GardaWorld, a service agency entrusted with the work of distributing the monies (mostly coins) on behalf of various banks. In the process, GardaWorld maintains the stock in its warehouses, accounts for what is being maintained, and carries out the distribution with its resources which include armored trucks and people. All went well till it was reported that some of the money went missing. Who stole the money, without being noticed?
The very first thought would be a robbery or someone stealing it. Robberies cannot go unnoticed and stealing truckloads of money from a secure & guarded location also equally ruled out. Employees taking money every day, filling their pockets while changing duties? It has to be a daily activity, as obviously one cannot carry bags full of money from a guarded vault. So many people and so many days of theft – sounds crazy! May not be the cause.
If no one steals anything – physically – where is the money gone? Before getting into the fundamental question, let us see how money(coins) are measured, monitored, and secured – in general – across various financial entities, while storing or distributing. While currency is generally counted before changing hands, coins are “weighed” when dealt in large quantities. However, weighing is not practical when container loads of coins are handled, as packing material would alter the calculations. So, the first issue here is – coins are generally counted as boxes/ containers/ drums when stored or transferred in large quantities. So the possibility of accurate accounting is less.
Secondly, the warehouse stores money from different banks – just like a regular warehouse storing different products like electronic items or meat products. The difference here is all the items are the same from different owners – at least the content within the packages. So, practically no need to segregate the boxes based on the owner bank. The second issue is lack of seriousness on segmentation and at any point in time, the accountability would be on “total” and not on detail.
Next, comes, where do you get this money from? Always receive from the mints/bank vaults or sometimes from your customers too? Is it always an issue to customer/branch or sometimes the receipt as well? It is more complex to handle issues and receipts both, why? The reason being whatever received from the banks are always in standard sizes/volumes/ quantities and simple measurement of packs will give a full measurement of value. The same cannot be true in the case of customer/branch receipts. So, the third issue is difficulty in quick measurements. This can be easily translated into a time-consuming handover/takeover process for each shift. So what? Practically ignored by its employees! A weak control obviously paves way for fraud. When no one knows how much money lying in all those hundreds of boxes, some crooks will make use of the opportunity.
Now, the chances of fraud. The money belongs to multiple owners (banks) and obviously, some inspection or audit takes place periodically by individual banks, as a global best practice adopted by all banks, almost. When you have a warehouse with similar items stocked everywhere – everything is the same in terms of value- what inspection do you do count a few items, which you think belongs to you? How easy it is to show the inspecting officer and tell him – “see, all those 25 boxes are yours”. Practically, every auditor can be given a similar reply and possibly they leave happily forever.
This kind of fraud happened at numerous places across the Globe where the custodian keeps huge sums of money on behalf of many banks or different branches on the same bank. Typically, they are given tasks like refiling ATM machines or maintain local vaults. At any given point in time, the fraudster (who manages the money) can show any visiting auditor, his money. Even when there is a shortfall, he can always make good from the huge balances he is maintaining. Unless and until all banks plan a single audit, this kind of fraud is hardly detected by auditors.
While fraud cannot be ruled out, another culprit could be weak systems and processes for accounting, transitioning, and reporting. As already discussed, the systems issues will multiply when money from different banks is pooled and stored together; money consists of receipts and payments as well; all packages will not be containing equal amounts of money and finally when the employees are overburdened with work.
Weak systems and faulty accounting practices could be a major culprit. It is likely that the money could be lying somewhere in some of the vaults, perhaps unnoticed/unreconciled, and not bothered about its existence. Also, it could be an issue of undercounting of packages like a box that may contain higher denomination but labeled as a lower denomination. The second probability, less likely, could be a major fraud where the money is siphoned out temporarily with an intention to replace it at a later date.
By and large, the episode talks about the need for a carefully designed and monitored system and associated processes. “A stitch in time saves nine”. Truetech’s Consultants helped many of its global clientele in designing and strenghtne their systems and process.
Information Security & Enterprise Risk Blog 