Internal Control Fraud at Nonprofits

In the Association of Certified Fraud Examiners (ACFE) 2024 edition of "Report to the Nations on Occupation Fraud and Abuse"¹, 89% of fraud cases involve misappropriation of assets. In addition, 21% of all fraud cases occurred in companies with fewer than 100 employees and for those fraud cases, the median loss was $141,000.

The report also found that there were three internal control weaknesses that contributed to occupational fraud; Lack of internal controls, override of existing internal controls, and lack of management review. The three internal control weaknesses occurred in 32%, 19% and 18% of fraud cases identified, respectively.

In this article, we will touch on how to mitigate each of these internal control weaknesses.

Lack of Internal Controls

A lack of internal controls can manifest in various ways, but one of the most critical vulnerabilities for an organization arises when there is insufficient segregation of duties within the cash receipts and disbursement processes. Employees who perform multiple accounting related duties and have control of cash coming in and going out of the organization have the greatest opportunity to commit fraud. To mitigate this weakness, we recommend the following:

• Do not allow a single employee to handle a cash transaction from beginning to end.
• The cash handling function should be separated from the function of recording cash transactions in the accounting system.
• Bank reconciliations should be performed on a timely basis at the end of each month by an employee that is not involved in the cash processing and reviewed by an employee who is not responsible for the accounting function but has familiarity with what cash receipts and disbursements activity for the organization should look like.
• A separate purchasing function that includes all necessary approvals, well-organized information, and documentation for all company purchases.
• A separate receiving function to verify that all goods ordered have been received in proper condition, etc. using documentation from the purchasing function. 
• Checks signed only by authorized individuals, only with the availability of the complete voucher package, and only after complete agreement of all documentation is reviewed. The employee responsible for generating checks should not have signature authority on checks. 

While the suggestions above are not all-inclusive, hopefully it will encourage you to review your current policies and procedures at your nonprofit organization and implement procedures to deter and detect employee fraud. Please let us know if we can help in reviewing your risk assessment of your policies and procedures.

Override of existing internal controls

An organization can have internal controls implemented to mitigate fraudulent activity but the most well-designed controls can still be susceptible to employees overriding them. Examples of this may be an employee who does not have signature authority forging a signature on a check. Another example would be an employee who has signature authority asking the accountant to cut a check without getting all of the proper approvals. To mitigate this weakness, we recommend the following:

• Management should set the tone at the top for ethical behavior in the organization. The message should be that fraudulent activity will not be tolerated and that if any employee suspects fraudulent activity is occurring, they should disclose it to management or the board of directors. 
• Implementing an anonymous hotline for employees to report suspected fraudulent activity. In the 2024 edition of "Report to the Nations on Occupation and Abuse", it was found that 43% of frauds were initially detected by a tip. That is more than the combined detection rate of internal audit, management review, account reconciliations, and external audit. 
• The Board of Directors should be involved in oversight of the internal controls of the organization. Override of internal controls is typically performed by management who can get employees to go along with their fraud as the employee is worried about getting terminated. Having members of the Board of Directors oversee management's role in internal controls could help prevent override of internal controls from occurring. 

Lack of management review

Typically this occurs when management is involved in running the operations of the company but provides very little oversight of the accounting function. To mitigate this weakness, we recommend the following:

• Review bank reconciliations and compare them to bank statements that management has received directly from the financial institution or accessed directly from the financial institution's website. When reviewing bank reconciliations and bank statements, careful attention should be applied to the review of unusual transfers in and out of the account and unknown checks being cleared by the bank. 
• Review of all cash disbursements. Ideally there should be multiple levels of review. The employee responsible for requesting the cash disbursement should review the disbursement and all supporting documentation to make sure it is correct. The person signing the check should then perform the same level of review.
• Review of all manual journal entries posted in the accounting system. If an employee who has access to accounting records is committing fraud, they will usually try to conceal their fraud by posting manual journal entries in the accounting system. Review of these entries could help prevent fraud from occurring and also detect fraud that has already occurred. 

While the suggestions above are not all-inclusive, hopefully it will encourage you to review your current policies and procedures at your nonprofit organization and implement procedures to deter and detect employee fraud. Please let us know if we can help in reviewing your risk assessment of your policies and procedures. 

 ¹https://legacy.acfe.com/report-to-the-nations/2024/