UNIVERSITAS INDONESIA

CASE STUDY 4
THE GREATER PROVIDENCE DEPOSIT AND TRUST EMBEZZLEMENT
SISTEM INFORMASI DAN PENGENDALIAN INTERNAL
Chitarani Kartika!"i # $4%&'(4&)(
D!*i S+*anti # $4%&'(4&,'
Karina A-+ Ditriani # $4%&'(4.$/
FAKULTAS EKONOMI
PROGRAM MAKSI#PPAK
OKTOBER (%$4
1
CHAPTER I
INTRODUCTION
Nino Moscardi, president of Greater Providence Deposit & Trust (GPD&T), received an
anonymous note in his mail stating that a ban employee !as maing bogus loans" Moscardi
ased the ban#s internal auditors to investigate the transactions detailed in the note" The
investigation led to $ames Guisti, manager of a North Providence branch office and a trusted %&'
year employee !ho had once !ored as one of the ban#s internal auditors" Guisti !as charged
!ith embe((ling )%"*+ million from the ban using ,- phony loans taen out over a three'year
period"
.ourt documents revealed that the bogus loans !ere /0'day notes re1uiring no collateral and
ranging in amount from )%0,000 to ),+,200" Guisti originated the loans3 !hen each one matured,
he !ould tae out a ne! loan, or re!rite the old one, to pay the principal and interest due" 4ome
loans had been re!ritten five or si5 times"
The ,- loans !ere taen out by Guisti in five names, including his !ife#s maiden name, his
father#s name, and the names of t!o friends" These people denied receiving stolen funds or
no!ing anything about the embe((lement" The fifth name !as $ames 6anesse, !ho police said
did not e5ist" The 4ocial 4ecurity number on 6anesse#s loan application !as issued to a female,
and the phone number belonged to a North Providence auto dealer"
7ucy 8raioli, a customer service representative !ho cosigned the checs, said Guisti !as her
supervisor and she thought nothing !as !rong !ith the checs, though she did not no! any of
the people" Marcia Perfetto, head teller, told police she cashed checs for Guisti made out to four
of the five persons" 9sed !hether she gave the money to Guisti !hen he gave her checs to
cash, she ans!ered, :Not all of the time,; though she could not recall ever having given the
money directly to any of the four, !hom she did not no!"
Guisti !as authori(ed to mae consumer loans up to a certain dollar limit !ithout loan
committee approvals, !hich is a standard industry practice" Guisti#s original lending limit !as
)%0,000, the amount of his first fraudulent loan" The dollar limit !as later increased to )%2,000
and then increased again to )<2,000" 4ome of the loans, including the one for ),+,200, far
e5ceeded his lending limit" =n addition, all loan applications should have been accompanied by
the applicant#s credit history report, purchased from an independent credit rating firm" The loan
taen out in the fictitious name !ould not have had a credit report and should have been flagged
by a loan revie! cler at the ban#s head1uarters"
Ne!s reports raised 1uestions about !hy the fraud !as not detected earlier" 4tate regulators and
the ban#s internal auditors failed to detect the fraud" 4everal reasons !ere given for the failure
to find the fraud earlier" 8irst, in checing for bad loans, ban auditors do not e5amine all loans
and generally focus on loans much larger than the ones in 1uestion" 4econd, Greater Providence
had recently dropped its computer services arrangement !ith a local ban in favor of an out'of'
state ban" This changeover may have reduced the effectiveness of the ban#s control procedures"
2
Third, the ban#s loan revie! clers !ere rotated fre1uently, maing follo!'up on 1uestionable
loans more difficult"
Guisti !as a fre1uent gambler and used the embe((led money to pay gambling debts" The ban#s
losses totaled ),<&,000, !hich !as less than the )%"*+ million in bogus loans, because Guisti
used a portion of the borro!ed money to repay loans as they came due" The ban#s bonding
company covered the loss"
The ban e5perienced other adverse publicity prior to the fraud#s discovery" 8irst, the ban !as
fined )20,000 after pleading guilty to failure to report cash transactions e5ceeding )%0,000,
!hich is a felony" 4econd, ban o!ners too the ban private after a lengthy public battle !ith
the 4tate 9ttorney General, !ho alleged that the ban inflated its assets and overestimated its
capital surplus to mae its balance sheet loo stronger" The ban denied this charge"
3
CHAPTER II
META#PERSPECTIVE OF CONTROL AND ACCOUNTING INFORMATION SYSTEM
.ontrol ob>ectives are the same regardless of the data processing method, but a computer'based
9=4 re1uires different internal control policies and procedures because?
