The Solo Approver at a Niamey Microfinance Branch
Sarafina is a microfinance institution with 14 branches in Niger. At its Niamey Haoua branch, the loan officer, Mr. Idrissa, approves and disburses group solidarity loans up to XOF 500,000 without a second signature, reconciles the branch mobile-money wallet at month-end, and maintains the borrower register. The branch manager reviews only monthly portfolio reports. In the last two quarters, group loans of XOF 450,000 to 490,000 rose 38%, while the branch 30-day past-due rate went from 2% to 11%. Internal audit found 19 groups whose members national ID numbers were handwritten and several signatures matched the handwriting of one borrower. Two borrowers told an auditor they never received funds. Mr. Idrissa has 11 years of service and is trusted; staff say he is the only one who understands the system.
1. Identify the control weaknesses that allowed this pattern and rank them by how directly they enabled the apparent fraud.
Read the worked answer
The most direct weakness is incompatible duties: Mr. Idrissa approves, disburses, reconciles, and maintains the borrower register, so no independent person checks whether a group exists or receives funds. Ranking: (1) single approval and disbursement for loans up to XOF 500,000; (2) month-end reconciliation performed by the same officer who disburses; (3) no independent verification of group membership or national IDs; (4) branch manager review limited to monthly reports rather than transaction testing; (5) a trust culture that discourages challenge. The rising past-due rate and loan clustering just below XOF 500,000 are symptoms, not proof, but they point to the approval limit being exploited. A fraud examiner should test the population of loans between XOF 450,000 and 490,000, confirm group members by phone or visit, and compare signatures. The weakness is a design flaw, not merely employee misconduct.
2. Recommend three cost-effective controls Sarafina can implement within 90 days without replacing its core banking system, and explain the risk each addresses.
Read the worked answer
First, require a second signature or branch-manager authorization for any loan above XOF 200,000 and random review of 10% of smaller loans; this directly breaks the single-approver power and tests whether the XOF 450,000 to 490,000 cluster is genuine. Second, move reconciliation to the branch manager or regional finance officer, with a signed checklist and a monthly exception report for loans just under the approval limit; this restores segregation of duties without new software. Third, introduce independent borrower verification: call the group registered phone numbers, scan national IDs, and require beneficiaries to confirm receipt by mobile code; this addresses ghost groups and handwriting reuse. These are low-cost because they use existing staff and mobile-money confirmations. The controls should be documented and tested, not announced as a one-time campaign. If the branch lacks staff for a second signature, a regional officer can approve remotely.
3. Should the examiner recommend an enterprise-wide fraud risk assessment? Explain what evidence would support or weaken that recommendation.
Read the worked answer
Yes, but as a targeted risk assessment, not a conclusion that fraud is widespread. The branch shows a classic fraud-triangle combination: pressure from growth targets, opportunity from sole control, and rationalization captured in the phrase only one who understands the system. Supporting evidence includes the 38% growth in near-threshold loans, the past-due jump from 2% to 11%, handwritten IDs, and duplicate signatures. Weakening evidence: only one branch was sampled, the sample is small, and no interview has yet established intent. The examiner should compare loan-limit and reconciliation practices across all 14 branches, map which branches have the same design flaw, and use the results to prioritize. An enterprise-wide assessment is justified if other branches also allow single-officer approval or if internal audit has no transaction-testing program. Otherwise, a branch-level review plus control remediation is proportionate. The recommendation should specify scope, data tests, and a timeline.