the say-so of one officer. Often, that officer could make loans of as much as one hundred thousand dollars. Say you're a bank officer and I'm your college buddy. I come in and beg you that I'm desperate and need this loan. You say, "Okay, but I want something for myself." So I give you a ten-thousand-dollar kickback and probably default on the loan. There's a reason a committee now approves loans in banks. The same thing must happen in all businesses with all transactions.
I've spoken about how vulnerable companies are through their mailroom. It goes without saying that mailroom personnel must have absolutely clean backgrounds. And you need to put in internal safeguards to discourage theft of incoming or outgoing checks. So many companies that have been the victim of an altered payee-check scam have traced the source of the original checks to their own mailroom.
One important step is to replace your company name and address on disbursement envelopes with a simple post office box number. This box should be solely for returned checks. And you've got to segregate the processing of returned checks. Any checks that get returned should not be returned to the area that originally processed them. A person independent of the payment function should handle these and investigate why they were returned.
CHECK CHECKING
Company checks should be made secure by using some of the techniques I mentioned in the chapter on checks. All checks and cash equivalents, whether they're preprinted or entirely blank, should be stored in a locked facility and only those employees who truly need access should have it. A physical inventory should be conducted at least once a quarter to account for every check. Zero amount checks and checks that have been canceled or voided should immediately be written or stamped "void" or "canceled" so they're unusable. All canceled or voided checks that have a signature on them should have the signature removed. And someone other than the accounts payable processor who handled the original transaction should be responsible for accounting for all voided or canceled checks. Too often, checks that are to be canceled or voided are left lying in someone's in-box, even though they're still "live" checks. Employees aren't dumb. They know that a replacement check was issued for the canceled or voided check, and so the canceled check won't be missed if they take it.
An accounts payable department of a city office out West had the bad habit of throwing away any checks that had been crumpled by the printer. The checks weren't voided. A member of the cleaning crew had his own habit, which was to rescue those checks from the trash, forge signatures, and cash them for increasingly large sums of money. The thefts weren't discovered until the account was overdrawn and more than $1 million was gone. The city, it was discovered, hadn't reconciled its accounts in more than a year.
All obsolete check stock should be shredded as soon as possible. Often, when bank accounts are closed or when highly secure check stock replaces old checks, boxes of the old checks are left unattended outside the locked cabinet where the new checks are stored. Some companies even store old checks on a pallet in a warehouse. Their rationale is that there's no need to worry about checks drawn on an account that has been closed. Checks are checks. Even though an account has been closed, someone could steal the old checks and pass them on to an unsuspecting third party. And guess what? The company would be considered negligent and be held responsible for the loss.
I tell every company I visit, make sure you empty the laser printer tray of checks and return them to the locked storage area after every check run. All too frequently, unused checks from the last check run are left in the printer tray. Anyone could find them and use them. And change keys or entry codes periodically to prevent unauthorized access to all of your secure areas.
There was an apparel maker in the Northwest that lost a lot of money from forged company checks that an employee had stolen. The company was puzzled. It thought it had really tight controls. An audit firm was brought in and traced the problem to a handful of blank checks left lying on the printer.
SEND US A POSTCARD!
And don't forget this one: make people take vacations, especially the ones who handle your money and financial records. Every employee has to be out of the office