Credit Union Fraud – Five Next Steps

In a financial institution, the risk of internal fraud and theft far outweighs the assumed risks of fraud committed by strangers. A typical organization loses five percent of annual revenue to fraud committed inside the organization, according to the Association of Certified Fraud Examiners.

Defending your credit union from internal threats is as, if not more critical than protecting it from external threats as it carries the risk of reputational damage, as well as far greater losses.

Trust Not, Want Not

Credit unions offer a unique environment for the internal fraudster. Frauds may occur in centres where there is limited staff, lack of segregation of duties and a family-like atmosphere where trust is presumed.

When an issue surfaces, the reputational damage in the community, the kickback to ensure data is protected and the critical incident stress that affects team members can be devastating. And larger credit unions can suffer greater losses if internal controls and weaknesses are not managed.

Typical strategies of conducting criminal background check for employees, trust as an internal control and lack of understanding of the potential risks make credit unions particularly vulnerable to internal fraud. 

That is because the typical fraudster has no criminal record, has worked with an organization between 8 to 11 years and has authorization over key internal controls.¹

Unfortunately, fraud happens when you least expect it, from the people you least expect it from.

Take Five – the A-E-I-O-Us of Fraud Investigation

"A" is for Advice - Credit unions need to protect themselves from litigation from poor or over-zealous internal investigations. Seeking the advice of a professional is critical; whether receiving advice from employment lawyers or receiving guidance from an investigative firm, the credit union must understand the pitfalls of internal investigations.

"E" is for Evidence - Identifying key evidence is critical to the organization. Computing devices such as cell phones, iPads, laptops, desktops and other PDAs are an important source of information. It is likely the organization's internal data was manipulated to conceal the theft and fraud, therefore these devices should be secured and not touched until examined by a professional.

"I" is for Internal Controls- It is important to understand that the internal fraudster was able to circumvent internal controls to conduct their theft and fraud. Those internal controls, whether weak or non-existent, need to be identified to quantify the extent of the crime. Understanding the access abilities of that person will be a step to remediation: senior staff may have greater access to key controls in an organization, whereas entry level clerks may have limited access.

"O" is for Others - Collusion in workplace fraud is often required to circumvent internal controls. Conducting a thorough investigation will identify if others were involved or if others were aware of the actions of the fraudster. As conducting interviews with fraudsters is fraught with litigation dangers, they should be completed by professionals.

"U" is for You - You, the organization, must identify the risks that the publicity of this event will cause. The reputation of the credit union is particularly important in small centres and may lead to a need for additional resources to handle inquiries from the public.

Be proactive and ahead of the game. Notify regulators, issue public statements as soon as you have the facts (and have been cleared by your legal team) and inspire confidence in your membership.

MNP is here to help credit unions grow and succeed. We have extensive experience providing accounting and business consulting services to more than 100 credit unions across Canada. Our dedicated credit union team delivers service specifically designed to help credit unions achieve their goals by providing strategic advice in assurance, taxation, enterprise risk management, corporate governance, consulting, investigative and forensic accounting and more.

For more information, visit http://www.mnp.ca/en/credit-unions

Mike McCormack, BA, CFI, is a senior manager of MNP's Investigative and Forensic Services in Edmonton. For more information on the above fraud considerations and the impact to your credit union, contact Mike at 780.451.4406 or [email protected]

1 ACFE 2016 Report to Nations