Audit Observation DBP ATMs

An agency must consider and achieve as well the separate but interrelated general objectives of internal
control. That public office is a public trust demands that a higher set of general objectives be
established, a step beyond the internal control practices that prevail in private sector organizations.
Hence, internal control in the public sector must conform to five (5) general objectives:

a. Safeguard assets;
b. Check accuracy and reliability of accounting data;
c. Ensure economical, efficient and effective operations;
d. Comply with laws and regulations; and
e. Adhere to managerial policies.

In view of the first objective, we have identified a condition of the ATMs of DBP Dumaguete to be
inconsistent with the proper implementation thereof. The ATMs do not have very safe placement. They
are placed in a designated room from the inside of the bank premise accessible from the outside
through the two openings of the front outer wall, where such openings are too large for the ATM to fit,
thus, leaving a significant amount of space above the installed machines.

The aforementioned condition threatens the safety of the banks assets, specifically the cash in the
ATMs. It amounts to a large possibility of theft, robbery, or even worse forms of safety risks. The threats
could come in various forms such as the following:

a. Ram Raid - A ram raid is an attempt to remove an ATM, and its contents, from its location,
usually after battering through to the ATM with a motor vehicle. A ram raid involves an attempt
to rip the ATM out of its position and remove it from its premises with the intention of breaking
into the machine later to steal its cash. Ram raids often take place in the early hours of the
morning in areas where police response times might be slower than normal. This type of
incident invariably causes considerable damage to the premises and, often, to its contents.

b. ATM Burglary - An ATM burglary is when an ATM is broken into to steal its cash. The attack takes
place on site and may be a traditional safe breaking method or perhaps as violent as explosive
attack using gas or accelerants.

c. ATM Replenishment Attack - Where directly employed staff, merchant or CIT courier are
attacked by criminals in the process of replenishing or dealing with cassettes within the
machine. Attacks usually take place when the ATM safe is open to receive / remove cassettes, or
when staff are transporting moneys through unsecured areas. These attacks usually place
personnel under considerable duress or physical threat.

We have assessed that the issue presented is a clear violation of sound safety measure and risk
management. The bank ought to provide reasonable assurance that the machines are properly
safeguarded and securely positioned on the premises to minimize, if not totally eliminate attack
potentials that can lead to loss, destruction and other hazards.

For immediate action, we are recommending that the extra space where the ATMs are placed be sealed.

Prepared by:

Bacane, Kris Joshua

Buagas, Flor Reyna
Lawanan, Jason
Matugas, Angelo