At many firms, the model employee comes in early, leaves late, and never takes the maximum allotted sick and vacation time. Unfortunately, some of those who seem dedicated to their desk are thieves; they can’t leave, because then someone will find out about their sham bank accounts, vendor kickbacks, or phantom expense reports.
Research of frauds committed in 2004 by the Association of Certified Fraud Examiners shows that those who commit fraud look loyal. Nearly 70 percent of them are employees rather than managers, and over 73 percent of them have worked for the company for more than three years.
They're also glued to their desks.
That's because, ostensibly, they can't leave: Long breaks from the office create an opportunity for their actions to be discovered. Which makes sense: The ACFE study also found that in about 65 percent of these cases, the perpetrator acts alone, and over 20 percent of frauds are uncovered by accident.
Go Away. Please!
The banking industry has favored long vacations for years. In 1995, the Federal Deposit Insurance Corporation endorsed a two-week consecutive vacation as an effective financial control, especially if there is no rotation of duties that might provide an internal check on employees’ activities.
In fact, the Federal Reserve Bank’s supervision manual recommends that examiners look for branch policies that require employees in sensitive positions to be absent from their duties for some minimum amount of time, with the recommendation being ten consecutive business days.
At Harris N.A., the Chicago-based subsidiary of Bank of Montreal, those on their 10-day vacations are denied remote access to computer networks, email, and voice mail, says spokesperson Chris Nardella.
Many of the regulations in Sarbanes-Oxley were taken from banking regulations, so it’s no surprise that auditors are looking at vacation policies as a financial control. The technique is particularly useful at small filers that don't have the resources to segregate duties, says Trent Gazzaway, managing partner for corporate governance at Grant Thornton. He recommends that these companies force financial staffers to take at least a week of vacation at a stretch, which automatically means that someone else has to take over duties for that period of time.
CONTROLLED VACATIONS
The excerpt below is from the "Commercial Bank
Examination Manual," published by the Division of Banking Supervision and Regulation, Board of Governors of the Federal Reserve System:
Rotation of assignments and periodic scheduled
absences may improve internal controls by
preventing one person from controlling any one
job for an extended time period (and by providing
cross-training and backup for all personnel).
When vacations are scheduled, management
may require staff to take uninterrupted vacations
that are long enough to allow pending transactions
to clear. These practices are most effective
if vacations or other types of absences extend
over the end of an accounting period or are for
two consecutive weeks...
The excerpt below is from the "Bank Holding Company Supervision Manual," published by the Division of Banking Supervision and Regulation, Board of Governors of the Federal Reserve System:
After producing a profile of high-risk areas
and activities, it would be expected that a minimum
absence of two consecutive weeks per
year be required of employees in sensitive positions.
The prescribed period of absence should,
under all circumstances, be sufficient to allow
all pending transactions to clear and to provide
for an independent monitoring of the transactions
that the absent employee is responsible
for initiating or processing. This practice could
be implemented through a requirement that
affected employees take vacation or leave, the
rotation of assignments in lieu of required vacation,
or a combination of both so the prescribed
level of absence is attained. Some banking organizations,
particularly smaller ones, might consider
compensating controls such as continuous
rotation of assignments in lieu of required
absences to avoid placing an undue burden on
the banking organization or its employees.
Bishop
“It is often recommended that people should take two consecutive weeks of vacation, but in today’s world, there is often no one to step in for them,” says Toby Bishop, president and CEO of the Association of Certified Fraud Examiners. “If that’s the case, fraud may never be discovered.”
Furthermore, he says that those committing the fraud often train their temporary replacement, so they can see to it that discovery is avoided. Bishop recommends that firms opting for a forced vacation strategy schedule it over a month-end reconciliation, and that they pay attention to the duties assigned to the replacement.
Sanders
Laura Sanders, a financial investigator at the law firm of Strasburger & Price in San Antonio, Texas, has seen situations like this in the past. In one case, the executive even forbid others from reviewing his communications during his absences. “The company's CFO rarely took time off and when he did, he gave specific instructions not to open mail,” says Sanders.
Sanders' example is reminiscent of a famous case involving Leston B. Nay, the former head of First Securities Co. of Chicago, who instituted a "mail rule" stating that no mail addressed to him was to be opened whenever he was away from the office. The policy facilitated Nay defrauding unwary clients.
According to Sanders, the CFO in her case also prevented employees to review certain financial information while he was gone. “He also password protected his computer and prohibited anyone from checking the bank statements on-line," she says. "The employees thought he was just being helpful as to not overload them with work during his short absences—in reality, he stole over half a million dollars in a two year period.”
Like other experts in the field, Sanders recommends companies require that all employees take at least one week-long block of vacation time each year. Doing so, she says, is a "best practice" that can help test and strengthen financial controls.
No comments yet