@ .omputer processing may reduce clerical errors but increase riss of unauthori(ed access or
modification of data files
@ 4egregation of duties must be achieved differently in an 9=4
@ .omputers provide opportunities for enhancement of some internal controls
Internal control is the process implemented by the board of directors, management, and those
under their direction to provide reasonable assurance that the follo!ing control ob>ectives are
achieved?
@ 9ssets (including data) are safeguarded"
@ Aecords are maintained in sufficient detail to accurately and fairly reflect company assets"
@ 9ccurate and reliable information is provided"
@ There is reasonable assurance that financial reports are prepared in accordance !ith G99P"
@ Bperational efficiency is promoted and improved"
@ 9dherence to prescribed managerial policies is encouraged"
@ The organi(ation complies !ith applicable la!s and regulations"
=nternal controls perform three important functions, preventive controls, detective controls, and
corrective controls" 9 number of frame!ors have been developed to help companies develop
good internal control systems" Three of the most important are?
@ The .BC=T frame!or
.BC=T consolidates standards from +, different sources into a single frame!or" =t is
having a big impact on the =4 profession, such as ?
@ Delps managers to learn ho! to balance ris and control investment in an =4
environment"
@ Provides users !ith greater assurance that security and =T controls provided by
internal and third parties are ade1uate"
4
@ Guides auditors as they substantiate their opinions and provide advice to
management on internal controls"
@ .B4B#s =nternal .ontrol 8rame!or
The .ommittee of 4ponsoring Brgani(ations (.B4B) is a private sector group consisting
of The 9merican 9ccounting 9ssociation, The 9=.P9, The =nstitute of =nternal 9uditors,
The =nstitute of Management 9ccountants, and The 8inancial E5ecutives =nstitute" =n
%//<, .B4B issued the Internal Control Integrated Framework" .B4B#s internal
control model has five crucial components" They are control environment, control
activities, ris assessment, information and communication, and monitoring" The internal
control frame!or has been !idely adopted as the principal !ay to evaluate internal
controls as re1uired by 4BF" Do!ever, there are issues !ith it" =t has too narro! of a
focus and focusing on controls first has an inherent bias to!ard past problems and
concerns" Nine years after .B4B issued the preceding frame!or, it began investigating
ho! to effectively identify, assess, and manage ris so organi(ations could improve the
ris management process"
@ .B4B#s Enterprise Ais Management frame!or (EAM)
Taes a ris'based, rather than controls'based, approach to the organi(ation"
Briented to!ard future and constant change"
=ncorporates rather than replaces .B4B#s internal control frame!or and contains
three additional elements? 4etting ob>ectives, =dentifying positive and negative events
that may affect the company#s ability to implement strategy and achieve ob>ectives,
and Developing a response to assessed ris"
.B4B#s EAM consists of ?
%" =nternal Environment
The most critical component of the EAM and the internal control frame!or is the
foundation on !hich the other seven components rest" 9 deficient internal control
environment often results in ris management and control breado!ns"
<" Bb>ective 4etting
Top management, !ith board approval, must articulate !hy the company e5ists
and !hat it hopes to achieve" Gses the mission statement as a base from !hich to
set corporate ob>ectives"
5
+" Event =dentification
Management must do its best to anticipate all possible eventsHpositive or negative
Hthat might affect the company
&" Ais 9ssessment
2" Ais Aesponse
9ccountants assess and reduce inherent ris using the ris assessment and response
strategy
," .ontrol 9ctivities
Generally, control procedures fall into one of the follo!ing categories?
