A nonprofit internal controls policy for Form 990 is a single board-adopted document that spells out how the organization authorizes transactions, protects assets, keeps reliable books, and answers the three governance questions on Form 990 Part VI: whether you have a written conflict of interest policy, a whistleblower policy, and a document retention and destruction policy.1Internal Revenue Service. Form 990 Part VI – Report Policies of Filing Organization Only The sections below walk through what each part of that document should contain.
What Form 990 and Federal Grants Require
Form 990 is the IRS’s primary tool for gathering information about tax-exempt organizations, and most states rely on it for charitable oversight.2Internal Revenue Service. Form 990 Resources and Tools Part VI reports governance policies to the public, so your written controls directly drive the answers you give. Saying “no” to any of the Part VI policy questions is not itself a legal violation, but it invites scrutiny from the IRS, state regulators, and donors who read 990s before giving.
Nonprofits that receive federal grant funding have a second layer of requirement. Under 2 CFR 200.303, grant recipients must maintain internal controls aligned with either the federal government’s standards or the COSO Internal Control–Integrated Framework.3eCFR. 2 CFR 200.303 – Internal Controls A single written policy that covers the areas below satisfies both the IRS governance expectations and the federal grant standard.
Segregation of Duties
Segregation of duties is the structural spine of the policy. The rule is simple: no one person should control more than one of the three core financial functions — authorizing transactions, holding custody of assets, and recording entries in the books. When one person does all three, the opportunity to commit and conceal fraud is wide open.
Your policy should name the separations by function:
- Cash receipts: the person who opens the mail and logs incoming checks is not the person who records the deposit in the general ledger.
- Disbursements: the person who approves a payment is not the person who signs the check or initiates the wire.
- Payroll: the person who prepares payroll does not distribute or have custody of payroll checks.
- Vendor files: the employee who authorizes a vendor contract does not maintain the vendor payment records.
Full separation is often impossible with fewer than five or six finance staff. If that describes your organization, the compensating controls section below is the part of the policy that fills the gap.
Financial Transaction Controls
Each type of transaction needs its own documented procedure.
Cash Receipts and Revenue
All incoming cash and checks should be opened and logged by two people who do not report to each other. Both sign the log. That log goes straight to accounting as an independent record the deposit can later be verified against.
Deposits should go into the bank intact, ideally within one business day of receipt. “Intact” means no one peels off cash to cover an office expense. Using incoming cash to pay bills destroys the audit trail and is one of the fastest paths to undetected theft. The person who prepares the deposit slip should be different from the person who records the revenue in the general ledger.
Purchasing and Disbursements
An approval matrix sets the authorization level required for each spending range. A common structure:
- Under $500: department manager approval.
- $500 to $10,000: executive director approval.
- Over $10,000: two signatures, including a board officer or finance committee member.
Before any payment is processed, require a three-way match: the approved purchase order, the vendor invoice, and documented evidence the goods or services were actually received. Paying an invoice without confirming delivery is how fictitious vendor schemes succeed. The person who authorizes a payment should never sign the check or initiate the electronic transfer.
Credit Cards and Petty Cash
Organizational credit cards need their own written sub-policy. Keep the number of cards low, assign a defined monthly spending limit to each, and issue cards only to approved employees. Cardholders should submit original receipts and a brief expense report within a set number of business days after the statement closes; five days is a common benchmark. A supervisor who is independent of the cardholder reviews the statement and verifies the business purpose of every transaction. The policy should flatly prohibit cash advances and personal purchases.
For small routine expenses, run a petty cash fund on the imprest system: cash on hand plus receipts must always equal the established fund amount. One designated custodian controls the fund, keeps it in a locked location, and submits receipts for replenishment. A supervisor approves each replenishment, and management conducts unannounced spot counts at least once or twice a year. The fund should never be used for salaries, personal services, or any expense large enough to run through normal purchasing.
Bank Reconciliation
Every bank account should be reconciled to the general ledger monthly. The person doing the reconciliation must not be someone who authorizes payments or handles cash, or they are checking their own work. The completed reconciliation and supporting documentation go to a manager who is independent of both cash handling and bookkeeping for review and sign-off.
Set a specific timeframe for resolving material variances. Thirty days is reasonable for most organizations, and the policy should require documentation of what caused each variance and how it was corrected. Many frauds are eventually caught in reconciliation, so cutting corners here defeats the purpose of most other controls.
