Overnight Reconciliation Fraud: Controls for a Clean Close

An overnight reconciliation can look like a firm control. In practice, it creates a window where entries post, match, and close while no one is watching. A reported theft at a credit union highlighted that risk. The bookkeeping lesson is not the amount stolen. It is that reconciliation is a procedure, and every automated step still needs evidence and a skeptical second look.

The weak point in an overnight reconciliation

Most manual closes rely on a person comparing a bank statement to the ledger. An overnight process runs a system comparison instead, often against rules or tolerances. If a transaction posts just before the cutoff, the reconciliation can include it without a human ever seeing the entry. The ledger looks balanced because the debit and credit are both present. What may be missing is the source document, the approval, or the correct period.

The cut-off risk in a simple example

Suppose a small credit union sweeps a clearing account each night at 10:00 p.m. A transaction posts at 9:55 p.m. from a member deposit to a suspense account. The debit and credit balance, so the automated reconciliation passes. The next morning, the bank item is not in the statement because the bank's processing window had already closed. The bookkeeper sees a zero balance in the clearing account and assumes the close is clean. The real result is a reconciling item that has been pushed into the next period.

Questions to ask before trusting an automated match

Ask four questions before you accept a clean automated match:

• Is the cutoff enforced by the system, or only by policy?
• Can the person who posts an entry also approve the reconciliation?
• Are reconciling items aged and reviewed by someone independent?
• Does the system auto-accept small differences, and is that threshold written down?

A no to any of them is not proof of fraud. It is a control gap that deserves a test.

Separating fraud from an ordinary posting mistake

An ordinary posting mistake tends to be isolated. It may hit the wrong account, use an odd amount, or appear once and then get corrected by the person who made it. Fraud tends to repeat near close, avoid attention, and clear through suspense or clearing accounts. Fraud also favors small amounts just under an approval threshold, dormant accounts, and periods when reviewers are away. One suspicious item is not proof. Repeating patterns are a reason to stop and test.

Evidence to preserve before anyone touches the file

Once you suspect the reconciliation has been abused, do not correct it first. Preserve the evidence as it sits. Export the ledger, the reconciliation report, the exception log, the audit trail, and the bank statement. Save user access records and any approval workflow. Keep a copy outside the live system. If access is controlled, restrict new edits but do not delete anything. The accounting treatment for an out-of-period entry is normally a reversing or restating entry, but you should not post that until the facts are secure.

The point at which it stops being bookkeeping

Bookkeeping can test the entries, explain the reconciling items, and prepare the correction once the facts are known. It cannot investigate a system compromise, recover hidden scripted entries, or reconstruct a corrupted audit trail. If you find altered data, compromised credentials, or entries that appeared without a user session, stop the close and bring in a forensic accountant or a digital forensics specialist. Do not attempt the repair yourself. The goal at that point is to preserve evidence and protect the opening balances for the next clean close.