Nonprofit Internal Controls Checklist: A Practical Guide

A nonprofit internal controls checklist helps a team protect its funds, records, and ability to serve its community. Internal controls are the everyday policies and habits that reduce mistakes, make responsibilities clear, and help people notice concerns early. They do not need to be complicated. A small organization can start with clear roles, a few consistent review steps, and written records of what was decided.

Explore community partnership opportunities

What belongs on a nonprofit internal controls checklist?

A useful checklist is a working tool, not a promise that fraud or errors can never happen. It records who does each task, what evidence is kept, and how another person checks the work. The right safeguards depend on the organization’s size, funding conditions, technology, and applicable legal or accounting requirements. Treat this guide as a starting point, then ask a qualified accounting or legal professional about issues specific to your organization.

At a minimum, review these areas:

• Roles and approvals: Who can request, approve, pay, record, and review transactions?
• Cash and deposits: How are donations and other receipts counted, documented, and deposited?
• Purchases and reimbursements: What evidence and approvals are required before money is paid?
• Bank and card access: Who has access, how is access reviewed, and who checks statements?
• Accounting records: How are transactions entered, reconciled, and reported?
• Information and documents: How are financial files stored, shared, retained, and disposed of?
• Oversight and follow-up: How do leaders review exceptions and track corrective actions?

The National Council of Nonprofits’ internal controls guidance emphasizes basic safeguards, including careful control over who can access nonprofit bank accounts. San Francisco’s Internal Controls for Small Organizations is another practical reference for discussing and assessing controls. Use these resources to inform a conversation, not as a substitute for rules that apply to your organization.

Make the checklist specific enough to use. For each activity, write down the trigger, the person responsible, the record produced, the reviewer, and the timing. For example, for a reimbursement, the trigger is a staff member submitting an expense; the record is an itemized receipt and business purpose; and the review is approval by someone other than the person requesting repayment. Add a space for exceptions and follow-up. This turns a general list into a simple reference that helps a new volunteer understand what to do without relying on informal memory.

It can help to mark each item as documented, consistently followed, or needing attention. Do not label a control complete simply because a policy exists. Compare the written procedure with what people actually do. If the policy requires an independent review but no one can explain when it last happened, the next step is to clarify ownership and create a record of reviews going forward.

How should a nonprofit assign financial responsibilities?

Begin by listing recurring financial activities. Include receiving donations, entering gifts, approving invoices, making payments, handling cards, reconciling accounts, preparing reports, and reviewing budgets. Write down the person responsible for each activity and the person who reviews it. Naming roles rather than relying on informal assumptions makes it easier to cover absences and manage transitions.

When possible, avoid having one person control every step of a transaction. For example, a person who approves a purchase should not also be the only person who pays it, records it, and confirms that the bank statement is correct. A second person can review documentation or the monthly account reconciliation. That division of duties is a practical safeguard, not a judgment about anyone’s character.

Small nonprofits may have too few people to separate every task. In that case, use a compensating review: a board treasurer or another authorized leader who is not processing the transaction can review bank activity, receipts, and reconciliations. Set a schedule, decide what the reviewer will see, and keep a record of the review. If one person must temporarily cover several roles, document the reason, the period, and the extra review in place.

Put approval limits and role assignments in a written policy or board-approved procedure. Explain how to approve routine expenses, unusual purchases, contracts, and payments to people with a potential conflict of interest. The policy should say who steps in when the usual approver is unavailable. Keep the process understandable enough that staff and volunteers can follow it consistently.

A short responsibility map can reveal gaps before they cause confusion. Trace one sample transaction from start to finish. Suppose a program lead needs supplies: who confirms the need and funding source, who approves the order, who verifies delivery, who checks the invoice, who releases payment, and who records it? If the same person performs several steps, identify the separate review that will compensate. Also name a backup for critical tasks such as payment approval or reconciliation, and ensure that backup access is granted only when needed and removed when the coverage period ends.

How can a team safeguard donations and other receipts?

Make the path from receipt to deposit visible. For checks and cash, record what arrived, when it arrived, and who handled it. When two people are available, have them count cash together and compare the count with the supporting record. Provide a receipt or acknowledgment when appropriate, and store funds securely until they can be deposited.

For online gifts, ticket sales, or other digital receipts, limit account access to people who need it. Assign an administrator to remove access when a role changes. Compare platform reports with bank deposits and accounting records on a regular schedule so missing, duplicated, or misclassified transactions can be investigated promptly. Keep a clear record of any differences and how they were resolved.

