EASTLAKE, Ohio–The spectacular, 2010 collapse of St. Paul Croatian FCU, the largest-ever loss to credit unions by a natural-person CU at more than $170-million, was supposed to have served as a loud-and-clear wake-up call to regulators and auditors of the risk of embezzlement and internal fraud by employees. But apparently not.
Since St. Paul Croatian FCU’s failure, losses and even conservatorships stemming from employee embezzlements at CUs have continued, in some cases only being discovered after a decade or more. Consider:
* This January, former CFO Michael A. LaJoice allegedly walked into a police station and admitted to stealing $20 million over 12 years from Clarkston Brandon Community CU in Pontiac. Mich., causing the credit union to be placed into conservatorship. The institution and regulators were further embarrassed by LaJoice’s high-profile lifestyle and other warning signs that apparently went unnoticed.
* In December, Jacqueline Ray, the former manager for the Ochsner Clinic FCU in Biloxi, Miss. was accused of stealing more than $1 million from 2007-2013, setting up nearly 150 fictitious loans where proceeds went into her own accounts. Her sister, Gail Teague, pleaded guilty to stealing $30,000 from Ochsner Clinic earlier this year.
* Also in December, the former vice president of Houston Police FCU, Cheryl Vickers, was charged with an embezzlement that has lasted for nearly two decades, involving stealing $1,247,785 between January of 1997 and February of 2015 by tapping as much as $70,000 in unclaimed funds on deposit at the credit union. She has pleaded guilty.
And these are only the most recent cases of insider thievery. CUToday.info has reported on at least another six long-term frauds at credit unions in the past year, ranging from one that found an unusual way to finance the downpayment for an expensive car to another where a corporate credit card was used to buy items that were charged to the credit union at a markup.
While no one in the industry seems to be willing to apply the term “epidemic” to these longstanding frauds, so many have occurred recently that they comprise at least a viral outbreak. The scams have ranged from the clever (tapping the unclaimed funds accounts that usually generate little interest from depositors or the credit union) to the simple (an employee that went into the institution’s vault in the mornings and stuck cash into her purse). The unavoidable question: how does this illegal activity continue to go on and on without being caught?
No Shortage Of Blame
There certainly doesn’t seem to be a lack of potential blame to go around, as interviews with industry sources have turned up potential causes ranging from employees who are afraid to blow the whistle; unsophisticated supervisory committees that don’t look deeply enough into the financial nitty gritty; managements that may not do proper monitoring or may even be complicit in the fraud; ineffective boards of directors, and regulators sometimes too ready to send in less-qualified auditors, especially for small credit unions.
A longtime credit union auditor blames the problem on a lack of internal controls or failure to follow them, and insufficient manpower at smaller credit unions.
Mike Richards, chief executive at Richards & Associates, a Yorba Linda, Calif. CPA firm that has worked with credit unions for nearly half a century, says the spate of long-term embezzlements “is a frustrating thing for auditors.”
In the smaller credit unions, often there are not enough employees to discover the frauds, he says, while in the larger ones, internal controls may be in place but may not be being followed.
And it’s usually not the case that the embezzlers have managed to cover their tracks for the entire run of illegal activity, according to Richards. “Every fraud that’s gone on a long time, it popped up (during the course of the fraud) but nobody did anything about it,” he said. In some of these cases employees were afraid to blow the whistle, especially on their own supervisors.
Getting The B Team?
That’s “slowly changing,” he believes. CU employees need fraud prevention and fraud awareness training, he said, and they need to know where to report fraud. NCUA does maintain a fraud hotline at 800-827-9650 and it does allow callers to remain anonymous.
One key is not to report the fraud back to the person or persons who are suspected of perpetrating the crime. Richards, who had just returned from accompanying a sheriff’s search warrant on a credit union fraud, remembers doing a forensic audit at a large California credit union that turned up a $2.6 million embezzlement “that had gone on for five or six years.” The fraud involved ordering equipment then selling it and pocketing the proceeds. But the people in charge of reporting the revenues and doing a physical inventory were the ones perpetrating the fraud.
