Internal controls for a nonprofit are the written rules and daily habits that keep money, records, and access from concentrating in one person’s hands. A workable set covers five things: who can move money, how transactions get approved and documented, how cash and digital accounts are secured, how conflicts and complaints are handled, and how the organization meets its filing and record-keeping obligations. None of it requires expensive software. It requires the board to decide the rules, put them in writing, and check that staff follow them.
Split the Financial Duties
The most important control is that no single person can initiate, approve, and record the same transaction. When one employee writes a check, signs it, and reconciles the bank statement, nothing independent verifies what they did. Splitting those steps forces a second set of eyes onto every dollar.
In practice: the staff member who prepares a payment should not be the one authorized to sign it. Whoever opens the mail and logs incoming donation checks should not also enter deposits into the accounting software. The executive director might approve a purchase, the bookkeeper records it, and the treasurer or a board member reviews the bank statement. Each person sees only their piece, and together they produce a cross-verified record.
Two- and three-person nonprofits often assume this doesn’t apply to them. It does; the solution just looks different. A board member or trained volunteer can review the monthly bank statement before the bookkeeper sees it. Another volunteer can open the mail and create a log of incoming checks that is later compared to the deposit record. The point isn’t a corporate org chart. It’s making sure no one person can move or hide money without someone else noticing.
Approval Thresholds and a Real Paper Trail
Every transaction needs documentation a stranger could follow start to finish. That means purchase orders for procurement, original receipts for every reimbursement, and dual signatures on checks above a set dollar threshold. Many nonprofits set that threshold at $1,000 or $5,000, depending on budget size and risk tolerance. The board should also set escalating approval levels, including a ceiling above which full board authorization is required.
Bank statements should be reconciled monthly, and the person doing the reconciliation must not have check-signing authority. Reconciliation is the control that catches unauthorized withdrawals, duplicate payments, and data-entry mistakes early. When the same person signs checks and reconciles the account, the safety net is gone.
Keep chronological files of invoices, bank statements, and payroll records so any transaction can be traced from request to bank clearance. When grant funds are involved, keep documentation that ties every dollar to an authorized expense. Donors and grantors expect this level of detail, and producing it on short notice is only possible if the filing system is maintained year-round rather than reconstructed the month before an audit.
Cash, Credit Cards, and Physical Assets
Petty cash is small but carries outsized fraud risk because people treat it casually. Before setting one up, write a policy that specifies the maximum amount held, the types of expenses it covers, the largest allowed single disbursement, and how replenishment works. Assign one custodian who keeps the cash in a locked box, records each disbursement on a dated slip with the amount, recipient, reason, and receipt, and reconciles the fund to the general ledger monthly.
Credit cards need their own rules. Every cardholder should have a defined spending limit and know which purchases are authorized. Require original itemized receipts for every charge; for meals, require attendee names and business purpose. Cardholders reconcile their charges within a set window each month, and a supervisor who did not make the purchases reviews and signs off. A second review by an executive or board member of the full monthly statement adds another layer that catches personal charges, duplicate payments, and forgotten subscriptions.
Physical protections matter too. Undeposited checks belong in a locked, fireproof cabinet. Blank check stock should be secured and inventoried. Deposit incoming checks promptly rather than letting a stack accumulate in a desk drawer.
Digital Security and Wire Fraud
Most nonprofit money now moves electronically, and controls need to match. Require multi-factor authentication on every account that touches money: online banking, accounting software, payroll, and donor management. The Cybersecurity and Infrastructure Security Agency recommends starting with administrator accounts and employees who handle sensitive data, then expanding to all users. Physical security keys give the strongest protection against phishing. Authenticator apps with number matching are a solid second. Text-message codes are the weakest option and should be a last resort.
Wire transfers and ACH payments need dual authorization: one person initiates, a different person approves before funds leave the account. Whoever sets up new users in the banking system should not be able to initiate transactions, and management should periodically review access privileges to confirm the separation holds.
Business email compromise is one of the most common ways nonprofits lose money. A scammer impersonates a vendor or an executive and requests a wire transfer or a change in payment instructions. The FBI recommends verifying any change in account numbers or payment procedures by calling the person who supposedly made the request, using a phone number you look up independently rather than one supplied in the email. Build that callback into your written procedure so staff treat it as a routine step, not an optional one.
Conflict of Interest and Whistleblower Policies
The IRS asks every organization filing Form 990 whether it has a written conflict of interest policy and a written whistleblower policy. The questions sit in Part VI. A “no” doesn’t automatically trigger an audit, but it signals to regulators, donors, and watchdog groups that basic governance may be missing.
A conflict of interest arises when a board member’s or officer’s personal financial interests clash with the organization’s mission. Classic examples include voting on a contract with a business you own or participating in setting your own compensation. A working policy requires annual disclosure: every officer, director, and key employee lists their financial interests, business relationships, and other board memberships that could create a conflict. When a conflict surfaces, the affected person discloses the facts, leaves the discussion, and does not vote.
A whistleblower policy gives staff and volunteers a way to report suspected fraud, financial misconduct, or policy violations without fear of retaliation. An effective one names who receives reports, offers multiple channels including an anonymous option, spells out the investigation process, and prohibits retaliation against anyone who reports in good faith. Designate a specific administrator, typically an audit committee member or independent board member, to maintain records and report outcomes to the board.
One boundary worth naming: under 18 U.S.C. ยง 1519, destroying, altering, or falsifying records to obstruct a federal investigation is a federal crime, with penalties up to 20 years in prison. It applies to nonprofits. Your normal retention schedule does not override this; once a federal matter is on the horizon, records need to be preserved regardless of what your policy would otherwise allow.
