Internal Fraud and Segregation of Duties

Why This Topic Matters for the CTP Exam

Treasury sits at the point where cash actually leaves the organization. Wires, ACH files, check runs, bank account openings, investment transactions and intercompany transfers all pass through treasury hands. That concentration of liquidity makes treasury the single most attractive target for employees who want to steal, and it is exactly why the AFP CTP exam tests internal fraud and segregation of duties (SoD) within the Financial Regulatory and Operational Risk domain. The exam expects you to recognize that operational risk is not only about systems failing or vendors defaulting; it is also about trusted insiders exploiting weak controls. Questions in this area are highly scenario driven. You will be given a description of who does what in a cash process and asked to spot the control weakness, identify the fraud that could result, or choose the best corrective action. Understanding the logic behind SoD, rather than memorizing lists, is what earns points.

What Internal Fraud Is

Internal fraud (sometimes called occupational fraud) is the intentional misuse of an organization's resources or assets by an employee, manager or executive for personal gain. Under the Basel operational risk framework, internal fraud is one of the seven formal operational loss event types, defined as losses from acts intended to defraud, misappropriate property or circumvent regulations or company policy that involve at least one internal party. The Association of Certified Fraud Examiners (ACFE) groups occupational fraud into three categories, and the CTP exam borrows that structure:

1. Asset misappropriation: the most common category (roughly 85 to 90 percent of cases) and the one most relevant to treasury. It includes cash theft, skimming (taking cash before it is recorded), larceny (taking cash after it is recorded), fraudulent disbursements such as billing schemes with fictitious vendors, check tampering, payroll ghost employees, expense reimbursement fraud, and unauthorized wire transfers.
2. Corruption: bribery, kickbacks from vendors or banks, conflicts of interest and extortion. For treasury, think of an employee steering bank business or investment purchases to a counterparty in exchange for personal benefit.
3. Financial statement fraud: the least frequent but most costly category, involving deliberate misstatement of results. Treasury can be implicated through fictitious cash balances, hidden debt, or misclassified investments.

Specific cash schemes the exam likes to name include lapping (applying one customer's payment to cover a previously stolen payment, then continually rolling the shortage forward), check kiting (exploiting float between two bank accounts to create artificial balances), check tampering (altering payee or amount, or forging signatures on blank check stock), and master file manipulation (adding a fake vendor or changing a legitimate vendor's bank account to the fraudster's own account).

The Fraud Triangle

Donald Cressey's fraud triangle explains why fraud happens and appears regularly on the exam. Three elements must usually coexist:

- Pressure (or incentive): a personal financial problem, addiction, lifestyle expectation, or unrealistic performance target.
- Opportunity: weak controls, excessive access, lack of supervision, or one person controlling an entire process end to end.
- Rationalization: the mental justification, such as feeling underpaid or intending to pay the money back.

The key exam insight is that opportunity is the only element the organization directly controls. Segregation of duties, access restrictions and independent review all attack opportunity. Ethics training and tone at the top address rationalization, and employee assistance programs can reduce pressure, but internal controls are aimed squarely at closing the opportunity gap.

What Segregation of Duties Is

Segregation of duties is the control principle that no single individual should be able to both commit and conceal an error or fraud. It is accomplished by dividing a transaction cycle so that different people perform four incompatible functions:

1. Authorization: approving the transaction (approving a payment, signing a contract, approving a new vendor).
2. Custody: physical or electronic control over the asset (holding check stock, having bank portal release rights, holding tokens or signing authority).
3. Recording: entering the transaction in the accounting records or treasury management system.
4. Reconciliation and review: comparing records to independent sources such as bank statements and investigating differences.

If one person controls two or more of these functions over the same asset, a fraud can be both executed and hidden. The classic example: an employee who prepares wire transfers and performs the bank reconciliation can send money to a personal account and then bury the item as a reconciling difference. Separating the two means the fraud would surface at reconciliation.

How It Works in Treasury Operations

Payments and disbursements. Best practice uses a three step model: one person initiates or creates the payment, a different person approves it, and in many organizations a third person or the system releases it to the bank. This is called dual control or dual authorization. Approval limits escalate with dollar amount. The person who sets up or changes vendor master data (especially bank account details) must not be able to initiate payments to that vendor. Callback verification to a known phone number is required for any change to payment instructions.

Bank account administration. Opening or closing bank accounts, adding signatories, and administering user rights on bank portals should require board or senior management authorization and should be handled by someone who is not a daily transaction user. The bank portal security administrator should not also be a payment approver. Periodic review of signatory lists and user entitlements catches terminated employees who still have access.

Cash receipts. The person opening mail and receiving checks should not post receivables. Lockbox services outsource receipt handling to the bank, which is itself a segregation control. Remote deposit capture should be performed by someone independent of accounts receivable posting.

Reconciliation. Bank reconciliations should be prepared by someone with no cash handling, payment initiation or recording responsibilities, performed promptly (daily for high volume accounts), and reviewed by a supervisor. Unexplained reconciling items that persist are a red flag for lapping or unauthorized transfers.

Investments and debt. The person executing trades should not confirm trades, record them or reconcile custodial statements. Confirmations should go directly to a party independent of the trader.

System access controls. In a treasury management system or ERP, SoD is enforced through role based access, workflow approvals, maker checker configuration, audit logs and periodic access recertification. The exam treats system enforced SoD as stronger than policy only SoD because it cannot be bypassed by a cooperative or careless colleague.

