Hacker News Reader

Comment by mrtksn | Hacker News Reader

I have a friend working in a large financial institution and by rule they are required to take 10 consecutive working days off every year when the rest of the department continues working.

The reason for this is to detect fraud and systematic issues within the company. When an employee is not on premises and locked out of the systems, any problems with their work can come out without actively investigating their conduct. It also guarantees resilience to the organisation in case the employee departures abruptly.

View on HN

This is extremely common in the industry, although it’s common practice to still allow one to be contacted if needed, however no system or building access beyond possibly being able to check emails.

How can locking someone out for 10 days reveal fraud? I don't have any financial institution background, and that doesn't make any sense to me.

The idea is that something (some metric) will spike/dip in that period that is different than normal ("Why do does our petty cash usage fall when X goes on vacation?"). It also means someone else will probably handle some/all of their "caseload" (aka "work") and might notice inconsistencies ("Why are we paying $X to Odd Corp monthly?").

Bottom line people are sloppy and/or their schemes can't handle them not being constantly present or "sunlight".

If said employee were actively defrauding the company and covering their tracks, they would be unable to make any fraudulent transactions or track covering in those 10 days. It's probably more like 16 days ultimately since it's probably business days, so there are 3 weekends as well. This would show up as a statistical difference in rejected transactions, contract overshoots, expense claims, something like that, I don't commit fraud.

It would also potentially expose any conspiritors, because the locked-out employee's responsibilities+communications would be forwarded to someone else for those 10 days. This wouldn't help you if the locked-out employee contacted conspirator's out-of-band to warn them however.

At least, that's the explanation. I guess the logic is that to avoid this, you would need to be making _larger_ fraudulent moves, less often. This would show up stronger against the background trade. Alternatively, simply the existence of these very obvious anti-fraud measures discourages people even if it's entirely possible they are a placebo. Similar to Lie Detectors, which only work on people who believe they work.

I think it's value for company resilience doing forced hit-by-a-bus tests on their employees on the regular is far more valuable in the long run.

For example some employees can override many checks and procedures for operational reasons and if they want they can use customer funds or conspire with people from outside the organisation to do shady things.

On a normal business day people will coordinate all the time and funds or resources can be moved, locked, released etc for operational reasons and no one will question a thing because everyone knows their part only and those who know the big picture are not exposed to these operations on daily basis.

So if an employee is doing something shady, they will act based on the developments on the ground. For example if a client is going to withdraw their money, they can move funds from another account to cover for the missing funds. If the employee is cut off for an extended period, they won't be able to arrange this and will trigger an investigation.

There are of course regular audits but these audits will catch you only if funds go missing or some other obvious irregularities are happening because they can't analyse every single action of the employees.

I was told that it's not unheard of employees taking the money from the client accounts and invest it stocks or crypto, take the profits and put back the money. They are usually caught when the investment doesn't pay off and can't put the money back.

Also, apparently there are cases of employees conspiring with criminal organisations to launder money. Handling of the client by another employee can reveal the shady business.

So in essence, any fraud that requires maintenance can be potentially uncovered in the absence of the fraudster.

The FDIC considers it a fairly important internal control mechanism for fraud:

https://www.fdic.gov/news/financial-institution-letters/1995...

To quote the most relevant bit (although the page is short and readable):

----

"Vacation Policies - It is the FDIC's goal that all banks have a vacation policy which provides that active officers and employees be absent from their duties for an uninterrupted period of not less than two consecutive weeks. Such a policy is considered an important internal safeguard largely because of the fact that perpetration of an embezzlement of any substantial size usually requires the constant presence of the embezzler in order to manipulate records, respond to inquiries from customers or other employees, and otherwise prevent detection. It is important for examiners and bank management to recognize that the benefits of this policy may be substantially, if not totally, eroded if the duties performed by an absent individual are not assumed by someone else. Where the bank's policy does not conform to the two-week recommended absence period, examiners should encourage the board of directors to annually review and approve the policy followed and the exceptions allowed. It is important in such cases that adequate compensating controls be devised and strictly enforced. When it is determined, after thorough consideration of all relevant facts and circumstances, that the bank's vacation policies are deficient, the matter should be discussed with the chief executive officer or directors. Comments and recommendations on the supplemental Internal Routine and Controls schedule may be appropriate."

Check kiting is a fraud which requires daily maintenance. If locked out of internal access for two weeks, the risk of exposure would rise dramatically. Would need to involve a co-conspirator or achieve solvency before the mandated break (which I thought could be randomly assigned).

https://en.m.wikipedia.org/wiki/Check_kiting

Reply on news.ycombinator.com