Internal Controls for Nonprofit Organizations

We have all seen the headlines, but we all think, or at least hope, it would never happen here. The fact is that frauds at nonprofits do occur. This is troubling to management, the board, contributors, and to the accountants who audit these organizations.

A recent study by the American Institute of Certified Public Accountants summarized lawsuits against CPAs by the industry in which the CPA's client operated. Nonprofit organizations surprisingly ranked in the top three, only behind regulated industries (such as banks, thrifts and insurance companies) and the construction industry. The study suggests that the high number of lawsuits involving nonprofit organizations is due to two unique characteristics of nonprofits. Understanding what can be done about them is critical to minimize the risk of financial loss, negative publicity, and potential litigation.

Characteristics of Nonprofit Organizations Affecting Internal Controls
First, the revenues received by nonprofit organizations are often derived from voluntary contributions, grants and other nonreciprocal transfers (i.e., the donor receives no goods or services in return). It is more difficult to determine if these transactions are properly recorded than for reciprocal transactions (i.e., where consideration is received in return). For example, if internal controls are weak, it may be easy for an employee or even a volunteer, to remove an incoming check or cash contribution without recording it. Neither management nor the auditor would have a way to determine that all contributions have been recorded, and thus the theft would go undetected. The donor of the check will still have a canceled check and no one at the organization is the wiser.

The second characteristic that weakens the financial controls of nonprofit organizations is the deliberate choice of many organizations to operate with a smaller and often lower-paid administrative staff than a comparably sized profit-motivated business. This results in a lesser degree of segregation of duties and, because of lower pay, may provide the temptation to compromise one's values.

Procedures to Improve Internal Controls
What can be done to improve internal accounting controls and thus minimize the risk of financial loss and embarrassment? Following are six suggestions, which, in the absence of collusion, reduce the likelihood of misappropriation of assets or misstatements of the accounts, and if they have occurred, maximizes the likelihood of detection.

• Hire all Employees Personally and Perform Background Checks
  In most nonprofit organizations where there is limited segregation of duties, the screening of new hires is critical and should include questioning as to motives, background, past work history, references, etc. The integrity of the bookkeeper is of utmost importance to the organization. The screening process, including reference checks, should be done by a senior-level person.
• Collections Should be Under the Control of Two People Whenever Possible
  Prenumbered receipts should be issued for all monies received; however, this is often not practical when cash is collected through door-to-door solicitation, plate offerings or canisters placed in stores. To the extent that one person has access to or handles the money, there is the risk that money can be misappropriated. It is preferable that two people be involved. Additionally, checks should be restrictively endorsed at the time received and deposited daily. A viable alternative to this procedure is the direct deposit of mail to a bank lock box, which circumvents many of the cash receipts control problems.
• All Disbursements Should be Made by Check and Support for the Disbursement Kept on File
  This procedure ensures that there is a record of disbursements that makes it more difficult to fraudulently disburse funds. Also, authorized check signers should not have access to the accounting records. This prevents the possibility of someone misappropriating funds and then covering up the fraud by manipulating the accounting records. In addition, dual signatures should be required on all checks over a predetermined amount.
• Someone Other than the Person in Charge of the Record Keeping Function Should Receive the Unopened Bank Statements
  This function is especially critical for a small nonprofit organization because it removes the possibility of covering up a fraud by destroying forged checks and falsifying the reconciliation. If the size of the organization prevents a separate person from preparing the bank reconciliation, then at a minimum, the contents of the bank statement should be reviewed by a key executive or, in particularly small organizations, a board member before the account is reconciled. This not only provides a good after-the-fact control, but also provides the executive with a very good opportunity to understand the cash flow of the organization.
• Executives Should Personally Approve all Adjustments and Write-Offs of Assets
  This function prevents a bookkeeper from misappropriating accounts receivable or other assets and then covering up the theft by writing off the receivable or asset.
• Current Period Financial Results Should be Compared to Budgeted Amounts and Actual Results from Prior Periods
  Analyzing the current period financial results is one of the most effective controls for reducing the risk of misappropriation of funds. Comparing actual results to budgeted figures and to prior years will highlight deviations, permit a detailed follow-up of questioned amounts, and reduce the likelihood of a large misappropriation occurring. This analysis should be performed not only by management but also include the involvement and review by the board's financial committee.

This discussion of internal controls is not all-inclusive, but rather acts as a reminder of some of the basic controls that should be considered. Establishing an effective system for your organization requires knowledge of the particular organization. However, these suggestions should be carefully considered as the starting point for establishing an appropriate system.

Contact the Not-for-Profit Services Group of Alpern Rosenthal at (412)281-2501 for more information about setting up internal controls in your Organization. Back