Two climbers examine a shared rope before setting out, an image of the care that comes from an independent second check. Original editorial painting of an imagined scene, not a documented event or technical climbing instruction.
Practical financial safeguards help small nonprofits share responsibility, catch mistakes and keep charitable resources connected to their purpose.
By Arbab Naseebullah Kasi, Chief Executive Officer - CEO, Feel Worldwide Foundation Inc.
A small nonprofit can depend heavily on the person who always remembers. The person who knows which invoice was paid, where the receipt went and why a transfer arrived with the wrong reference. Their care keeps the work moving. Their absence can reveal how much of the organization exists only in one person’s memory.
Financial safeguards begin with a fair question: could someone else understand, check and continue this work?
An illustrative scene, not a reported case: A coordinator receives a $640 invoice for workshop materials. The supplier is familiar. The purchase was expected. But the payment instructions name a different bank account from the one used last month. A colleague notices the change before the payment is released and asks for verification through a previously established contact channel.
There may be an ordinary explanation. There may be an error or an attempted diversion. At that moment, the useful achievement is that someone has enough information, time and authority to ask.
This is the practical heart of internal control. A mission should not depend on one person being available, accurate and alert every time. A second set of eyes can protect the organization while also protecting the conscientious person carrying too much alone.
Follow a payment rather than an organization chart
Discussions about accountability often begin with board structure or conflicts of interest. Those subjects matter, but a payment presents a more immediate test: who requested it, who checked it, who released it and who later confirmed what happened?
Internal controls are the everyday arrangements that make those answers reliable. They include approvals before money moves, checks afterward, usable records and a clear response when something does not fit.
The New York Attorney General’s guidance describes controls as supporting asset protection, dependable reporting, compliance and effective operations. It recommends written procedures suited to the organization and separating financial responsibilities so that one individual does not control the whole flow of funds. This is state-regulator guidance, not a claim that every recommendation is a universal rule for every nonprofit. New York Attorney General guide to internal controls.
Start by tracing an actual transaction from beginning to end. A request may arrive in an email. An approval may live in a messaging app. The payment may leave through a bank portal, while the invoice sits in someone’s downloads folder. Each step can look reasonable in isolation. Together, they may leave no dependable connection between the purchase, the authority to make it and the money that left.
The first improvement may be as simple as giving each payment one reference and keeping the supporting records together in an appropriately protected place.
Give the second reviewer a real job
Two names on a form do not necessarily mean two people have checked the work. A reviewer who sees only the amount, or approves a batch while rushing between meetings, may add very little protection.
A useful review asks concrete questions:
- What is being purchased, and how does it serve an approved activity? - Does the invoice agree with what was ordered and received, or with the terms of an authorized advance? - Is the supplier and payment destination correct, including any recent change? - Has this invoice already been paid or scheduled elsewhere? - Is the expense permitted under the relevant budget, grant or donation restriction?
The reviewer needs the underlying evidence, not merely a colleague’s assurance that everything is fine. They also need permission to pause a payment without being treated as obstructive.
Separate the preparation of a payment from its release wherever staffing and banking arrangements permit. Use named accounts and appropriate permissions so that approval is attributable to an individual. A colleague pressing a button while signed in under the preparer’s credentials does not create an independent record.
The Charity Commission’s CC8 guidance, which applies to England and Wales, recommends splitting financial duties and using dual authorization for online banking. It also recognizes small-team constraints: when duties cannot be fully separated, transaction reviews and checks on whether controls are followed can help manage risk. Its jurisdiction matters, but the practical design questions are useful more broadly. Charity Commission financial-controls guidance.
Small teams need a workable division of responsibility
A two-person office cannot operate like a finance department with ten specialists. Copying a large organization’s manual may produce an impressive document and a routine everyone quietly works around.
Instead, identify where one person could both make an error and conceal it. Concentrate limited review time there.
