Internal Controls 101

I work with a lot of emerging and small nonprofit organizations. One of the first things I try to teach nonprofit leaders is the importance of internal controls.

In this article, I’m going to give you an overview of internal controls for the small or growing nonprofit organization.

Our goal is to help you understand what internal controls and segregation of duties are, and how to implement them at your organization.

Internal Controls 101

First things first: what are internal controls?

Internal controls are the financial processes and procedures that help the organization to safeguard its assets (like cash, supplies, equipment or property). One of the key components of having good internal controls is the segregation of duties. That’s just a fancy way of saying it takes more than one person to do the job.

For example, the person who writes the checks should not be the person signing the checks. The person who orders a service or product can be the person to approve the invoice, but another person should also approve the expense and should determine how the amount on the invoice will be coded on the ledger of the organization.

Why does it have to be so complicated? Segregation of duties does add extra steps to the process of spending nonprofit money – but it’s the absolute best way to avoid mistakes or fraud. Trust me I’ve had plenty of clients with crazy embezzlement issues. One recent case was a treasurer who had diverted the nonprofit’s cash to pay their own mortgage payments through a bank transfer. It took a long time for the board to figure out that this was going on because the treasurer had coded the expense as something innocent. They even had a bookkeeper who didn’t notice the issue!

Protecting the charitable assets of the nonprofit is one of the key duties of management and the board of directors. So that makes having good internal controls very, very important.

Who establishes the procedure?

The organization’s management (usually the board) establishes the system of controls. Sometimes if there are staff with capacity, executive staff will develop policies and procedures that may need to be adopted by the organization through board or committee approval.

Should controls be documented?

Yes. Nonprofits should have a written accounting manual detailing the policies and procedures at the organization. This helps everyone understand their role and provides a mechanism for maintaining the procedures in the event there is a change in personnel or leadership. Getting a good set of internal controls can be a challenge for the smallest nonprofits because the size of the staff team or volunteers may be small. What follows is an outline of the basic areas internal controls are needed for.

1. Check Writing

At a minimum an organization should have two people involved in this process. The process can be broken into several parts with only two people involved.

• Person 1 is an administrator receives invoices and reviews them for accuracy
• The person who ordered the service or incurred the cost should code the invoice to a department / program / grant and approve the invoice in writing (either on the invoice or through a software system) (this may be a volunteer / staff person)
• Person 1 (the administrator) produces a check to pay the invoice
• Person 2 is the authorized check signer. The check signer reviews the check and the documentation (approved invoice) and signs the checks
• Checks are mailed
• Document retention: copy of the check is attached to the invoice (or written on the invoice or documented in a software system) and filed by Person 1 the administrator.

2. Electronic Payments and Transfers

The same process as for checks but the method of payment is different. When making a wire transfer or ACH payment, you should collect all of the documentation and authorizations necessary for any payments before making the transfer payment.

When transactions are processed online, print (to PDF) and maintain the confirmation for the transaction for your records.

For electronic payments, you should have one or more approvals before the transfer will be released. For example, one person might set up the transaction. Then a second person should review the transaction, including the supporting documentation. At least two people should always be involved in when processing electronic transactions. This avoids the fraudulent mortgage payment kinds of situations.

3. Petty Cash

You can start a petty cash fund to cover incidental office expenses. This fund is for a small dollar amount and should be used sparingly. All expenses paid from petty cash need to be documented with receipts, and the person who is getting the cash should sign the receipt.

Maintain your petty cash fund at a set amount. When the cash in the fund is low enough to be replenished, the remaining cash and all receipts should be added together to verify that the total of both equals the stated amount of the fund. The check written to replenish the petty cash fund will be a transfer between two cash accounts.

It’s amazing how much cash is stolen each year from petty cash funds. Only one person should have access to the petty cash fund. At all times the cash and the receipts signed for withdrawals should equal the total of the fund in the general ledger.

The cash should be in a locked box and kept in a locked drawer or filing cabinet.

Every time an individual receives cash from the box, a receipt should be signed and placed in the box (you can purchase paper receipt books from office supply stores or online). The expense coding should be noted on the receipt.

If a receipt is presented for reimbursement from petty cash (i.e. for taxi fare or the purchase of supplies), this receipt should be attached to the receipt created also.

When the cash in the box is low, the total of the paper receipts must be determined and a check written for that amount to replenish the petty cash fund and bring it back up to the fund total. The check should be made payable to the individual in charge of the petty cash.

A summary of the expenses noted on the receipts should be prepared and attached to the check copy. This summary will be the basis for recording the activity in the general ledger.

Under no circumstances should the petty cash fund be used to advance money to employees in the form of loans. EVER.

4. Bank Reconciliations

The bank statements are received each month and must be reconciled to the general ledger (i.e. QuickBooks – hint: using an excel sheet to manage your financials is NOT a good system).

