A cash management policy for a nonprofit is the written document your board adopts to control how money comes in, how it gets approved for spending, who touches it along the way, and how the organization proves it later. A workable version covers eight areas: segregation of duties, authorization thresholds, physical cash handling, electronic payments and cards, expense reimbursement, bank reconciliation, record retention, and any extra rules that apply to federal grant funds. The policy itself can be short. What matters is that every way money moves through your organization is addressed somewhere in it.
The IRS encourages every 501(c)(3) to adopt governance and management policies covering financial oversight, among other areas.1Internal Revenue Service. Publication 4221-PC – Compliance Guide for 501(c)(3) Public Charities A cash management policy is how that oversight becomes enforceable rather than aspirational, and it is the document auditors, grantors, and regulators will ask to see first when something goes wrong.
Segregation of Duties
The single most important principle in the policy is that no one person controls a financial transaction from start to finish. Split three functions among different people: access to assets (handling cash, signing checks), accounting duties (recording entries, preparing deposits), and independent oversight (reviewing statements, approving reconciliations). When one person handles two or more of these phases, the risk of undetected errors or theft jumps sharply.
Write the separation into the policy by role, not by name, so the structure survives turnover.
When Staff Is Too Small to Separate Duties
Many nonprofits have fewer than three people handling finances. The workaround is board involvement. A treasurer or finance committee member can fill the oversight gap by reviewing monthly bank statements, approving large transactions, or co-signing checks above a threshold. The board member doesn’t need to do daily bookkeeping; the point is that a second set of eyes lands on the numbers before they are final. Even a volunteer who opens bank statements and scans them before passing them to the bookkeeper adds a meaningful control layer.
The policy should also connect to your conflict of interest policy. Anyone with authority over spending should complete an annual disclosure identifying personal financial interests that could overlap with organizational transactions. Form 990 asks whether officers and directors disclose potential conflicts annually and how the board monitors transactions where conflicts exist.2Internal Revenue Service. 2025 Instructions for Form 990 – Return of Organization Exempt From Income Tax If the executive director’s spouse runs a catering company and the nonprofit holds events, that relationship belongs on paper before the contract is signed.
Authorization Thresholds
The policy should set dollar limits that determine who can approve a payment and whether a second signature is required. Specific numbers depend on your budget, but the structure is typically tiered:
- Routine operational expenses under $500: a program director or department head approves, and a single authorized signer processes payment.
- Mid-range expenses from $500 to $5,000: the executive director reviews and approves before payment.
- Large expenditures over $5,000: two authorized signers are required on the check or electronic transfer, and the finance committee or board chair may need advance notification.
Tie signatory authority to job titles rather than individual names so the policy still works when a program director leaves. Keep a current board resolution on file with your bank listing who holds each authorized role; banks need these resolutions to verify that whoever is signing checks or initiating transfers actually has the authority to do so.
Set a threshold for contracts and recurring commitments, not just single payments. A $400-per-month subscription that nobody re-evaluates can quietly drain $4,800 a year without ever tripping a review if the policy only looks at individual transactions.
Cash and Receipt Handling
Cash is the hardest asset to track and the easiest to steal, so the policy should treat it differently from every other form of payment. Every physical currency and check payment should generate a pre-numbered receipt immediately on receipt. Sequential numbering creates an audit trail where a missing number is itself evidence that something went wrong.
Keep petty cash small. A cap between $100 and $300 is typical, with replenishment only after submitting receipts that account for every dollar spent. At fundraising events or anywhere staff collect cash, assign at least two people to accept and count the money together, with a third person handling the deposit. Log sheets should record every incoming amount before the funds leave the event site.
Require bank deposits within 24 to 48 hours of receiving funds. Until cash reaches the bank, it sits in a safe or lockbox earning nothing and insured by nothing.
FDIC Insurance Limits
Standard FDIC insurance covers $250,000 per depositor, per insured bank, per ownership category.3Federal Deposit Insurance Corporation. Deposit Insurance FAQs If the nonprofit holds more than $250,000 at a single institution, the excess is uninsured. Organizations with larger balances should spread deposits across multiple banks, use an FDIC sweep program through a brokerage account, or look into CDARS networks that distribute funds automatically. The policy should name who monitors aggregate deposit levels and what action to take when balances approach the ceiling.
Electronic Payments and Corporate Cards
Most nonprofit spending now flows electronically, and the policy needs to keep pace. ACH transfers, wire transfers, and corporate credit cards each carry risks that check-based controls don’t fully address.
For ACH payments and wire transfers above the threshold, require two authorized individuals to approve the transfer. Many banking platforms support this natively by requiring a second login to release queued payments. The person who enters the payment details should not be the person who releases the transfer.
Limit credit card issuance to employees who regularly incur business expenses, and require written supervisor approval before anyone receives a card. Each card should carry an individual spending limit based on the cardholder’s typical purchasing needs rather than a blanket organizational limit. Set a clear deadline for receipts and documentation after each purchase. Thirty days is a common standard. State in the policy that any charge lacking an itemized receipt and a written business purpose becomes the personal financial responsibility of the cardholder, including late fees and interest. This is also what keeps your reimbursements compliant with IRS accountable plan rules, which is what prevents them from being treated as taxable wages.4Internal Revenue Service. Nonresident Aliens and the Accountable Plan Rules
Expense Reimbursement Standards
Under the IRS accountable plan rules, expense reimbursements stay non-taxable only when three conditions are met: the expense has a clear business connection, the employee substantiates it with adequate documentation within a reasonable time, and any excess advance is returned.4Internal Revenue Service. Nonresident Aliens and the Accountable Plan Rules If any of those conditions fails, the reimbursement becomes taxable wages subject to withholding.