An illustrative arrangement, not a Foundation policy: A program coordinator documents a purchase and confirms delivery. A bookkeeper prepares the payment and records it. A designated reviewer, who did not prepare it, examines the invoice and authorization before release. A separate volunteer with suitable financial experience reviews the monthly reconciliation and receives bank statements directly through authorized access.
Where only two people are available, duties may overlap. That limitation should be acknowledged explicitly. An independent director or outside accounting professional might periodically examine original statements, selected transactions and changes to suppliers. The review should be proportionate to the volume, complexity and risk of the work, with a clear record of what was checked.
The title “treasurer” does not automatically make a review independent. If that person prepared or released the payments being examined, the organization should recognize the overlap and arrange another check where possible. Likewise, an outside bookkeeper cannot independently review a process simply by checking their own work again.
Write down who acts when someone is on leave. A control that disappears whenever one person is unavailable is especially weak during the weeks when everyone else is stretched.
Choose thresholds without creating blind spots
Approval limits should reflect the organization’s circumstances, not a number copied from another charity. Consider the size of its resources, the frequency of payments, the reversibility of errors and any conditions attached to funding.
An illustrative approval example: A small organization sets a $500 threshold for an additional senior review of otherwise authorized purchases. A $640 invoice therefore receives that extra review. Two invoices of $320 for the same purchase still total $640 and should not be treated as unrelated transactions merely to avoid the threshold. These amounts illustrate a policy choice; they are not legal thresholds or recommended limits for every organization.
An amount-based rule also needs a way to recognize risks that do not depend on size. A first payment to a new supplier, an unexpected refund request or changed bank details can warrant additional verification even when the sum is small.
Routine approvals should be efficient enough that staff can follow them. Decide who can cover an absent approver and how quickly requests are normally reviewed. If an essential purchase regularly waits several days because nobody knows who can approve it, the process needs repair.
At the same time, urgency should have a defined route. Record why an exception was necessary, who authorized it and what follow-up is required. Repeated exceptions are evidence about the process. They should not become an unofficial second system.
Reconciliation asks a different question
Approval asks whether a payment should happen. Reconciliation asks whether the records agree with what actually happened.
Neither can replace the other. A correctly approved payment can be entered twice. A bank balance can reconcile perfectly while including a payment that was never authorized.
A worked illustration using invented amounts: At month-end, the accounting record shows $12,480 in a bank account. The bank statement shows $12,950. The difference is $470, but that figure alone does not explain the problem.
The reconciliation identifies an $800 check already recorded in the books but not yet cleared by the bank. It also identifies a $300 deposit recorded in the books but not yet credited on the statement. Both timing items are supported by records and subsequently checked for clearance.
- Bank statement balance: $12,950. - Less the outstanding check: $800. - Add the deposit in transit: $300. - Adjusted bank balance: $12,450.
The statement also shows a genuine $30 bank fee missing from the accounting record. After verifying and recording that fee, the book balance becomes $12,480 minus $30, or $12,450. The adjusted balances now agree.
The useful work was identifying and documenting the reason for each difference. Entering an unexplained $470 adjustment just to make the totals match would have concealed the questions rather than answered them.
A reviewer should examine the original statement, the reconciling items and the evidence for corrections. Old outstanding items deserve follow-up. An unexplained difference needs an owner and a resolution date, not indefinite residence in next month’s file.
Finally, a reconciled bank balance is not a statement of unrestricted spending power. Some of that money may be restricted, committed or needed for obligations already incurred. Reconciliation establishes agreement between records; financial planning must answer what the organization can responsibly spend.
Keep a trail that another person can follow
An audit trail connects a transaction to its purpose, evidence, authorization and final accounting treatment. The term sounds technical. The test is practical: can an authorized person reconstruct the decision without depending on memory?
Keep the invoice or other supporting evidence, the approval, the payment reference and any relevant explanation together or reliably linked. For a correction, retain what changed, why it changed and who made the change. Where software records edits automatically, understand what the history captures and who can alter or delete it.