Donation restrictions and designated purposes also need a reliable record. Capture the donor’s instructions, make the restriction visible in the accounting system, and include it in the relevant financial review. The control objective is to make it possible to trace a receipt to its deposit and its proper accounting treatment. When recording funds raised through an event such as a charity bike ride for autism, document event receipts and ensure designated gifts are traceable to the appropriate accounting treatment.

Use a simple receipt-to-record test during a periodic review. Select a deposit and follow it backward: does the bank statement amount agree with the deposit record, and can the team locate the count sheet, platform report, or other supporting detail? Then trace a few individual gifts forward: are they recorded under the correct date and purpose, and can the deposit containing them be identified? The point is not to inspect every gift every time. A small sample can show whether records connect clearly and whether discrepancies are addressed rather than carried forward.

What controls help with purchases, reimbursements, and cards?

Set a predictable process before a purchase is made. A request should explain what is needed, how it supports the organization’s work, the expected amount, and the proposed funding source. The right person approves it before commitment. For reimbursements, ask for an itemized receipt, business purpose, date, and approval from someone other than the person being reimbursed. Establish a reasonable submission deadline in writing and apply it consistently.

For cards and online payment accounts, define authorized users and acceptable uses. Do not share credentials when an account can provide individual logins. Require receipts and descriptions for transactions, review card statements promptly, and remove access when it is no longer needed. If a card is lost or a suspicious payment appears, staff should know whom to contact and how to report it without delay.

Use a simple approval matrix that matches your capacity. Here is an example framework to adapt; the roles and thresholds are placeholders, not recommended dollar limits:

Activity	Person initiating	Approval or review	Record to retain
Routine budgeted purchase	Staff member or authorized volunteer	Designated supervisor or budget owner, before purchase	Request, approval, invoice or receipt
Reimbursement	Person requesting repayment	Another authorized person, before payment	Expense form, itemized receipt, approval
New vendor or contract	Program or operations lead	Authorized leader or board delegate under written policy	Business purpose, review, agreement, approval
Monthly bank reconciliation	Assigned bookkeeper or finance role	Separate reviewer where feasible	Reconciliation, statement, evidence of review
Unusual or urgent payment	Requesting program or staff lead	Alternate authorized approver plus later documented review	Reason for exception, approval, supporting documents

Review the matrix when responsibilities change or a new type of payment is introduced. Keep it aligned with the organization’s governing documents, grant conditions, and financial policies. A table that no one understands or follows is less useful than a short procedure people can apply.

For each payment route, tell people what to do when required documentation is delayed or unavailable. A lost receipt should not be silently replaced with an unsupported estimate. The person requesting repayment can provide a written explanation, and an authorized reviewer can decide whether the record is adequate under policy. Note the decision and any corrective action. For a recurring vendor payment, keep the approved agreement or invoice schedule accessible, then verify that the payment matches the agreed service and period before release.

How should a nonprofit review bank accounts and records?

Reconcile each bank and payment account on a regular schedule. The reconciliation compares the statement with the accounting records and identifies timing differences, unfamiliar transactions, duplicate entries, or errors. Assign preparation and review roles. The reviewer should have access to the underlying statement and supporting records, not only a summary showing that the work is complete.

Leaders should also receive financial reports often enough to make informed decisions. A useful review may compare actual income and expenses with the approved budget, explain significant differences, and flag cash-flow or funding concerns. Ask questions in a constructive way: What changed? Is the difference temporary or ongoing? Does the plan need an adjustment? Record the discussion and any follow-up task, owner, and due date.

Restrict access to accounting platforms, banking, donor records, and shared storage according to each person’s role. Use individual accounts where available, strong authentication, and prompt removal of access after a role ends. Keep backup and recovery processes documented. Avoid sending sensitive financial information through channels that are not approved for it.

A reliable month-end routine makes financial review less dependent on memory. A simple sequence could be: gather statements and platform reports; enter and categorize transactions; match deposits and payments to supporting records; prepare reconciliations; have a separate person review important accounts and unusual items; then prepare a concise report for leadership. If the person preparing a reconciliation also handles payments, the independent reviewer should receive the actual statement and enough detail to follow the work. Keep a dated checklist or file showing each completed step, open question, and resolution.

When a reviewer finds an unfamiliar transaction or a difference that does not clear, record the issue without jumping to a conclusion. Note the date found, the amount or record involved, who is following up, and the date for another check. The reviewer should confirm that the correction appears in the accounting records and that any needed access or procedure change has been made. A visible follow-up log prevents an unresolved question from disappearing between meetings.

What should written policies and records cover?