The policy should require original invoices or digital receipts for every disbursement and a description of the business purpose, not just the amount and vendor. For entertainment expenses, the IRS expects documentation of who attended, the business relationship, and the specific business discussion involved.5Internal Revenue Service. Revenue Ruling 2003-106 Spell out that missing documentation results in denial of reimbursement or reclassification as taxable income. That language gives the finance team authority to enforce the standard without negotiating case by case. Standardize the expense report format across departments so the finance team is reviewing, not translating.
Bank Reconciliation and Record Retention
Reconcile every bank account at least monthly. The policy should set a specific deadline, such as ten business days after the statement closing date. Whoever performs the reconciliation should not have signatory authority on the account being reconciled. This independent check is where you catch unauthorized transactions, bank errors, and duplicate payments. A board or finance committee member should then review and sign the completed reconciliation, verifying that the work was done and the ending balance matches the general ledger.
For retention, the IRS requires exempt organizations to keep records that support their annual returns and demonstrate compliance.6Internal Revenue Service. Recordkeeping Requirements for Exempt Organizations The general statute of limitations runs three years after a return is due or filed, whichever is later, so financial records supporting Form 990 should be kept at least that long. Employment tax records require at least four years. Some documents should be kept permanently: your application for tax-exempt status, your determination letter, articles of incorporation, bylaws, and board minutes.1Internal Revenue Service. Publication 4221-PC – Compliance Guide for 501(c)(3) Public Charities Many organizations default to a seven-year period for bank statements, invoices, and canceled checks, which gives a margin above the three-year minimum and covers late filings or fraud situations that extend the limitations period. Set specific retention periods by document type in the policy so staff aren’t guessing.
Federal Grant Cash Management
If the nonprofit receives federal funding, the policy must meet the Uniform Guidance. The core requirement is straightforward: minimize the time between receiving federal funds and spending them on program costs. Advance payments must be limited to the minimum amounts needed and timed to actual, immediate cash requirements for the program.7eCFR. 2 CFR 200.305 – Federal Payment The financial management system must also identify all federal awards received and expended, maintain records sufficient to trace the source and use of federal funds, and include written procedures for determining whether costs are allowable.8eCFR. 2 CFR 200.302 – Financial Management
In practice, add a section to the policy addressing how federal funds are tracked separately from general operating funds. Commingling federal grant money with unrestricted donations in a single account without clear accounting controls is one of the fastest ways to trigger audit findings. If your organization doesn’t take federal money, this section doesn’t apply and you can note that in the policy itself.
Operating Reserve
The policy should address how much cash the organization keeps on hand beyond immediate operating needs. A board-designated operating reserve is money the board sets aside internally for emergencies, cash flow gaps between grant payments, or unexpected expenses. Unlike donor-restricted funds, the board can redirect a board-designated reserve at any time because it remains legally unrestricted.
Most financial advisors suggest nonprofits maintain a reserve equal to three to six months of average operating expenses. Specify the target amount, where the funds are held, who authorizes a drawdown, and what triggers replenishment. Track reserve funds separately in the accounting system even though they aren’t legally restricted; the transparency reassures funders and auditors that the board is managing cash deliberately.
Why This Policy Protects the Organization and Its Leaders
Weak cash controls can create the conditions for excess benefit transactions that trigger federal excise taxes under IRC Section 4958. When a disqualified person (typically a board member, officer, or key employee with substantial influence over the organization) receives compensation or other benefits that exceed what is reasonable, the IRS treats that as an excess benefit transaction.9Office of the Law Revision Counsel. 26 USC 4958 – Taxes on Excess Benefit Transactions
The penalties land on the individuals, not the general fund. The disqualified person who received the excess benefit owes a tax equal to 25 percent of the excess amount, and if they don’t correct the transaction within the statutory period, an additional 200 percent applies. Organization managers who knowingly participate face a separate tax of 10 percent of the excess benefit, capped at $20,000 per transaction.9Office of the Law Revision Counsel. 26 USC 4958 – Taxes on Excess Benefit Transactions In extreme cases of private inurement, the IRS can revoke tax-exempt status entirely.10Internal Revenue Service. Exemption Requirements – 501(c)(3) Organizations A cash management policy reduces this exposure by requiring documented approval for executive compensation, enforcing spending limits that prevent insiders from directing resources to themselves, and creating the paper trail that proves transactions were reviewed at arm’s length.
Adopting and Updating the Policy
Before drafting, compile every bank and investment account the organization holds, including institution and current balance. Identify every person who handles cash, signs checks, accesses accounting software, or holds a corporate card. Pull the prior year’s budget so authorization thresholds don’t create bottlenecks for routine purchases. Update the organizational chart so oversight gets assigned to the right positions.
The treasurer or finance committee chair presents the draft to the full board at a scheduled meeting. Adopt the policy by formal vote and record the vote in the official meeting minutes. The approved policy should be signed by the board secretary and stored with permanent corporate records, which the IRS expects you to keep indefinitely.1Internal Revenue Service. Publication 4221-PC – Compliance Guide for 501(c)(3) Public Charities
Distribute the finalized policy through the employee handbook or a central shared drive, and have new hires acknowledge it during onboarding. Schedule an annual review tied to the fiscal year-end or the audit to update thresholds, signatory lists, account information, and any procedures that have drifted from what the policy says. A policy that was accurate three years ago but hasn’t been touched since is almost as risky as having none at all.