Vonya Global

Priest “Father Short Story” exploits deficient internal controls to embezzle from his faithful parishioners.

I did a bit more investigating this case, and found the church doesn’t employ a Treasurer, but they do have a Business Manager. And it has been the same Business Manager, who partly functions as a Treasurer, for the past 11 years. The Business Manager was not mentioned in the article, but she certainly bears some responsibility for not fulfilling her fiduciary duties.

Check out the article and determine for yourself. Here are 3 internal control areas where I think they failed:
1. Lack of independent review of credit card activity
Large personal expenditures, international travel, retail purchases, and cash withdrawals should have been identified through routine transaction reviews and supporting documentation requirements.
2. Weak documentation and expense accountability
Reports indicate that many expenditures lacked supporting records, making it difficult to determine whether charges were legitimate. Missing documentation should be treated as a control exception, not an administrative inconvenience.
3. Excessive authority concentrated in a trusted individual
Many long-term fraud schemes occur when organizations rely on trust rather than oversight. Strong governance requires independent review regardless of position, tenure, or reputation.

This serves as another lesson in “Could this happen to us?”

Trust is important. Verification is essential.

Priest allegedly embezzled $160K from church for cruises, casino Priest "Father Short Story" busted

Hey retailers, here is an upcoming webinar you may be interested in. Merchants across industries face ongoing challenges with PCI DSS compliance due to complex payment environments, multiple payment channels and reliance on third‑party service providers. Confusion around SAQs, qualifying criteria and shared responsibility often leads to misunderstood scope and misplaced compliance efforts.

This webinar will help cut through the noise by breaking down what “scope reduction” really means, and when it does (and does not) apply.

FREE WEBINAR June 16 : Cut the scope, not the corners: Merchant-friendly PCI DSS scope reduction PCI DSS Scope Reduction Webinar