Nonprofit organizations operate on a foundation of trust. Donors, grantors, and the communities you serve all assume that resources are being used as intended. That trust, however, can become a liability when internal safeguards are weak; and the data consistently shows that nonprofits are among the organizations most frequently targeted by occupational fraud.

According to the Association of Certified Fraud Examiners (ACFE), occupational fraud typically goes undetected for more than a year. For a resource-constrained nonprofit, even a modest loss can derail programs, damage donor relationships, and trigger regulatory scrutiny. Understanding where the risk lives, and what controls actually prevent it, is the starting point for protecting your organization.

Why nonprofits are disproportionately exposed

Fraud thrives where opportunity exists, and several features of the nonprofit environment create it. Many organizations operate with small administrative teams, which makes true segregation of duties difficult to achieve. A single staff member may handle incoming donations, record the transactions, and reconcile the accounts – a combination of responsibilities that would raise immediate red flags in a for-profit business.

Board oversight, while critically important, is often part-time and volunteer-driven. Board members may lack financial backgrounds or assume that a trusted executive director has things under control. That assumption is exactly what bad actors rely on.

Nonprofits also depend heavily on cash and cash equivalents – entrance fees, event revenue, donation jars, and online contributions that flow through multiple channels. Each touchpoint is a potential gap. Add in the fact that employees in mission-driven organizations often feel their conduct goes unquestioned because of their perceived commitment to the cause, and you have the conditions for prolonged, undetected theft.

The most common fraud schemes

Asset misappropriation is by far the most prevalent fraud type in nonprofits. Within that category, a few schemes appear repeatedly.

Skimming occurs when cash is stolen before it is ever recorded. Because no record exists, it can be difficult to detect through routine bookkeeping review. An employee accepting event registrations in cash who pockets a portion before logging the receipts is a classic example.

Billing fraud involves submitting fictitious invoices from a vendor the fraudster controls or has a relationship with. A finance manager who approves payments to a shell company and routes funds to a personal account can generate losses in the tens of thousands of dollars before the pattern surfaces, if it ever does.

Expense reimbursement abuse is one of the most underflagged schemes in small nonprofits. Employees submit personal expenses as organizational costs, inflate mileage or receipts, or submit the same expense multiple times. Because reimbursements are often reviewed informally, these schemes frequently persist for years.

Payroll manipulation, including ghost employees, inflated hours, or unauthorized pay rate changes, is more common in mid-sized organizations with enough staff volume to obscure the additions.

Internal controls that work in a lean environment

You do not need a large accounting department to implement effective controls. The key is designing processes so that no single person can both initiate and approve a transaction.

Separation of financial duties is the most impactful place to start. The person who opens mail and logs incoming checks should not be the same person who posts them to the accounting system or prepares the bank reconciliation. If staffing constraints make full separation impossible, a board member can serve as a second set of eyes on monthly bank statements – a low-time-commitment control that carries significant deterrence value.

Dual signatures or dual approval on disbursements above a defined threshold add friction at the payment stage. Setting that threshold at $1,000, for example, means most routine transactions move efficiently while larger payments require an additional review.

Establish a formal expense reimbursement policy that requires original receipts, a business purpose for each expense, and supervisor approval before reimbursement is issued. Require that someone other than the person submitting the expense approves it, including, when relevant, for executive director expenses, which should be approved by the board treasurer or finance committee.

Conduct regular bank reconciliations and have the completed reconciliation reviewed by someone who is not involved in day-to-day cash handling. Unexplained variances, even small ones, warrant follow-up.

Implement a confidential reporting mechanism. The ACFE consistently finds that tips are the most common way fraud is uncovered, more so than audits or management review. A simple anonymous reporting email box, communicated clearly to staff and volunteers, gives your organization a detection channel that costs almost nothing.

The board’s role is not optional

Board members carry fiduciary responsibility for the organization’s assets. That responsibility requires more than reviewing an annual financial report at a board meeting.

The finance committee or audit committee should receive and review financial statements monthly, compare actuals to budget, and ask questions when line items look unusual. Board members should have direct access to the bank (ideally the ability to view statements online independently) rather than relying solely on what the executive director presents.

Conducting or commissioning a periodic fraud risk assessment signals to staff that the board takes oversight seriously. Rotating financial responsibilities where possible, requiring vacations (which often surface anomalies in the accounts of employees who never step away), and periodically reviewing vendor lists against employee records for conflicts of interest are all practices worth institutionalizing.

Bringing your CPA into the conversation

An annual audit or review engagement is a fraud deterrent, but it is not designed as a comprehensive fraud detection program. Your CPA can do more when engaged proactively. Internal control assessments, agreed-upon procedures focused on high-risk transaction cycles, and periodic fraud risk consultations give you a more complete picture of where your organization is exposed.

If you lead a nonprofit and have not had a recent conversation with your CPA about your current control environment, that is a good place to start. Fraud prevention is far less costly than fraud recovery – in dollars, in donor trust, and in organizational time.

If you have questions about your organization’s internal controls or want a second opinion on your current processes, our team is here to help. Contact us to start the conversation.