At home, our almost two-year-old daughter is into everything. It seems as though each day we learn of a new way our home is not “toddler proofed.” Luckily for us, there are child locks on cabinets and dead bolts on outside doors that prevent her from accessing the other side. Without these controls, she would be able to enter the pantry and eat goldfish until she was sick or run outside unattended, and she would be causing herself some pain and her parents a headache. She has to rely on a second person (mom or dad) to open the door and go out with her. She may find these controls a little irritating now (or a lot depending on the daily mood), but she will one day realize they were there for her protection.
This same concept of preventative controls can protect a financial institution and its employees. Just as neighbors seeing our child outside unattended would bring about undesired attention, so too would your customers finding out about an employee theft. Financial institutions have been so heavily focused on improving credit the past few years that their internal controls may have suffered in the process. Now may be a good time to consider reviewing your internal cash controls for sufficiency.
When I ask someone if they have dual control procedures in place, most of them respond “yes,” but when asked if there is physical control restricting access to individuals, the response usually changes. Many community financial institutions count among their most trusted employees long-tenured tellers with years of experience. While no financial institution wants to experience a significant loss involving cash, the ones that do often find it was from a long-term employee. These situations are especially tough because of the often close relationships these employees share with their coworkers. There are a lot of hard feelings when a “trusted” employee is responsible for theft. Are your policies and procedures adequate, and more importantly, are they being followed?
For example, true dual control, such as a split combination on a cash vault door, requires two employees, each with only half of the combination, to be present to open the door. Without both employees, access to the cash is impossible. If your institution’s cash supplies cannot physically be accessed by one person, then you are in great shape. But what if you have four employees who could each access the cash individually? If the vault count came up short, even if it was due to an honest mistake, four employees will have to be questioned to determine where the mistake happened. Here are a couple of things to consider regarding cash access:
Vault Controls—When scheduling allows, a “sole” vault custodian can be appointed. The custodian will have full access to the keys and/or combinations required to access the cash supply. When the sole custodian is not available, the keys and/or combinations should be split among two groups of employees. Many vaults are combination-only locks, and having the lock vendor reset the combination and giving only half the combination to one group and the other half to another is an effective control. If a key is also needed, or is the only locking device used, the key should be kept in a key box that requires two employees to enter their keys for access. Electronic locks are also available that require two separate employees to enter their codes before the lock will open.
Teller Cash—When possible, teller cash supplies should be only accessible to the assigned teller. If teller cash drawers are kept in a “teller cart” overnight, the key to unlock the drawer from the cart should be kept by the teller. Backup keys to the cash drawer should be locked in a key box requiring dual control. For drawers that must be shared by rotating or “traveling” tellers, keys for accessing the teller drawers should be kept in the key box as well. And remember, cash drawers should always be counted or audited prior to any change in custody.
Unfortunately, many small financial institutions are already stretched for staffing and many employees are wearing numerous hats, making segregation of duties increasingly difficult. For this reason, it is important to have good compensating controls and oversight for your cash. The most important of these is a sound and functional cash audit program. Beyond audits done for a change in custody of teller cash, all cash supplies should be subject to random surprise cash counts. Below are the basic tenets of a good cash audit program:
- Type of audit
- These should be done no less than semiannually, but more frequently is preferred.
- All cash under control of teller being audited should be counted at same time (i.e., cash drawer and vault for vault custodian).
- Vaults, ATMs, and cash dispensers should be included in surprise schedule.
- In addition to surprise cash audits, a cash audit done while a teller is on vacation or out sick unexpectedly should be done annually.
- Vacation policy is considered an important internal safeguard largely because perpetration of an embezzlement of any substantial size usually requires the constant presence of the embezzler in order to manipulate records, respond to inquiries from customers or other employees, and otherwise prevent detection.
- Audit controls
- Two employees should always be present
- Cash count records should be signed and dated by both employees present and retained.
- Audit timing
- Audits should be completed prior to the drawer being used each day or after the teller has balanced for the day.
- If not possible, all tickets should be cleared to ensure the balance is accurate.
- To retain the element of surprise, avoid auditing a drawer around the same time each month or quarter.
- Don’t wait until the last couple of days in the audit period to perform a surprise audit.
- Designate an employee (branch manager, retail supervisor) who is responsible for tracking audits and ensuring they are completed as required. NO EXCEPTIONS!!
Many of you probably have some or all of these controls in place. Couple that with a solid cash audit program and your chances of suffering a loss are greatly reduced. Take the time now to go through your “house” and see what areas could be strengthened to avoid a headache later.