The IRS says tax-exempt organizations must maintain records supporting receipts and expenditures and demonstrating compliance with tax rules. This duty remains even when an organization files Form 990-N or is not required to file a return. A small filing obligation does not mean there is no recordkeeping obligation. IRS recordkeeping requirements for exempt organizations.
Choose retention periods with appropriate advice and regard to applicable law, grant terms and other obligations. Avoid inventing one universal number for every document. Test whether records can actually be retrieved, including after a staff departure or software change.
Good documentation also respects privacy. An internal reviewer may need access to detailed records. A public report generally does not need bank account identifiers, personal circumstances or unredacted beneficiary information. Transparency means providing the right evidence to the right audience, with lawful protections intact.
Make oversight specific enough to be useful
Oversight becomes more effective when a report shows what remains unresolved, rather than presenting only clean totals.
A short financial review can identify which accounts have been reconciled, which approvals were missing, which exceptions occurred and which corrective actions are still open. Explain significant differences from budget. Give each unresolved item a responsible person and a next step.
For example, reporting that “all reconciliations are complete” is less useful if several contain old unexplained entries. Reporting that “two items remain unresolved, with supporting records requested and a review date agreed” gives the reviewer something concrete to assess. This is an illustrative reporting contrast, not a result from any particular organization.
The U.S. Government Accountability Office’s 2025 Green Book emphasizes preventive controls and responsibilities throughout an organization. It sets standards for federal agencies and can also be adopted by nonprofits as a framework. It should not be presented as a blanket legal requirement for every charity. GAO Green Book overview and 2025 revision summary.
An annual external audit, where required or commissioned, does not perform daily payment reviews. Nor does it relieve people of investigating a discrepancy found between reporting cycles. The organization still needs controls that work on ordinary Tuesdays.
The IRS likewise distinguishes thoughtful governance practices from universal federal mandates. Its guidance notes that tax law generally does not prescribe particular management structures or operational policies. Check the rules that actually apply, including state law, governing documents and funding agreements, before treating an example as a compliance checklist. IRS governance guidance.
A good check protects working relationships
A control is harder to sustain when people experience it as a personal accusation. Apply the same process to senior leaders, familiar suppliers and long-serving volunteers. Explain what the reviewer is checking and why.
When someone finds an error, correct the record and ask what allowed it to happen. Was the instruction unclear? Was the supporting document missing? Did the software allow the same invoice to be entered twice? Did someone override an established approval?
Those questions require care. A discrepancy is not proof of dishonesty. A credible concern about misuse, however, should not be dismissed as a misunderstanding merely because the person involved is trusted. Preserve relevant records, restrict access appropriately and seek qualified advice on investigation, recovery and any reporting duties. Avoid public allegations before facts are established.
Staff and volunteers also need a safe route to raise concerns outside the person whose conduct is in question. A review system loses its value if people believe asking a reasonable question will cost them their role.
Begin with one transaction and one monthly review
For a small organization, a useful first step is to trace one recent payment, one incoming donation and one bank reconciliation. Ask a person who was not involved to follow the evidence. Notice where explanations depend on memory or access only one colleague holds.
Then fix the most consequential gap, assign a backup and test the revised process. Review it again when funding grows, staff change or a new payment platform arrives. Training should show people how to complete the actual task, not simply ask them to acknowledge a policy.
Two sets of eyes cannot eliminate collusion, override or every mistake. They can create a dependable opportunity to notice, question and correct. That opportunity is worth designing carefully.
Charitable resources carry expectations from the people who gave them and responsibilities toward the people they are intended to serve. Protecting those resources is part of doing the work well. The mission benefits when care is shared, decisions can be explained and no one has to hold the entire system alone.
Accountants, nonprofit educators and organizations with a practical proposal to strengthen responsible operations are welcome to submit a partnership inquiry to Feel Worldwide Foundation Inc. Any collaboration would require review of mission fit, capacity, scope and agreed responsibilities. An inquiry does not establish an advisory engagement or partnership.
To support the Foundation’s broader work in education, livelihoods and community resilience, please consider making a donation. Review the available giving options and any stated purpose before choosing your contribution.