a" Proper authori(ation of transactions and activities
b" 4egregation of duties
c" Pro>ect development and ac1uisition controls
d" .hange management controls
e" Design and use of documents and records
f" 4afeguard assets, records, and data
g" =ndependent checs on performance
-" =nformation and .ommunication
The primary purpose of the 9=4 is to gather, record, process, store, summari(e, and
communicate information about an organi(ation"
*" Monitoring
Monitoring can be accomplished !ith a series of ongoing events or by separate
evaluations"
6
7
CHAPTER III
PROBLEM CASE
0+!*ti1n*2
%" Do! did Guisti commit the fraud, conceal it, and convert the fraudulent actions to
personal gainI
<" Good internal controls re1uire that the custody, recording, and authori(ation functions be
separated" E5plain !hich of those functions Guisti had and ho! the failure to segregate
them facilitated the fraud"
+" =dentify the preventive, detective, and corrective controls at GPD&T and discuss !hether
they !ere effective"
&" E5plain the pressures, opportunities, and rationali(ations that !ere present in the Guisti
fraud"
2" Discuss ho! Greater Providence Deposit & Trust might improve its control procedures
over the disbursement of loan funds to minimi(e the ris of this type of fraud" =n !hat
!ay does this case indicate a lac of proper segregation of dutiesI
," Discuss ho! Greater Providence might improve its loan revie! procedures at ban
head1uarters to minimi(e its fraud ris" Jas it a good idea to rotate the assignments of
loan revie! clersI Jhy or !hy notI
-" Discuss !hether Greater Providence#s auditors should have been able to detect this fraud"
*" 9re there any indications that the internal environment at Greater Providence may have
been deficientI =f so, ho! could it have contributed to this embe((lementI
An*"!r 31r 0+!*ti1n $
$ames Guisti, a trusted %&'year employee and manager of a Greater Providence Deposit & Trust#
branch office, !as authori(ed to mae consumer loans up to a certain dollar limit !ithout loan
committee approvals" De used this authority to create ,- fraudulent /0'day notes re1uiring no
collateral" 9s the scheme progressed, he !as able to bypass the loan committee approval as
some of his loans e5ceed his loan limit" Guisti !as charged !ith embe((ling )%"*+ million from
the ban"
De made the loans out to five people? his !ife using her maiden name, his father, t!o friends,
and a non'e5istent person" To avoid detection, he made sure the loans !ere performing and that
they !ere never e5amined for non'payment" That is, !hen the loans matured, he !ould tae out
a ne! loan, or re!rite the old one, to pay the principal and interest due" De also ept the loans
small to avoid the attention of auditors, !ho e5amined loans much larger than those he !as
fraudulently originating"
8
De had a subordinate, customer service representative 7ucy 8raioli, cosign the checs" De then
had another subordinate, head teller Marcia Perfetto, cash the checs, and give him the money"
An*"!r 31r 0+!*ti1n (
Guisti !as authori(ed to mae consumer loans up to )%0,000 (later )%2,000 and then )<2,000)
!ithout loan committee approval" This authori(ation is standard industry practice" De used this
authority to create fraudulent loans" 9s the scheme progressed, he !as able to bypass loan
committee approval for loans that e5ceeded his loan limit" This is not standard industry practice
and represents a failure of ban internal controls"
Guisti !as able to commit the fraud because he !as able to obtain custody of the checs used to
e5tend the loans" De used his position as branch manager to get his subordinates to cosign the
checs and cash them"
Nothing in the case !rite'up indicates that Guisti had any recording responsibilities" =t appears
that he used the ban#s normal recording processes? the ban recorded the loans !hen created
and the payments !ere appropriately recorded !hen Guisti repaid them
An*"!r 31r 0+!*ti1n /
9ll ban loans e5ceeding Guist#s limit ()%0,000, then )%2,000 and then )<2,000) !ere supposed
to be approved by a loan committee" This control !as not enforced or !as not effective as Guisti
!as able to bypass it" GPD&T segregated the functions of loan origination, authori(ation (a co'
signer needed on loans), and custody of cash (tellers)" Guisti used his position of branch
manager to override the controls over co'signatures and chec cashing"
7oan applications !ere to be accompanied by the applicant#s credit history report, purchased
from an independent credit rating firm" The loan taen out in the fictitious name did not have
that credit report and it should have been flagged by a loan revie! cler at the ban#s
head1uarters" This control !as not enforced or !as not effective as Guisti !as able to bypass it"
Greater Providence dropped its computer services arrangement !ith a local ban in favor of an
