Nonprofit Internal Controls: A Practical Guide for Small Organizations

Why internal controls matter for nonprofits

Nonprofits are entrusted with other people’s money. Donors give to support a mission. Grantors award funds for specific programs. Board members accept fiduciary responsibility for organizational assets. Internal controls are the mechanisms that protect those assets and demonstrate to stakeholders that the trust is warranted.

The Association of Certified Fraud Examiners (ACFE) publishes data showing that small organizations — those under $100,000 in revenue — suffer disproportionately high median losses per fraud case. The typical scheme runs for 12 months before detection. The most common fraud vector at nonprofits is unauthorized disbursements, which is precisely what dual authorization and segregation of duties prevent.

Beyond fraud, controls reduce errors. Accidental miscodings, missed restriction tags, and unreconciled accounts create audit findings even when no fraud is involved. Good controls catch these errors before they become audit issues.

The five core controls

Segregation of duties. The person who approves a payment should not be the same person who processes it, and neither should be the same person who reconciles the bank account. This applies to check-writing, electronic payments, and petty cash.

Dual authorization. Any payment above your board-defined threshold requires two approvals. Define the threshold in writing. $2,500 is a common threshold for mid-size nonprofits; smaller organizations may set it lower.

Independent bank reconciliation. The monthly reconciliation must be performed by someone without transaction-processing authority, and reviewed and signed by a supervisor or board officer.

Restricted fund access. Accounting software should enforce role-based access — program staff can view their grant fund but cannot process transactions in other funds or the operating account.

Board financial review. The board or finance committee reviews monthly financial statements and approves any payments to executives. Annual review of the audit management letter is required.

Handling limited staff situations

A small organization with two finance staff cannot achieve full segregation across all duties. The compensating controls available:

• Assign bank reconciliation to a board treasurer or volunteer accountant
• Require board approval for all disbursements above $500
• Have the executive director review all transactions entered by the bookkeeper before month-end close
• Use software with immutable audit trails — if a transaction is changed after posting, the system records who changed it, when, and what the original value was
• Conduct quarterly surprise reviews of a sample of transactions

Document these compensating controls in written policies. Auditors evaluate compensating controls explicitly. A well-documented compensating control is better than an undocumented gap.

What auditors look for

Auditors test controls in two steps: design effectiveness (does the policy say the right things?) and operating effectiveness (is the control actually being performed?). A policy that exists on paper but is not executed results in a finding.

Evidence of execution: signed bank reconciliations, dual-signature records on checks, board meeting minutes reflecting financial statement review, and software audit logs showing access restrictions were active.

How fund accounting software supports controls

Fund accounting software built for nonprofits includes role-based access controls that enforce fund restrictions structurally. Audit trails capture every transaction entry and modification. Period-end close prevents backdating transactions without explicit override authorization. These software controls directly address the most common control weaknesses auditors find in small nonprofit accounting environments.

DEFINITION

Segregation of duties

The internal control principle that distributes the steps of a financial transaction — authorization, recording, custody of assets, and reconciliation — among different individuals. Prevents a single person from both committing and concealing fraud. When limited staff makes full segregation impossible, compensating controls (board oversight, independent review, software audit trails) are required.

DEFINITION

Dual authorization

A disbursement control requiring two independent approvals before a payment is made. For checks, this means two signatures. For electronic payments, two approvals in the payment system. The threshold above which dual authorization is required should be defined in written policy and approved by the board.

DEFINITION

Bank reconciliation

The monthly process of comparing the organization's general ledger cash balance to the bank statement balance, identifying and explaining all differences. The reconciliation must be performed by someone other than the person who processes payments, and the completed reconciliation should be reviewed and signed by a supervisor or board officer.

DEFINITION

Material weakness

An auditor-identified deficiency in internal controls that creates a reasonable possibility that a material misstatement of the financial statements will not be prevented or detected. A material weakness finding in an audit report is serious — it can jeopardize grant renewals, trigger grantor investigations, and increase the next year's audit fee. Repeated material weakness findings can trigger regulatory attention.