A lack of segregation of duties allowed the former CEO of the failed CBS Employees Federal Credit Union in Los Angeles to embezzle $40 million,
National Credit Union Administration examiners documented the issue within their risk assessments, but "failed to respond appropriately to the heightened risk," the regulator's IG wrote.
The NCUA Inspector General found that Edward Rostohar, the $21 million-asset institution’s former CEO, had exclusive access to physical and electronic records. Once he was removed, employees of the credit union struggled to produce basic reports since Rostohar prevented access to the accounting system to anyone besides himself.
Rostohar, a former NCUA examiner,
“One reason the former CEO was able to successfully hide the fraud from examiners is that he knew what to expect from the examination, because examination procedures and timing tended to be predictable from year to year,” the IG wrote.
Given the lack of segregation of duties, the fraud could have been detected earlier if examiners requested share subsidiaries or AIRES reports on a random date, according to the IG.
The Share Insurance Fund lost around $39.5 million as a result of the fraudulent activity, and NCUA liquidated CBS Employees FCU last year. Rostohar was sentenced to 14 years in federal prison.
The IG recommended that NCUA revise examination procedures to prioritize the creation of a risk response method for CUs that fail to segregate key duties that require dual controls.
“We believe that if examination procedures required examiners to perform additional procedures for credit unions that lack segregation of duties, and to incorporate an element of unpredictability into examination procedures, the likelihood of detecting fraud could increase,” the IG wrote.
NCUA officials agreed with the recommendation, noting the creation of a working group evaluating the Small Credit Union Examination Program. Officials said that they plan to incorporate any recommendations by the end of 2021.
