News & Events Listings


When it comes to maintaining a proper accounting environment and having effective internal controls, not-for-profits (NFP) have essentially the same requirement as commercial organizations do. Having both are critical to capturing accounting data to provide for proper financial reporting, decision making, third party requirements, etc. However, in the increasingly competitive landscape of charitable organizations, smaller NFPs face some unique constraints that can significantly impact the internal control environment.

These can include:

  • Less access to individuals with the education and expertise needed for NFP accounting and reporting.
  • High turnover of key accounting personnel.
  • Accounting and control environments that are poorly designed or implemented.
  • Board or management that lacks the expertise to fully understand the financial statements and related accounting.
  • Increased pressure to raise funds amidst changes to the Federal tax laws and increased competition among NFPs.
  • An increased risk of fraud because of the risks associated with the aforementioned challenges.

While larger NFPs may have an increased level of sophistication that reduces these constraints, smaller NFPs tend to encounter significant internal control problems which create additional risks for their accounting and financial reporting. This article focuses on those smaller NFP organizations.

The need for proper accounting and financial reporting

A significant reason that NFPs are unique is that their financial statements and Form 990s are often reviewed by third parties such as funding sources, potential donors, and Federal/State Agencies. It is common for NFPs seeking grants to submit audited financial statements to funding sources. These funding sources want to have a level of confidence that their grants are going to be properly used and administered, so it is crucial to have effective accounting systems and internal controls in place to allow for a successful audit.

Similarly, many potential donors review the Form 990 as part of their decision making process. The Form 990 tells the story of the NFP in both quantitative and qualitative terms. These donors look at key metrics and amounts such as total revenues, functional expenses, officer/director salaries, etc. As with an audit, having the proper systems and controls in place helps ensure that the NFP is reporting the Form 990 correctly.

NFPs may also receive Federal/State awards that are subject to additional compliance requirements and potentially a Single Audit in accordance with Uniform Guidance rules. It is also not uncommon for the Federal/State agencies to perform regular reviews of the NFP’s administration of the awards. If the NFP is unable to administer the award requirements properly, they risk consequences such as lost funding or having to repay past award proceeds.

Entity level and activity level controls

Internal controls are generally grouped into two categories – entity level and activity level.

Entity level controls can be thought of as higher level and include board or management involvement. Examples include:

  • Reviewing financial statements and budget to actual reports on a regular basis.
  • Reviewing cash disbursements and vendor lists.
  • Approval thresholds for transactions over certain dollar amounts.
  • Having a board member receive the bank statements directly from the bank.
  • Regular meetings with the accounting/finance team to discuss operating results, accounting problems, unexpected issues, etc.

Activity level controls are more specific in nature and are usually found at the detail level and involve individuals directly responsible for various types of transactions. Examples include:

  • Preparing bank reconciliations on a monthly basis.
  • Reconciling balance sheet accounts on a monthly or periodic basis.
  • Approval of vendor invoices prior to payment.
  • Separating the functions of opening cash receipts and posting them to the accounting records.
  • Approval of payroll records prior to processing.
  • Review of contributions and agreements for donor restrictions.

The constant challenge that smaller NFPs face is how to design and implement internal controls with the limited staffing and budget constraints that are often present. One of the key elements of any internal control environment is segregation of duties. Any time you can have more than one person involved in processing transactions, the risk of errors or fraud is reduced. However, it isn’t uncommon for smaller NFPs to have only 1 or 2 people involved in all of the accounting functions.

In light of the constraints mentioned above, smaller NFPs often make sacrifices to the internal control environment that can have a negative impact on the accounting and financial reporting. These choices may be unavoidable – if the accounting functions are performed by only one person, how can there be a segregation of duties over cash receipts and disbursements? Likewise, if the board doesn’t have any members that have experience in NFP accounting and reporting, how can there be an effective review of monthly financial statements?

Finding the right internal control balance

The most effective internal control environments include both entity and activity level controls. To determine the best balance and type of internal controls to implement, NFPs need to assess several factors such as:

  • The ability to segregate duties among accounting staff and management.
  • The knowledge and expertise of board members and management.
  • Areas that carry a higher risk of error or fraud such as cash or vendor payments.
  • The extent that the accounting system is based on manual processes vs. IT based.

Larger NFPs often have the ability to implement more activity level controls because of larger accounting staffs, greater expertise, etc. However, smaller NFPs are often faced with limited resources and/or a lack of expertise, so they need to rely on greater entity level controls to mitigate risks.

In practice there is no single best solution to finding the right balance of internal controls to implement, so performing this assessment will help ensure that the NFP has the best available information to design and implement the most efficient and cost effective internal controls.

Examples of common control deficiencies in smaller NFPs

Through our experience with NFPs of varying sizes and types we have identified some areas where internal control deficiencies are common and made recommendations on how to strengthen the internal controls. For example, if you are limited with segregation of duties for the following areas, adding entity level controls will help mitigate risks.

  • Bank reconciliations – Have a qualified board member or management review the bank reconciliations, check registers, and/or receive and review the bank statements direct from the bank.
  • Cash disbursements – Establish dollar thresholds which would require board approval prior to authorizing the purchase or making the payment.
  • Cash receipts – Have someone independent of the accounting function summarize cash receipts prior to posting to the accounting records. A qualified board member or management can then review and compare the cash receipts against other source documents such as receivable ledgers, donor agreements, etc.
  • Vendor activity – Limit the access to add vendors and require board approval for any changes.
  • Payroll activity – Have a qualified board member review the payroll reports on a periodic basis. Limit the access to add employees or make rate changes, and require board approval for any changes.
  • Account reconciliations and close processes – Require the use of a monthly checklist to manage the close process and preparation of account reconciliations. A qualified board member can then review the checklist monthly and account reconciliations as needed.
  • Financial statements and budget reports – Mandate that financial statements be prepared on a periodic basis and have a qualified board member review and scrutinize them. If the NFP utilizes budgets, compare the budget to actual information on a regular basis.

While these issues may be common to smaller NFPs, this is not a comprehensive list. Each NFP should assess their risks and options for activity level and entity level controls. Establishing and maintaining effective internal controls will always be a challenge for smaller NFPs and require constant monitoring to ensure they are operating effectively. UHY’s team of NFP professionals has the experience to work with you and help you assess your internal controls and identify areas for improvement.