out'of'state ban" This may have reduced the effectiveness of the ban#s control procedures"
4tate regulators and the ban#s internal auditors failed to detect the fraud" Can auditors do not
e5amine all loans and focus on much larger loans than Guisti#s" The ban#s loan revie! clers
!ere rotated fre1uently, maing follo!'up on 1uestionable loans more difficult" The ban
bonded (an insurance policy on an employee#s honesty) its employees" Jhen the ban !as
defrauded, the ban#s bonding company covered the loss" This control !as effective in restoring
the financial losses the ban e5perienced"
9
An*"!r 31r 0+!*ti1n 4
Guisti !as a fre1uent gambler and needed the money to pay gambling debts"
9s the Cranch Manager, Guisti could override some internal controls and unduly influence his
subordinates not to comply !ith others"
No information is given on ho! or !hy Guisti rationali(ed his fraud
An*"!r 31r 0+!*ti1n '
7oan funds should generally not be disbursed in cash" Cetter control !ould be established by
depositing the funds in a checing account in the borro!erKs name or by issuing a ban chec to
the borro!er" Jhen cashing such a chec, ban personnel should re1uire identification
containing the borro!erKs photograph, and the borro!erKs signature on the chec, and should scan
both the photograph and the signature to verify the borro!erKs identity" =n no case should one
ban employee disburse cash to another for a loan to a third party borro!er !ithout first
verifying the e5istence and identity of the borro!er" .ustomer service representatives generally
should not co'sign checs to borro!ers !ithout first verifying their e5istence"
An*"!r 31r 0+!*ti1n &
9 system should be in place at the banKs head1uarters to maintain data on all outstanding ban
loans" This system should flag all loans that have been made in e5cess of the loan officerKs
lending limit" The authenticity of these loans should be scrutini(ed by internal auditors or other
ban officials independent of the loan officer"
Disciplinary action should be taen !hen a loan officer e5tends a loan that is greater than his
loan limit" 9pproved loans for !hich there is no credit report should be flagged and scrutini(ed"
Can head1uarters could send a letter to each ne! borro!er thaning them for their business"
=ndividuals !hose names had been used on loan documents !ithout their permission !ould be
liely to 1uestion !hy they had received such a letter, !hile letters mailed to fictitious borro!ers
!ould be returned as undeliverable" Either event should trigger an investigation"
Aotating the assignments of loan revie! clers may have made it more difficult for the ban to
detect this fraud" 9fter it discovered the embe((lement, Greater Providence changed its policy to
re1uire its loan revie! clers to trac a problem loan until it is resolved"
An*"!r 31r 0+!*ti1n .
9udits are not guaranteed to detect fraud" =t is too costly for auditors to e5amine every loan, so
they generally e5amine a systematically selected sample" =t maes sense for auditors to focus on
10
larger loans, since that is !here the greatest e5posure is" The case notes that Guisti !as a former
auditor" Therefore, he !ould have been very familiar !ith the banKs control system and its audit
procedures" De undoubtedly made use of this no!ledge in planning and carrying out his
embe((lement scheme"
Bn the other hand, since the banKs central records !ere computeri(ed, it should have been a
simple matter for auditors to find and e5amine every outstanding loan record !ith 1uestionable
characteristics, such as?
7oan amounts in e5cess of the loan officerKs lending limit
4hort'term loans that had been re!ritten several times"
=f auditors had any indication that Guisti !as heavily involved in gambling activities, they
should have e5amined his accounts very carefully" Do!ever, the case gives no indication that
the auditors !ere ever a!are of GuistiKs penchant for gambling"
An*"!r 31r 0+!*ti1n )
There are three indications of potential deficiencies in the banKs control environment"
@ .ontrols may have been deficient during the computer services changeover" Do!ever, the
fraud too place over a three'year period, and any problems relating to the computer
changeover should have taen much less than three years to resolve"
@ The ban pled guilty to a felony three years prior to discovery of the fraud, !hich !as
about the time the fraud began"
@ The stateKs charges of an inflated balance sheet suggest the possibility that the integrity of
the banKs management may be fla!ed, though there is certainly no proof of this"
Jhile one indicator of a deficient internal environment may be tolerable, three begins to loo
lie a pattern" Deficiencies in the banKs internal environment certainly could have contributed
to the embe((lement by enhancing the opportunity for fraud and by fostering an attitude that
dishonest behavior is someho! acceptable"
11