If at all possible, an individual other than the person writing checks and making deposits should reconcile the bank account each month. Many organizations hire an outside accountant or bookkeeper to perform this function to increase the internal controls surrounding cash. Ask me for a referral anytime.

If the organization cannot afford to hire an outside accountant, the executive director (or the treasurer) should receive the unopened bank statement each month. This individual should review all activity and be confident that all transactions are valid. The reviewer should initial and date the bank statement indicating their review.

Once the review takes place the appropriate individual should reconcile the account. All bank statements and the related information should then be filed.

5. Payroll

Use a payroll service. Period. The end. Full Stop.

Go with a major vendor who is reputable. ADP, Gusto, etc. These companies will process the regular payroll, make direct deposits, prepare quarterly and annual tax filings and remit taxes due for a very reasonable fee.

This is generally the most efficient and cost-effective manner for processing payroll and ensuring all tax requirements are met. Further, the payroll service is responsible for keeping current with changes to tax and benefit laws in all jurisdictions. If you do it yourself, you are personally liable as a check signer. Don’t mess around with this. And because an outside party is involved in the process, the controls surrounding payroll are enhanced and the risk of errors and/or misappropriation of funds are reduced immeasurably.

Once a payroll service has been selected, it is prudent to check with the Internal Revenue Service periodically to verify all taxes owed by the organization are paid currently and in full. This step will serve as a check in the event the payroll service does not remit all taxes when due, no matter what the reason.

All withdrawals from employees’ paychecks must be approved in writing by the employees. The following are common withdrawals that require signed forms:

• Federal income tax
• State income tax
• Pension withholdings
• Parking/metro
• Health insurance premiums

In addition, any raises received by the employee must be documented in writing and signed by the executive director or president of the board of directors.

The person who is in charge of payroll should notify the payroll service of any changes for the particular payroll.

The payroll summary issued by the payroll service prior to the payment of the payroll should be reviewed by both the payroll processor and a member of management or the board.

Sufficient cash should be available for automatic withdrawal by the payroll service for both the net salary and all taxes due.

Payroll is either recorded through the check register (QuickBooks) or by journal entry.

Support in the form of timesheets must be available to support the allocation of the salaries to various functions (programs, grants, departments, general and administrative and fundraising). All time records should be saved. Even salaried employees should track their time and effort so the organization can accurately track grant efforts, capture matching contributions or create a cost allocation plan when needed. Clicktime and Toggle are great options, there are also add-ons to QuickBooks Online that may work for the organization.

6. Recording Other Transactions

The general ledger is the journal where all transactions are posted throughout the year and balances are maintained. To create a comprehensive and easily used general ledger, a chart of accounts is developed. The chart of accounts should comply with nonprofit accounting rules and practices as well as GAAP. The account numbers noted in the chart of accounts are the basis for sorting the information in the general ledger. Journal entries are the means for recording all activity in the general ledger.

You should have the general ledger set up by a professional if you’re a tiny organization just starting out. Do not rely on Uncle Larry the CPA to set up the GL. Do not use an excel sheet and hope for the best and figure you’ll upgrade later. Start right from the beginning. Cleaning up past years of bad financials is a very expensive and unfortunately very common situation I see my clients get into. Don’t let this be you. If this is you now, it’s time to fix it. Contact us for a referral to a service who can get your books in order and get you on the right track.

7. Handling Incoming Check Volume

Getting lots of donations? Or lots of membership dues? Or Lots of fee for service revenue by check? If a large volume of checks is received by the organization, a lockbox may be appropriate. The bank will receive the checks directly and the deposit is made upon receipt. The organization then receives a report from the bank of the activity along with the supporting documentation.

Cost can be factor in the decision to use a lockbox, but the time savings and additional controls provided may offset the expense.

When investigating lock boxes, also give consideration to whether the bank can process credit card payments. If not, the transaction will be sent to your organization for manual processing. In these instances, a substantial delay can occur before the organization receives the information. Do your research before committing.

8. Sending Out Invoices

Your organization might have to send out invoices for several reasons. Some organizations sell merchandise or newsletters for a fee. Others require registration for meetings or bill for dues. I recommend setting up these invoicing and payment systems online if possible. Sending out invoices individually is time consuming and antiquated. But if you do, all invoices should be reviewed by a person other than the preparer before mailing / sending.

If the organization is on an accrual basis, invoices must be recorded in the general ledger when they are prepared. And you must keep an aging list so you can track the length of time it takes to get paid on invoices. Plus, then you know who you need to do collections efforts with. Keep copies of all invoices (electronically).

Any invoices you don’t collect on must be written off. All amounts written off must be approved in writing by management.

Conclusion

There’s a lot more to accounting and internal controls than this, of course, but these basics set your nonprofit up for success. Be sure to reach out to us for referrals if you need them!

Article Attachments

• Internal Controls 101