Fraud Prevention Banking Tools
Two banking services belong in the policy because they catch what manual review cannot. Positive pay works like this: your organization sends the bank a file of issued checks with the check number, dollar amount, and payee each time checks go out. When a check is presented, the bank matches it against your file and flags anything that does not match for your approval or rejection before it clears. Forged or altered checks are stopped cold.
ACH positive pay works the same way for electronic debits. You set up a list of approved vendors and can set a maximum dollar threshold for each. Any ACH debit from an unrecognized account requires manual approval before it posts. Both services cost relatively little. Your policy should require enrollment in both and designate who reviews exception items daily.
Payroll Controls and Personal Liability
Payroll is high risk because it involves recurring, predictable outflows that can hide ghost employees or inflated hours for months. Separate payroll preparation from payroll distribution and from the authority to add or remove employees from the payroll system. A manager outside the payroll function should review each run before release, comparing headcounts and totals against the prior period and investigating unexpected changes.
Outsourcing payroll does not transfer legal responsibility. The IRS recommends enrolling in the Electronic Federal Tax Payment System (EFTPS) so you can independently verify that your payroll provider is actually making deposits under your employer identification number.4Internal Revenue Service. Third Party Payer Arrangements – Payroll Service Providers and Reporting Agents There are well-documented cases of payroll companies collecting funds from clients and failing to remit them to the IRS, leaving the employer on the hook.
The personal stakes are severe. Under 26 U.S.C. § 6672, any person responsible for collecting and paying over employment taxes who willfully fails to do so faces a penalty equal to the full amount of the unpaid taxes. That penalty falls personally on whoever had authority over the organization’s finances, typically the executive director, CFO, or treasurer. Volunteer board members who serve in an honorary capacity and do not participate in day-to-day financial operations are protected, but only if they had no actual knowledge of the failure.5Office of the Law Revision Counsel. 26 USC 6672 – Failure to Collect and Pay Over Tax, or Attempt to Evade or Defeat Tax
For grant-funded positions, require employees to certify their time on specific grants after the work is performed, not based on budgeted estimates. Federal grant rules require after-the-fact timesheets prepared at least monthly, signed by both the employee and a supervisor with firsthand knowledge of the work.3eCFR. 2 CFR 200.303 – Internal Controls Budget-based allocations can be used for interim accounting but do not satisfy audit requirements.
Non-Cash Assets
Set a capitalization threshold: the dollar amount above which a purchase is recorded as a fixed asset rather than expensed. Many nonprofits set this at $5,000 per item, aligned with the IRS de minimis safe harbor for organizations that have an applicable financial statement. Organizations without an applicable financial statement can use $2,500 under the same safe harbor.6Internal Revenue Service. Tangible Property Final Regulations Items above the threshold should be tagged with an asset number, tracked in a fixed asset ledger, and physically verified at least every other year.
Access to physical non-cash assets like inventory, equipment, or stored donations should be restricted to authorized personnel. Transfers between locations or programs should be documented with signed transfer forms, and periodic physical counts should be reconciled against the accounting records.
Information Technology Access
IT controls protect the integrity of every other control. If someone can alter records in the accounting system without detection, your segregation of duties and approval matrices do not matter.
Restrict access to accounting software through unique user IDs and role-based permissions. A staff accountant does not need the ability to delete journal entries or modify the chart of accounts. The policy should require a quarterly review of all user access covering current employees, contractors, consultants, and service accounts. The review verifies that departed employees have been removed, that access levels match current job responsibilities, and that no user has conflicting permissions.
Back up financial data frequently, with copies stored securely off-site or in an encrypted cloud environment. Encrypt sensitive data such as donor records, banking credentials, and employee tax information in storage and in transmission.
The Three Governance Policies Form 990 Part VI Asks About
Form 990 Part VI puts three specific policy questions on the public record. Your controls document should contain all three.1Internal Revenue Service. Form 990 Part VI – Report Policies of Filing Organization Only
Conflict of Interest Policy
Line 12a asks whether your organization has a written conflict of interest policy. Lines 12b and 12c ask whether officers, directors, and key employees are required to disclose interests that could create conflicts annually, and whether the organization monitors and enforces the policy.
