Internal controls for a nonprofit of any size
Updated 16 October 2026
Internal controls are the rules that decide who may spend money, who approves it, who records it and who checks the records. In a nonprofit they protect the staff, the board and the mission from a single error or a single dishonest act. They also carry out the board's fiduciary duty to donors, to the people the organization serves and to the public. This page lists the controls every nonprofit needs, how a small team covers them, and what an audit reviews. The worked examples use round figures as an illustration.
Why controls carry extra weight at a nonprofit
A company's controls protect its owners and shareholders. A nonprofit's controls protect money that donors gave for a purpose. A control failure at a small nonprofit can close the organization, damage its name for years, or lead to an investigation by the state Attorney General. The risk is concrete, and the controls are required.
A bookkeeper at a small nonprofit enters bills, prints checks and reconciles the bank account. Over 18 months, the bookkeeper writes 24 checks of $1,500 each to a vendor account they control, $36,000 in all. No second person sees the bank statement, so nothing flags the checks. A treasurer reading the statement each month would have seen the first one. The figures are an illustration.
The controls every nonprofit needs
- Divided duties. No single person starts, approves and records the same transaction. In a small office, the board treasurer or another board member can act as the third person.
- Approval limits. A written policy says who may approve which amounts. Checks above a set amount need two signatures or two approvals. The limit might be $1,000, $5,000 or $10,000, depending on the organization's size.
- Independent bank reconciliation. Someone other than the person who makes the entries reviews the reconciliation each month.
- A written expense policy. It says who may incur which expenses, with what approval and what receipts.
- Credit card rules. Card statements are reconciled each month with receipts attached, and someone other than the cardholder reviews the charges.
- Restricted fund tracking. Restricted gifts are recorded apart and spent only on their named purposes.
- A conflict of interest policy that board and staff review every year.
- Rules for keeping documents and for password security.
An organization pays 240 bills in a month. Under its policy, the 180 bills below $1,000 need one manager's approval. The 45 bills from $1,000 to $10,000 need the executive director. The 15 bills above $10,000 need the executive director and the treasurer. Two approvers see 15 of 240 payments, or 6.25% of the count, and those 15 carry the largest dollar amounts. The figures are an illustration.
When the team is too small to divide duties
A finance office of two people cannot divide every duty. The board fills the gap. The treasurer reviews the monthly bank statements directly. Two people approve every payment above a set amount. An audit committee asks questions, and an outside reviewer looks at unusual transactions. An outside accountant can run the monthly close. Controls that stand in for divided duties this way are called compensating controls, and they work.
An office manager enters bills and deposits. The executive director approves payments and signs checks. An outside controller reconciles the bank and card accounts each month. The treasurer receives the bank statement directly from the bank and reads it before the reconciliation arrives. Four people now touch each month's cash, and no one of them handles every step. The figures are an illustration.
Card and reimbursement records
Credit cards and staff reimbursements are where receipts go missing. The policy names who holds a card, what each card may buy and when receipts are due. The person who reconciles the card statement is someone other than the cardholder. Reimbursements need the same receipt and the same approval as any other payment.
An organization issues 3 cards, and each one carries about 40 charges a month. That is 120 receipts a month and 1,440 a year to match to statements. A monthly deadline for receipts keeps the review to 120 items at a time. A year-end search for 1,440 receipts would leave gaps the auditor would find. The figures are an illustration.
What an audit reviews
An annual audit reviews internal controls as a standard step. Audit findings at nonprofits often concern the same areas.
- Duties that are not divided, which is more frequent at smaller organizations.
- Bank reconciliations done by the same person who records transactions.
- Missing receipts or approvals for reimbursements and card purchases.
- Restricted funds that are not tracked apart from general funds.
- Board oversight that exists on paper and goes no further.
One finding alone seldom causes serious harm. Three or four findings together tell the board that its controls need more attention and resources.
An auditor finds that the bookkeeper both records deposits and reconciles the bank. The fix moves the reconciliation to an outside controller and adds the treasurer's monthly review of the statement. At the next audit, the auditor tests the 12 monthly reconciliations, sees a second preparer on each one, and the finding is closed. The figures are an illustration.
Checking that controls work
The audit catches some problems. A documented internal review once a year adds a second check. The treasurer or finance committee pulls a sample of transactions with the controller or fractional CFO and confirms that each one followed the policy. The policies themselves get a formal review every two to three years. They also get an informal review whenever the organization changes size, structure or risk.
An organization records about 600 payments a year, or 50 a month. The finance committee picks 25 of them across the year, about 4.2% of the total. For each one, it checks the approval, the receipt, the coding and, for grant spending, the restriction. Any payment that fails a check is traced back to the step that missed it. The figures are an illustration.
What this means for a nonprofit
No one person starts, approves and records the same payment. Approval limits are written down, and payments above the limit need two people. Someone outside the bookkeeping role reviews the bank reconciliation and the card charges each month. In a small office, the treasurer and outside staff provide the second and third sets of eyes. A sample review each year and a policy review every two to three years show whether the controls still work.
Controls built into the close
Averan Advisors runs reconciliations and reviews as part of each monthly close for nonprofits. See controller services for the close and controls, and systems for approval workflows in the accounting software.
Where to next
Want the books off your plate?
Book a short call, and we'll give you an expert view of your situation.
Free Consult →If you want this done for you
What happens next
Reading about it and having it done are different things. Here is exactly what happens if you want the second one.
- The call takes thirty minutesYou describe the business and where the numbers are letting you down. We give you an expert view of your situation, and what we would start with. There is no pitch deck.
- We look at the fileYou give us read access to the books as they are. We come back with what is wrong, what it will take to fix, and whether the answer is bookkeeping, controller work, or something else.
- We send a written scope and a priceIt lists what we do each month, what you get, the date it lands and the fee. We agree it before anything starts, and it does not change unless you agree.
- We take over the books and close the first monthWe set up access and systems and enter the opening balances. The first close lands on the date in the scope, and every one after it does too.