Accounting department employees should not have access the member database, Richards said.
Supervisory committees, often volunteers, are part of the problem too, he feels. “Dormant accounts are very vulnerable. They should get flagged and require a supervisory override on activity. The controls are there but are often being short-cutted,” he said.
He noted that a credit union’s supervisory committee may have good intentions “but they do a cash audit and don’t tie it back to the general ledger.”
Relying on regulators to catch the frauds may not be foolproof as well, he feels, as small CUs sometimes “get the B team.”
Smaller CUs can’t just hire more people, according to Richards. They need more stringent monitoring of accounts, and internal control audits, like surprise cash audits. “At really small CUs, top management is often involved,” he noted.
And justice is never assured. “A lot of them walk. It takes a long time to find them guilty. They get a slap on the wrist if it’s not a violent crime,” Richards said.
If there is any hopeful sign when it comes to embezzlements it’s that the perpetrators are usually not criminal geniuses. “Very rarely have I seen one that’s sophisticated,” Richards observed. “For example, money is taken in even amounts, rather in odd amounts that would seem more like an actual transaction.”
The View from NASCUS
The National Association of State Credit Union Supervisors (NASCUS) agrees with Richards on the overarching problem of fraud at credit unions, which does not differentiate between federal and state charters.
“Significant frauds that go undetected for an extended period of time are generally the result of a weak framework of internal controls,” said Pat Keefe, VP-communications. Keefe consulted with several state supervisors to respond to questions posed by CUToday.info related to internal fraud.
“An effective control framework generally results in fraud being identified in a timely manner with the severity of loss mitigated,” he said.
That may cost money, but it is money well spent. “While there is a cost to investing in internal controls, the payoff for that investment is timely identified and mitigated losses,” he says.
NASCUS says the number of long-running embezzlements that have been uncovered is “troubling” and that management, boards, auditors and regulators, groups that it feels are “separate and essential lines of defense against fraud,” need to be remain vigilant. “A fraud of significant magnitude unidentified for an extended period of time will typically result from a gap, lapse, or outright failure in each of these lines of defense.”
But the trade group for state regulators places ultimate responsibility on another group. “Blame resides first and foremost with those individuals who chose to ignore the law and abuse trust – the thief (or thieves) who steal from the membership.”
NASCUS acknowledges smaller shops are vulnerable to fraud, but maintains “there are typically compensating controls that can be designed and implemented in those situations to effectively protect member funds.”
And Keefe pointed out that smaller credit unions are not the only victims. “Fraud can occur at a financial institution of any size, small or large. What may be a wholly adequate and appropriate control environment at a small credit union may be completely inadequate at a large credit union engaged in complex activities.”
So what can be done to battle these types of long-running frauds? NASCUS feels “fraud prevention generally comes down to the basic blocking-and-tackling fundamentals of designing and implementing sound internal controls, such as separation of duties and joint custody.”
Boards Not Up To Task
Another problem can be boards of directors. Writing recently on the role of boards in preventing internal fraud, Joette Colletts, senior manager, risk management at CUNA Mutual Group, said many investigators of credit union failure caused by internal fraud cite “a failure of the board to perform its duties.”
Citing unnamed examples from 2013 and 2014 when employee fraud caused the failure of institutions, she pointed to failures by the boards that included missing board minutes, a failure to challenge a treasurer’s flawed financial statements, and the failure of a board and a supervisory committee to follow a recommendation from external auditors on segregation of duties.
Colletts’ recommendations to credit union boards include making sure to have a written fraud policy and having a comprehensive whistleblower policy.
“A volunteer credit union board may not have the experience and expertise to detect and prevent certain types of internal fraud,” Colletts wrote. “But ignorance doesn’t release your fiduciary duties. Get the outside help you need to assess your internal controls, look for vulnerabilities in policies and procedures, and investigate red flags you can’t address internally.”
—Mark Fogarty