How to Strengthen Not-for-Profit Internal Controls

Many not-for-profit financial policies exist in one of two states: written down and formally approved, or informal practice that staff simply know by habit.

That distinction matters more than many organizations realize. Strong financial policies and internal controls help not-for-profits safeguard resources, reduce the risk of error or misuse, meet compliance expectations, and build trust with boards, donors, funders, and other stakeholders. The organizations with the strongest controls are not always the largest. More often, they are the organizations that have taken the time to document and consistently follow their processes.

Moving from informal practice to a written, board-approved framework isn't about mastering a technical standard. It comes down to working through a handful of practical steps, in a sensible order, that would hold up if an auditor, funder, regulator, or board member ever looked closely.

A good starting point is taking stock of what's already written down versus what's simply understood informally. Common gaps tend to cluster in the same few areas: reimbursements, spending approvals, segregation of duties, and record retention.

It also helps to map major transaction cycles, such as cash receipts, purchasing, and payroll, and identify who initiates, authorizes, processes, and records each transaction. Those four responsibilities create a useful framework for evaluating internal controls. When one person performs every step of the process, risk naturally increases. Full segregation isn't always realistic for smaller organizations, but recognizing where responsibilities overlap is an important first step toward managing that risk.

Reimbursement policies are a common place for gaps to form, and the gaps are rarely dramatic. A policy might require approval without defining which expenses are eligible. It may require a receipt without requiring a stated business purpose, leaving a reviewer with a dollar amount and little else to evaluate.

Submission windows are another frequent omission. Without a defined deadline, such as 30 days, stale requests accumulate and become harder to verify.

Approval authority is where policies often become quietly inconsistent. Requests may be approved by individuals who never review the supporting documentation, or executive-level expenses may follow a different process than everyone else's.

Approval thresholds tend to present a different challenge. Many organizations adopt limits borrowed from templates or peer organizations and never revisit them. A $500 threshold may be reasonable for a $300,000 budget but impractical for a $10 million organization. Even well-designed thresholds can become outdated as budgets grow, which is why reviewing them annually is a worthwhile habit.

Credit cards deserve the same level of attention. Assigned spending limits, receipts for every charge, monthly reconciliations, and independent review by someone other than the cardholder all help strengthen accountability.

A written records retention schedule that reflects applicable federal and state requirements helps ensure documentation remains available when questions arise. Without one, organizations often find themselves reconstructing information long after the fact.

Restricted grants frequently require an additional layer of documentation. Expenses should be clearly connected to grant agreements and funder requirements, not just recorded in the general ledger.

Monitoring is another area where organizations can unintentionally fall behind. Bank reconciliations, budget-to-actual reviews, and other oversight procedures are most effective when performed on a consistent schedule rather than whenever time permits.

Policies carry more weight when they are formally approved by the board and reviewed periodically to ensure they remain relevant as the organization grows.

Electronic systems deserve the same attention that paper-based controls historically received. That includes multifactor authentication for banking platforms, dual approval for ACH and wire payments, documented procedures for verifying changes to vendor banking information, and prompt removal of system access when employees or volunteers leave the organization.

None of these improvements need to happen all at once. In many cases, identifying a single gap and addressing it before the next board meeting is more realistic, and more valuable, than attempting a complete overhaul overnight.

CSH's Not-for-Profit practice works with tax-exempt organizations year-round to strengthen financial policies, internal controls, and financial oversight processes. Whether reviewing existing policies or helping develop new ones, our team helps organizations build practical control environments that support both compliance and effective stewardship.

For a step-by-step guide to implementing the concepts discussed above, download our companion checklist, which walks through eight key areas, from inventorying existing policies and evaluating segregation of duties to monitoring financial activity and reviewing electronic system access.

Have questions about where your organization's policies stand today? Let's talk about what a review would look like.