to instruct staff to clear a backlog while running 3 of 9 staff short. Pressure without capacity is a tone-at-the-top choice. | Design (resourcing decision) |
| Risk assessment | Appetite is expressed only as an annual aggregate (LKR 150m). There is no per-counterparty, per-relationship-manager or per-bill limit, and no assessment of documentary-fraud patterns. | Design |
| Control activities | The checklist has no carrier verification step; a single RM handled origination, documentation and submission. No independent confirmation, no dual control. | Design |
| Information and communication | No mechanism for the documentary-check unit to escalate a suspicious pattern; the last compliance review was 26 months ago. | Both |
| Monitoring | No monitoring of approval-threshold clustering. Three bills just below LKR 150m is a detectable pattern that was not detected. | Design |
Design versus operation The threshold structure is the clearest design failure: a hard limit per transaction with no aggregation invites structuring, and the RM's behaviour was a rational response to the design. The missing carrier-verification step is also design - the control did not exist. By contrast, whatever segregation existed between origination and checking appears to have operated only nominally; that is an operation failure, but a predictable one given the staffing and the backlog instruction.
Three lines
- First line: the RM originated, documented and submitted. No separation, and no consequence framework.
- Second line: compliance had not reviewed trade finance in 26 months. The risk function owned an appetite statement it did not monitor at transaction level - present on paper, absent in practice.
- Third line: internal audit coverage of trade finance over the period must be tested. If covered, the finding was missed; if not, the audit plan was misaligned with the stated risk appetite.
Root cause A control set built for individual diligence rather than system verification, combined with a transaction limit that created the incentive to structure, operating under a capacity constraint that made the diligence impossible.
2. Recommend a risk response portfolio using avoid, reduce, share and accept, with the cost-benefit reasoning. Why is 'strengthen training and remind staff of the policy' an inadequate response?
Read the worked answer
Response portfolio
Reduce (primary)
- Mandatory independent carrier or eBL verification before any bill is honoured, through a portal or API rather than a phone call. Cost is modest relative to LKR 410 million and recurring; it removes the specific forgery vector.
- Redesign limits on aggregate exposure per counterparty, per relationship manager and per rolling quarter, with threshold-clustering detection replacing the single per-bill cap.
- Restore segregation: no single officer from origination through submission. Enforce with system permissions, not with a memo.
- Fill the 3 of 9 vacancies and remove backlog-based performance pressure; a service complaint cannot be remedied by lowering the control standard.
Avoid (targeted) Decline or require prepayment/cash collateral for higher-risk corridors and new-to-bank counterparties until verification capability is proven. Cost: forgone revenue in a segment that has already lost LKR 410 million; acceptable on a defined review date.
Share Confirmations through the correspondent bank, credit insurance or export credit cover where the policy responds, and a documentary-fraud extension if obtainable. Note the limits: insurers exclude fraud by the insured's own officers and require the very controls that failed.
Accept Residual exposure within the appetite, explicitly recorded with a named owner and a monitoring KRI. The LKR 410 million already incurred should be treated as an operational loss with a capital and provisioning consequence, not as a one-off.
Why training is inadequate Training addresses knowledge, and the RM plainly knew the rule - the bills were structured just below the approval threshold. The behaviour was a rational response to a limit design, a capacity constraint and a throughput culture. A training response leaves the opportunity, the incentive and the pressure unchanged, so the loss recurs with better-informed staff. The hierarchy of control runs: eliminate or design out the opportunity, then detect, then train. Training is the last layer, not the first, and a board should reject a remediation plan that is training-only.
3. Design the key risk indicators the board risk committee should adopt for trade finance, with thresholds and owners.
Read the worked answer
Design rules Each KRI needs a definition, a data source, an amber and a red threshold, a reporting frequency and a named owner. Thresholds should be set so that amber triggers a management action, not just a discussion. KRIs must be leading where possible; the loss itself is a lag indicator that arrives too late.
| KRI | Amber | Red | Owner |
|---|---|---|---|
| % of trade transactions sized within 10% of an approval threshold | >15% in a quarter | >25% | Head of Trade Finance |
| Bills outstanding more than 2 working days without independent carrier confirmation | >0 | >5% of open bills | Head of Documentary Operations |
| Aggregate exposure to any single counterparty as % of the LKR 150m appetite | >50% | >80% | Chief Risk Officer |
| Exceptions per relationship manager per month | Above unit median by 50% | Any repeat exception by the same RM | Business Head |
| Trade finance staff vacancy rate | >15% | >25% | HR and Business Head |
| Months since last completed second-line review of trade finance | >12 | >18 | Chief Compliance Officer |
| Age of unremediated audit findings in trade finance | >90 days | >180 days | Head of Internal Audit |
| Losses and near-misses against the LKR 150m annual appetite | >50% consumed | >80% consumed | Chief Risk Officer |
Governance
- Report monthly to the executive risk committee and quarterly to the board risk committee, with a one-line commentary on each amber and red.
- Any red requires a written remediation plan with a date; any red open beyond one quarter escalates to the board.
- Near-misses must be captured, not only realised losses - otherwise the indicator set only records past failures.
- Add a qualitative horizon-scanning item: changes in counterparty behaviour, new corridors and known fraud typologies in the region. The control set that missed forged bills of lading would also miss the next variant if the KRI list is purely historical.
Test of adequacy Apply the three forged bills retroactively: the clustering KRI and the missing-confirmation KRI would both have gone red before the third bill was paid. A KRI set that would not have flagged a known loss should not be adopted.