Compensating controls for small staffs. Many treasury departments have two or three people, making perfect SoD impossible. Compensating controls include active owner or senior management review of bank statements and payment reports, mandatory vacations and job rotation (frauds like lapping require the fraudster's constant presence), independent reconciliation performed by an outside accountant or a different department, surprise audits, bank fraud tools such as positive pay, payee positive pay, ACH debit blocks and filters, and low payment thresholds requiring executive approval. When an exam question describes a small organization, the correct answer is usually a compensating control rather than hiring more staff.

Supporting Framework and Regulation

The COSO Internal Control Integrated Framework is the reference model. Its five components are control environment, risk assessment, control activities, information and communication, and monitoring. Segregation of duties is a control activity. The Sarbanes Oxley Act of 2002, particularly Section 404, requires management of US public companies to assess and report on internal control over financial reporting, with auditor attestation, which made SoD documentation and testing a formal requirement. Section 302 requires CEO and CFO certification of controls. The exam may also reference the role of internal audit as an independent assurance function reporting to the audit committee, whistleblower hotlines (the most common way fraud is detected according to ACFE research), and a code of conduct supporting an ethical control environment.

Controls are classified as preventive (stop the fraud before it happens: SoD, dual authorization, access restrictions, positive pay) or detective (find it afterward: reconciliations, audits, exception reports, hotlines). Preventive controls are preferred, but detective controls are essential because no preventive control is perfect, especially against collusion. Note that collusion between two or more employees defeats segregation of duties, which is why management override and collusion are considered inherent limitations of any control system.

How to Approach Exam Questions on This Topic

Step 1: Map the roles. Read the scenario and tag each activity as authorization, custody, recording or reconciliation. Then look for one person holding two tags over the same asset or process.

Step 2: Name the risk. Ask what specific fraud that combination enables. Initiate plus reconcile enables hidden unauthorized transfers. Receive cash plus post receivables enables lapping. Vendor master access plus payment initiation enables fictitious vendor schemes. Custody of check stock plus signature authority enables check tampering.

Step 3: Choose the fix that breaks the conflict with the least disruption. The best answer reassigns one of the incompatible duties to an independent person, adds system enforced approval, or introduces a compensating control if staff is limited. Be wary of answers that add a control that does not actually separate the conflicting functions, such as merely documenting the procedure or increasing training.

Step 4: Watch for hierarchy traps. A supervisor approving their own transactions, or a treasurer who is both sole signatory and sole reconciler, is still a SoD failure regardless of seniority. Seniority does not substitute for independence.

Exam Tips: Answering Questions on Internal Fraud and Segregation of Duties

1. The phrase 'the same person' is your trigger. Whenever a scenario states that one individual performs two steps in a cash cycle, assume the question is testing SoD and look for the incompatible pair.

2. Memorize the four incompatible functions: authorization, custody, recording, reconciliation. Nearly every SoD question reduces to two of these overlapping.

3. Reconciliation must always be independent. If the preparer of the bank reconciliation also initiates, approves or records cash transactions, that is the weakness, and moving the reconciliation to an independent person is almost always the correct answer.

4. Fraud triangle questions focus on opportunity. If asked which element internal controls address, choose opportunity. If asked which element ethics programs and tone at the top address, choose rationalization.

5. Small company scenarios point to compensating controls. Owner review of bank statements, mandatory vacations, job rotation, outsourced reconciliation and positive pay are the expected answers, not adding headcount.

6. System enforced controls beat policy controls. When choices include both a written policy and a system configured dual approval workflow, the system control is the stronger answer.

7. Know the scheme vocabulary. Lapping involves receivables and requires the fraudster never to take time off. Kiting involves float between two bank accounts. Skimming is off book theft before recording; larceny is theft after recording. Fictitious vendors and bank account changes point to vendor master file controls and callback verification.

8. Collusion is the known limitation. If a question asks what SoD cannot prevent, the answer is collusion (and management override). Detective controls and hotlines are the response to that limitation.

9. Distinguish preventive from detective. SoD, dual authorization, access limits and positive pay prevent. Reconciliations, audits, variance analysis and hotlines detect. Tips and hotlines are the most frequent actual detection method.

10. Connect to regulation when asked. SOX 404 is internal control over financial reporting; SOX 302 is executive certification; COSO is the framework; internal fraud is a Basel operational risk event type.

11. Eliminate answers that do not separate duties. Options such as 'require the employee to sign an acknowledgment', 'increase training', or 'document the process' do not resolve a SoD conflict and are usually distractors.

12. Read for the best answer, not just a correct one. CTP questions often include two plausible controls; choose the one that directly removes the specific incompatibility described, and prefer the one that is independent, timely and automated.

Worked Example

Scenario: A treasury analyst sets up new vendors in the ERP, initiates ACH payments, and prepares the monthly bank reconciliation, which the controller reviews. Which change most effectively reduces internal fraud risk?

Analysis: The analyst holds recording (vendor master), initiation (effectively custody of payment release) and reconciliation. The exposure is a fictitious vendor scheme concealed through reconciliation. Controller review is a detective, after the fact control and is monthly, which is too slow. The most effective change removes the analyst from either vendor setup or reconciliation and adds dual approval on payment release. If the answer choices include 'assign vendor master maintenance and bank reconciliation to employees outside treasury and require a second approver for ACH release', that is the best answer. 'Have the controller review the reconciliation more carefully' is the distractor because it does not break the conflict.

Key Takeaway

Internal fraud thrives where one person can both do and hide. Segregation of duties, reinforced by system enforced approvals, independent reconciliation and compensating controls where staffing is thin, removes the opportunity leg of the fraud triangle. On the exam, identify the incompatible functions held by the same person, name the fraud it enables, and select the answer that restores independence between those functions.