I once had the responsibility of auditing a $10,000 petty cash fund, monthly. The cash was kept locked in a safe in the supply closet. The clerk responsible for reimbursing expenses to employees watched me as I counted the cash and added up the receipts, a task she considered a great waste of her time since it takes more than a few minutes to count $10K in cash and receipts. Having her present during the audit was an internal control that provided a safeguard for both of us. If I found that cash was missing, how easy for her to say, “It was there when I handed it to you!”
My boss at the time was fond of saying locks just keep honest people honest. The same is true for internal controls.
A publication by the Virginia Society of Certified Public Accountants explains that good internal controls are essential to:
- Prevent loss through errors, misappropriation of funds, or theft
- Prevent an “honest” employee from making a mistake that can ruin his or her life
- Document the responsibility of the board as it safeguards the assets of the NPO
- Assure that all transactions are properly authorized and recorded
While seemingly time consuming, the simple act of having two people present during the petty cash audit protects both employees and assets – a distinct advantage of using adequate internal controls.
Internal Controls Defined
The National Council of Nonprofits defines internal controls as financial management practices systematically used to prevent misuse and misappropriation of assets, such as occurs through theft or embezzlement. Internal controls protect not just assets but reputations, as well. That nonprofit organizations maintain the highest integrity and ethical standards is critical to attract funders.
The objective of internal controls is to put “checks and balances” in place to protect the assets of the organization.
What Can Go Wrong
Once at a holiday party hosted by a University of Texas accounting professor, I found myself standing next to auditing professor Steven Kachelmeier. Using my Dale Carnegie powers of conversation, I engaged Professor Kachelmeier in a discussion of top 10 internal controls for nonprofits. He responded by saying, “Just consider what can go wrong.”
I scoured the internet to find examples of what can go wrong with weak or non-existent internal controls. The following stories are true and could happen to you.
Scenario: Cash – MIA
Suppose checks are merely kept in the bottom drawer of a file cabinet. An enterprising employee might take a few checks from the bottom of the stack, forge a signature, and cash them, stealing thousands of dollars before being caught.
Internal Control Solution: Secure the checks with keys held by two different financial managers. Ensure that bank reconciliations are performed by staff with no access to deposits or withdrawals. Bank reconciliation should be prepared on a monthly basis, at minimum.
Scenario: Employee Alert
A clever payroll employee adds overtime hours to pay himself or herself at time and-a-half.
Internal Control Solution: Timecards should be signed by managers. A second person compares the payroll totals to signed timecards.
Scenario: Sad But True Fundraiser Fiasco
During a fundraiser, a volunteer handled all aspects of the cash ticket sales, including depositing funds and reconciling the bank statement. Occasionally short on cash, she would borrow funds and then pay them back. Until she didn’t pay them back. This well-meaning volunteer “borrowed” around $10,000. The event intended to be financed by the fundraiser was cancelled.
Internal Control Solution: Anytime cash is involved, the responsibilities should be divided among several people. At least two people should be present when cash is counted. Separate people should make the deposits and reconcile bank statements.
Internal controls should be clearly documented in a procedural manual and authorized by the board or governing authority of the organization. Discovery of theft or an embezzlement and the resulting investigation is hard on the organization internally, and the external damage to the organization’s reputation can cause loss of funding.
Establishing internal controls protects both the organization and the board members, officers, and staff. For more comprehensive reading, Abila has created “Internal Controls for Nonprofits: Best Practice Principles, Policies, and Procedures.”