The IRS describes a conflict of interest as a situation where someone’s duty to further the organization’s charitable purposes clashes with their own financial interests, such as a board member voting on a contract with a business they own, or insiders setting their own compensation. Require annual disclosure statements from all board members, officers, and key employees, and establish a procedure where conflicted individuals recuse themselves from discussion and voting. The IRS warns that serving private interests more than insubstantially can cost the organization its tax-exempt status.7Internal Revenue Service. Form 1023 – Purpose of Conflict of Interest Policy
Related party transactions also trigger reporting on Schedule L of Form 990. Business transactions with interested persons that exceed $100,000 in total annual payments, or single transactions exceeding the greater of $10,000 or 1% of total revenue, must be disclosed. Compensation paid to family members of officers or key employees triggers reporting at just $10,000.8Internal Revenue Service. Instructions for Schedule L (Form 990) Your conflict of interest policy should create the internal process that identifies these transactions before they hit the tax return.
Whistleblower Protection
Line 13 asks whether your organization has a whistleblower policy. The Sarbanes-Oxley Act’s whistleblower and document destruction provisions apply to all corporations, including nonprofits. Retaliating against an employee who reports concerns about accounting practices or destroying evidence related to a federal investigation is a federal crime regardless of your organization’s size.
Establish a clear reporting channel for employees to raise concerns about financial irregularities, policy violations, or suspected fraud. The channel should allow reports to bypass the person being reported, typically by going directly to the board chair, audit committee chair, or an anonymous hotline. The policy must explicitly prohibit retaliation and describe the protections available to anyone who reports in good faith.
Document Retention and Destruction
Line 14 asks whether your organization has a document retention and destruction policy. The IRS requires exempt organizations to maintain records sufficient to document compliance with tax rules and to support the income, expenses, and credits reported on their annual returns.9Internal Revenue Service. EO Operational Requirements – Recordkeeping Requirements for Exempt Organizations The IRS instructs public charities to keep records for as long as they may be needed to document compliance.10Internal Revenue Service. Publication 4221-PC – Compliance Guide for 501(c)(3) Public Charities
In practice, specify minimum retention periods for each category of record. Governing documents like articles of incorporation, bylaws, and determination letters should be kept permanently. Filed tax returns and supporting schedules should be kept at least seven years. Employment tax records and payroll documentation should be retained at least four years after the tax becomes due or is paid, whichever is later, consistent with IRS guidance for employment tax records. Grant records should be kept for the period specified in the grant agreement, typically three years after final reporting. The destruction side matters too: documents should be destroyed on schedule unless a litigation hold, audit, or investigation requires preservation.
Compensating Controls for Small Nonprofits
The segregation rules above assume you have enough staff to separate financial roles. Many nonprofits do not. When one or two people handle everything, you need compensating controls — alternative safeguards that reduce risk without additional headcount. Document each one in the policy and tie it to the segregation gap it addresses. Auditors expect to see this, not just assumed.
The most effective compensating control is direct board involvement:
- Unopened bank statements go to a board member. The treasurer or finance committee chair opens the monthly statement, reviews cancelled checks and withdrawals for anything unusual, then passes it to the bookkeeper. This single step catches a remarkable number of problems.
- Credit card statements get the same treatment. Someone other than the cardholder or bookkeeper reviews every transaction each month, looking for unfamiliar vendors, late fees, or foreign transactions.
- Mandatory consecutive time off. Banks require employees with financial access to take at least two consecutive weeks away each year because fraud often surfaces when the perpetrator is not there to maintain the cover-up. Apply the same rule to anyone who handles money.
- Surprise cash counts. Unannounced counts of petty cash, cash registers, or any other funds on hand by a board member or outside accountant can reveal shortages that scheduled counts miss.
- Background and credit checks. Run criminal background checks on anyone with financial access before they start. A credit check on the bookkeeper or finance manager, conducted with their consent as a condition of the role, can identify financial pressures that increase fraud risk.
Adopting, Training, and Reviewing the Policy
A policy that sits in a drawer does nothing. Formal adoption requires a board resolution passed at a scheduled meeting, referencing the specific policy document and version number. The policy itself should include an effective date, version control number, and a revision history so there is never confusion about which version is current.
After the vote, all staff and board members with any financial role should receive mandatory training on the policy’s contents. Each participant signs a written acknowledgment that they have read, understood, and agree to follow the policy. Store the acknowledgments in personnel files.
The policy should require an annual review by the audit committee or an independent third party. The review evaluates whether the controls still match the organization’s current size, operations, and risk profile. A nonprofit that doubled its grant funding since last year needs different controls than it did twelve months ago. Any changes go back to the board for formal approval before implementation.
Build in a mechanism for reporting control deficiencies to the audit committee throughout the year, not just at the annual review. Controls break down gradually, and waiting twelve months to surface a weakness can turn a procedural gap into a financial loss.