Extra Rules If You Take Federal Grants
Federal funding adds a heavier layer of control requirements. Under the Uniform Guidance, any organization receiving a federal award must establish, document, and maintain internal controls that provide reasonable assurance of compliance with the award terms. Those controls should align with either the federal government’s Green Book standards or the COSO Internal Control framework.
The specifics get concrete fast. Your financial management system has to track every federal dollar separately, identifying the award by its Assistance Listings number, the federal agency, and the award year. You need to compare actual expenditures against the approved budget for each award and show that all costs charged are allowable under the award. Written procedures for determining cost allowability and for handling cash draws are required.
Time and Effort Tracking
Personnel costs charged to federal awards need source documentation. Employees who split time across multiple funding sources complete time-and-effort reports showing hours worked in each program each day, signed by both employee and supervisor. Employees working exclusively on a single federal award may complete a semiannual certification stating that all their time went to that award. Paid time off must be allocated proportionally across all the funding sources an employee works on. The requirements are in 2 CFR 200.430, and auditors check them closely.
Single Audit
Any nonprofit that spends $1,000,000 or more in federal awards in a fiscal year must undergo a Single Audit, which examines both financial statements and compliance with federal program requirements. It requires an auditor experienced in federal compliance work. Organizations spending less than $1,000,000 in federal funds are exempt from the Single Audit but still must maintain adequate records and controls.
Board Oversight and Required Filings
The board of directors carries ultimate fiduciary responsibility for the organization’s finances, and that responsibility is not ceremonial. A federal appeals court upheld a $2.25 million judgment against former directors of a bankrupt nonprofit who ignored red flags about management misconduct; the court found they failed to follow the organization’s own bylaws, did not attend meetings, and continued relying on officers whose incompetence was apparent. The business judgment rule did not shield them because they had not exercised reasonable diligence. Board members need to actually read and question the financial reports at every meeting. A separate audit or finance committee that meets between full board meetings adds another layer of scrutiny.
Form 990
Tax-exempt organizations must file Form 990 annually. Late filing carries a penalty of $20 per day, up to a maximum of $10,500 or 5% of gross receipts, whichever is smaller. Larger organizations with gross receipts above roughly $1 million face steeper daily penalties and higher maximums, adjusted annually for inflation. Failing to file for three consecutive years results in automatic revocation of tax-exempt status. Reinstatement is possible but involves a new application, back filing, and potential gaps in donor deductibility.
Employment Tax Returns
Nonprofits with employees file Form 941 quarterly to report withheld income tax and Social Security and Medicare taxes. Late filing and late payment both carry penalties, and the IRS charges interest on unpaid balances at a rate set by law. Depositing payroll taxes on schedule, filing complete returns on time, and furnishing correct W-2s are the ways to avoid those penalties.
State Audit Thresholds
Many states require an independent CPA audit once annual revenue or contributions cross a threshold set by state law. Thresholds vary widely, from as low as $25,000 in some states to $3,000,000 in others, with many clustering around $500,000 to $1,000,000. Some states tie the requirement to total gross revenue; others look only at charitable contributions. A handful have no mandatory audit requirement. Check with your state attorney general’s office or secretary of state for the threshold that applies to you.
Record Retention: The “Seven Years” Question
Many nonprofit templates say “keep everything for seven years.” The IRS rule is more nuanced, and the distinction matters because storage costs money and destroying records too early creates legal exposure.
The general IRS rule is to keep records supporting income, deductions, or credits on a return for three years from the filing date. If you underreport income by more than 25%, the IRS has six years to assess additional tax, so records supporting income should be kept for at least six years. The seven-year period applies specifically to claims for losses from worthless securities or bad debt deductions. Employment tax records, including payroll records and Forms 941, must be kept at least four years after the tax is due or paid, whichever is later. If no return is filed, or a fraudulent return is filed, records should be kept indefinitely.
Many nonprofits adopt a blanket seven-year policy as a conservative default that covers nearly every IRS scenario. That’s reasonable, but it’s a policy choice, not the legal minimum for most records. Whatever you choose, put it in writing and apply it consistently. And remember the federal obstruction rule above: destroying records to interfere with a federal investigation is a crime regardless of your normal schedule.
Writing and Adopting the Policy
Before drafting anything, gather the operational details that make a policy real rather than generic. List every bank and investment account the organization holds, and identify every authorized signer. Decide whether each signer still needs that access. Map which staff members handle cash, which enter data into the accounting system, and which have administrative access to financial software. Set the dollar thresholds for each level of approval.
Templates from national nonprofit associations can give useful structure, but a template becomes a governance document only when placeholders are replaced with actual names, account numbers, and dollar amounts. Your policy should state explicitly, for instance, that the treasurer reviews the monthly bank reconciliation performed by the office manager, or that any expenditure above a stated amount requires two signatures. It should also address digital security: who holds administrator access to accounting software, how often passwords change, and how financial data is backed up.
Present the draft to the full board for discussion and a formal vote. Record the motion, the vote, and any significant discussion points in the official minutes. Distribute the adopted policy to every staff member and volunteer with financial responsibilities, and have each sign an acknowledgment confirming they’ve read it and understand their role. A policy sitting in a filing cabinet that was never explained is not a control.
Keeping the Controls Current
Controls degrade. Staff turn over, financial systems get upgraded, new grants introduce new compliance requirements, and scam tactics evolve. Review the policy formally at least once a year, and again whenever something significant changes: new accounting software, a new bank account, a first federal grant. Every new hire whose work touches financial processes should be trained on the controls that apply to their role before they start handling money. Existing staff benefit from periodic refreshers when procedures change. Clear roles and routine documentation also protect staff themselves; nobody ends up in a position where they could be falsely accused of mishandling funds.