In the not-for-profit world, maintaining strong internal controls can be a challenge, especially when working with limited budgets, small teams and basic account software. Watch our video and learn more about common internal control issues, practical workarounds like compensating controls and strategies to strengthen financial oversight, even with limited resources.

Transcript

I’m Carl Thomas, I’m a manager at Cray Kaiser focusing on the assurance line of business. In my experience working with not-for-profit organizations, a big challenge is internal controls and segregating duties and making sure that the process is well protected from error and mistakes and things.

A couple of reasons these challenges may exist is limited budget constraints and limited staffing in the finance office. Another challenge is that a lot of smaller and not-for-profit organizations use off-the-shelf accounting software, which may not be able to limit access controls in terms of who can do what in the system. With a small finance office, there’s also limited FTEs. So you can’t necessarily break a process up amongst three, four people if your finance office is maybe only two people. So that’s also a challenge.

A good way to work around these limitations is what we call compensated controls in the industry. Now, compensated controls would be something that is outside of that process. So it could have a time lag where it happens after it, or it could be someone even outside of the finance office looking at something. An example would be after payroll was run, the president or CEO may run a report for what we call an exception report, for example, where they’re looking for paychecks that may be populated for a plus or minus 10 percent different than the last period. This would really target the review by someone who is not familiar with the usual finance processes and make it very efficient. And since that person, in general, does not have access to assets or the accounting system, it would provide sort of an independent check on that process. In this case, this would be a pretty good control for payroll. However, it is important to understand that that person, again, should not have access to any of the accounting system or assets. Otherwise, it kind of negates the value of that process because controls could be overridden. We call that management override in our business.

Another good compensated control is keeping the board of directors engaged. Now, the board should be reviewing financial information regularly. Balance sheet, investment reports, profit and loss statement, and potentially even cash flow statements. This helps the board be informed about operations and how the organization is performing. It’s very important that the board assess performance. Now, it’s also interesting because this is a control. And so it’s important to keep the board engaged because the board being engaged is actually a great control.

Other good things to have in process are what we would call entity level controls. And when we talk about these, we’re talking about things that are outside of that transactional process. For example, good tone at the top is actually pretty important. If there’s a good tone at the top with the board of directors and management, it cascades down. And this is actually very paramount in our industry. If we do not have a good tone at the top, it can lead to problems in the organization. So that is actually a very good control and that is very hard to quantify, but it is something that organizations should be thinking about. It’s very important.

Going along with the entity level concept, too, it’s really important to have well-defined policies and procedures. For example, employee handbook, perhaps a code of conduct can also be quite helpful. People operate better when they have a framework of what’s expected, I think, and that’s also another great entity-level control. Something from a blocking and tackling standpoint could be maybe a tip line. All right, tip line. If you see something, say something.

Going again with the entity-level control, something that organizations may also wish to think about is keeping their employees and their stakeholders engaged. And a great way to do this could be something what we call maybe a suggestion box or a way to keep engaged where there’s a two-way communication between employees, management, and the board of directors. In this way, certain things that may not be visible at some levels of the organization may be apparent if there’s good two-way communication. Two-way communication is also a foundational principle of auditing. Auditors have to have good two -way communication with our boards of directors so that everyone is informed of matters that are relevant.

These challenges and issues are inherent to many small, medium, and even large-sized not -for-profit organizations. If some of these challenges are resonating with you, feel free to give us a call. Cray Kaiser is a full-service CPA firm with a dedicated team to not-for-profits, and we’d be very happy to hear from you.