The Ins and Outs of Internal Controls for Nonprofits

For any board of directors, internal controls for nonprofits prevent nightmares like waking up to discover missing money from the organization’s bank account or a rash of phone calls from vendors alleging they never got paid. Internal controls are a set of written policies and financial practices that help prevent people within an organization from misusing or misappropriating assets.

Nonprofits are just as prone to theft and embezzlement as corporations. Why not center your next board discussion around what could happen without the proper internal controls, how to write strong internal control policies, and how to conduct an internal investigation at the sign of a red flag?

Unfortunately, there’s no foolproof formula for preventing internal theft. What your board can do is set up appropriate internal controls to deter individuals from stealing from your nonprofit and reduce the potential for fraud.

What Are the Red Flags for Theft or Embezzlement?

One of the challenges that nonprofit boards face in addressing internal controls is learning more about what they should be looking for. It’s vital to consider questions like these:

• How would we know if money was missing in any capacity?
• What things indicate red flags for theft or embezzlement?
• Are our internal controls strong enough?
• What are some of the weaknesses of our nonprofit’s internal controls?
• How will we investigate allegations of theft or embezzlement?
• How will we communicate our standards and practices for internal controls throughout our organization?

In setting up strong internal controls, you have to consider the worst-case scenarios. To do that, you need to be aware of the signs that money could be missing.

Here’s what to look for:

• Financial documents are missing
• Calls from vendors stating they haven’t been paid when records show they were
• Cash keeps disappearing
• Profits are shrinking
• Strange transactions
• Odd issues with payments
• Unusual-looking checks

Factoring the Motivation Behind Nonprofit Theft and Embezzlement

People from all walks of life serve and work in nonprofits, and each person has their own ethical and moral compass. Everyone has their own way of managing money. When the motivation is right, even the most upstanding members of the community can be tempted to steal or “borrow” money from a nonprofit organization. Some fall prey to that temptation, especially when they don’t think they’ll get caught.

In your board’s role as overseers, be aware of some of the signs that someone within your nonprofit may be tempted to take funds for personal use including:

• Working long hours at the nonprofit or arriving at strange times
• Refusing to take time off or allowing others to fill their shoes
• Insisting on working alone
• Being unusually possessive about their work area, desks, and devices
• Experiencing financial distress
• Living above their means
• Showing signs of addiction
• Taking small steps in moving money around to test your internal controls for weaknesses
• Looking for ways to access restricted data or spaces

One or more of these signs doesn’t necessarily mean that you have a fraud situation on your hands. However, these signs in connection with signs of missing funds might be cause for an internal investigation.

Strengthening Internal Controls for Nonprofits

Internal controls serve as checks and balances to reduce the risks associated with financial mismanagement. Financial policies should clearly describe how to do things and who is responsible for them. Your board members should consider the following three principles as they discuss how to develop or strengthen your nonprofit’s internal controls:

1. Strong physical controls
2. Separation of duties
3. Transparency

Here are some suggestions of how to implement those principles:

• Require two signatures on checks (at least one should be a board officer)
• Lock doors to offices to prevent unauthorized entry
• Require advance approval for expenditures
• Require a different person to log in checks than the person who deposits them
• Requiring a different person to distribute checks than the one who prepares payroll
• Conduct periodic or surprise audits of the checking account
• Require cash to be stored in a locked drawer and make nightly deposits
• Create a policy that requires background checks for all who handle money
• Protect computers and financial programs with passwords
• Require two people to count cash

Prevention is the best medicine to prevent fraud. There’s always a chance that theft or embezzlement can occur, so your board should also be prepared on what to do if there’s an allegation of this type of crime.

Money Is Missing: What Do We Do Now?

Pursuing an allegation over missing funds is a sensitive issue. It can be hard to believe that anyone who’s invested in a nonprofit would steal from it. Yet, it happens. An investigation will be much easier on everyone when you’ve established a plan for conducting an investigation and you apply it consistently.

Here are lists of dos and don’ts for investigating fraud, theft, or embezzlement:

Do

• Ensue an investigation immediately. Compile the facts.
• Gather documents quickly.
• Set up a timeline for your investigation and set up interviews.
• Keep the investigation confidential to prevent the destruction of evidence.
• Make a list of everyone who had the access or opportunity to commit the fraudulent act.
• Look for the root cause of the fraud.
• Determine the amount of money that was taken.
• Take steps to recover the loss.
• Take preventative actions to prevent a similar situation from occurring.
• If allegations are proven, ask the individual(s) to resign, discontinue their employment, or discontinue their involvement with your nonprofit.
• Ask interviewees to sign written statements confirming their stories and record each interview.
• Analyze your findings and decide what action to take (including notifying police or other authorities).
• Write an official report of the investigation.

Don’t

• Automatically assume someone is guilty.
• Confront someone without getting all the facts.
• Discriminate for any reason regardless of the individual’s tenure, salary, position, race, or financial status.
• Conduct your investigation openly during work hours. You might need to do it during off-hours to avoid suspicions and keep the rumor mill at bay.
• Reveal too much while conducting interviews. Only reveal as much as you need to for the investigation.
• Coerce interviewees or ask leading questions.
• Be afraid to enlist the help of a forensic accountant or data expert.
• Be afraid to self-report the incident to the proper authorities.

Your board spent time and energy developing good financial policies, so use them consistently and don’t make any exceptions for anyone. Your BoardEffect board management system provides unlimited cloud storage for your internal control policies and other board documents. The platform also provides a secure space where your board or finance committee can collaborate on developing financial policies and a flowchart to show how money flows through your organization.

Internal controls for nonprofits stand as a deterrent for would-be criminals. By understanding the ins and outs of internal controls and having a secure platform to conduct your work, your board will worry less over problems with internal fraud.