Internal Control Questionnaires and Verification Procedures
Cash Dispensing Machines
Is daily access to the automated teller machine (ATM) made under dual control?
When maintenance is being performed on a machine, with or without cash in it, is a representative of the bank required to be in attendance?
Are combinations and keys to the machines controlled (if so, indicate controls)?
Do the machines and the related system have built-in controls that:
Limit the amount of cash and number of times dispensed during a specified period (if so, indicate detail)?
Capture the card if the wrong PIN (Personal Identification Number) is consecutively used?
Does the machine automatically shut down after it experiences recurring errors?
Is lighting around the machine provided?
Does the machine capture cards of other banks or invalid cards?
If the machine is operated “off line,” does it have negative file capability for present and future needs which includes lists of lost, stolen, or other undesirable cards which should be captured?
Is usage of an ATM by an individual customer in excess of that customer’s past history indicated on a “suspicious activity” report to be checked out by bank management (three uses during the past 3 days as compared with a history of one use per month)?
Have safeguards been implemented at the ATM to prevent disclosure of a customer’s PIN during use by others observing the PIN pad?
Are “fish-proof” receptacles provided for customers to dispose of printed receipts, rather than insecure trashcans, etc.?
Does a communication interruption between an ATM and the central processing unit trigger the alarm system?
Are alarm devices connected to all automated teller machines?
For on-line operations, are all messages to and from the central processing unit and the ATM protected from tapping, message insertion, modification of message, or surveillance by message encryption (scrambling techniques)? (One recognized encryption formula is the National Bureau of Standards Algorithm.)
Are PINs mailed separately from cards?
Are bank personnel who have custody of cards prohibited from also having custody of PINs at any stage (issuance, verification, or reissuance)?
Are magnetic stripe cards encrypted (scrambled) using an adequate algorithm (formula) including a total message control?
Are encryption keys, i.e., scramble plugs, under dual control of personnel not associated with operations or card issuance?
Are captured cards under dual control of persons not associated with bank operation card issuance or PIN issuance?
Are blank plastics and magnetic stripe readers under dual control?
Are all cards issued with set expiration dates?
Are transaction journals provided that enable management to determine every transaction or attempted transaction at the ATM?
Previous: Cash on Hand
Next: Cash Items