Mary works in the Bursars Office. She receives a call one day from a student requesting information on a refund check that should have been mailed to her weeks ago. Mary, according to Bursars procedures, asks the student to verify her birth date and asks her what courses she is taking the current semester. The student provides information that matches the system data.

Mary determines that a refund check was issued two weeks ago. She looks up the mailing address and asks the student to verify this address. The two addresses do not match. The address the student provides was inactivated when a new address was entered. Upon further investigation, the address was not changed online by the student but by another department at UNM.

Mary sees a Red Flag. She informs the student she will look into the matter further and someone will call her back. Immediately she reports the Red Flag to her supervisor. Her supervisor looks into the matter and finds that the check was cashed but the signature on the copy of the canceled check does not match any other signatures on prior checks or other UNM documentation signed by the student. The supervisor also determines that the department that changed the student address does so remotely through phone calls. No verification documents are sent to the student once an address is changed.

What control(s) was/were not operating?

How would you update/enforce the controls to help prevent this from happening going forward?