Written procedures turn good intentions into repeatable practice. A lean finance policy can describe:

• Who may approve spending, sign agreements, and access accounts.
• What documentation is required for purchases, reimbursements, deposits, and adjustments.
• How often accounts are reconciled and who reviews the work.
• How restricted funds, conflicts of interest, and unusual transactions are handled.
• Where records are stored, who can access them, and how retention decisions are made.
• How to report suspected errors, misuse, or missing documentation.
• How policies are reviewed, approved, and communicated to staff, volunteers, and board members.

Keep the supporting record proportional to the transaction. It should let a reviewer understand what happened, why it was authorized, and how it was recorded. Use consistent file names or a simple index so a receipt or approval can be found later. Do not keep unnecessary sensitive information simply because it is easy to store; follow applicable law, funder terms, and professional advice when setting retention and disposal practices.

Good documentation should not turn routine work into a barrier. Create accessible forms and explain what fields matter. When people understand the reason behind a step, it is easier to complete it and to raise a question when something does not fit.

Before approving a new form or policy, test it with the people who will use it. Ask a staff member to complete a sample purchase request, and ask the reviewer to locate the relevant approval and receipt afterward. If either person has to guess what a field means or where a record belongs, simplify the instructions. Give volunteers a brief orientation when they take on finance-related tasks, and keep the current version of procedures in a shared location with clear access rules. Retire outdated copies so a former approval path is not followed by mistake.

How can small teams handle exceptions and concerns?

No checklist predicts every situation. A late invoice, urgent repair, absent approver, or unexpected gift may require an exception. The key is not to pretend the process was followed when it was not. Record the circumstances, who authorized the action, the supporting evidence, and who will review it afterward. Consider whether the exception points to a procedure that needs clarification.

Make it clear how a staff member or volunteer can report a concern. Identify a contact outside the normal approval chain for situations involving that approver. Leaders should respond promptly, preserve relevant records, and avoid making assumptions before understanding the facts. For suspected theft, fraud, legal violations, or safety risks, seek appropriate professional and legal guidance. Do not attempt to investigate beyond the organization’s authority or promise confidentiality that cannot be guaranteed.

Review whether a control is working as intended. If a required receipt is routinely missing, find out whether the process is unclear, the form is hard to use, or people need training. Strengthening a control often means making it easier to follow, not adding another layer of paperwork.

It is useful to distinguish a one-time exception from a pattern. If an urgent payment happens once, document why the normal approver was unavailable and complete the planned later review. If the same exception happens repeatedly, discuss whether the normal process has an impractical timing or coverage gap. Update the procedure only after an authorized review, tell everyone affected, and set a date to check whether the revised method is followed. This keeps flexibility from becoming an undocumented substitute for approval.

How often should you revisit this checklist?

Review the checklist at least as part of the organization’s regular financial-policy cycle, and sooner when an important change occurs. Examples include a new bank or fundraising platform, a different accounting system, a new grant requirement, a staff transition, a significant change in transaction volume, or an incident that exposed a gap.

1. Assign an owner. Ask a board finance lead, treasurer, executive, or other appropriate role to coordinate the review.
2. Walk through real processes. Trace one recent receipt, purchase, reimbursement, and reconciliation from start to finish.
3. Identify gaps. Note missing approvals, unclear ownership, access that is no longer needed, or records that are hard to find.
4. Choose manageable improvements. Prioritize a few clear steps rather than trying to rewrite every procedure at once.
5. Document and communicate. Update the policy, tell affected people what changed, and provide a way to ask questions.
6. Check completion. Set a date to see whether the new process is being followed and whether it creates new obstacles.

One practical way to pace the review is to focus on a few related controls at a time. A team might first confirm account users and backup approvers, then review its deposit records, and then test a month-end reconciliation. For each finding, identify whether the risk is urgent, whether a temporary safeguard is needed, and who can approve the permanent change. Avoid changing several procedures at once without telling the people who carry them out; a clear transition date and short explanation can prevent old and new rules from being mixed.

For organizations whose work includes events and fundraising, controls should cover the entire cycle: planning, collecting funds, paying vendors, documenting expenses, and reconciling proceeds. Bike to the Beach brings cycling and charitable giving together through community events that support local autism and disability organizations. Its Why We Bike stories offer context about community impact; the financial procedures for any nonprofit should still be tailored to its own activities and obligations.

Teams can also make sure their fundraising workflows are documented alongside financial controls. A practical bike fundraising events resource can help readers explore the event context, while internal procedures should specify who records incoming funds and who independently reviews the records. For ride participants, the event navigation information illustrates one kind of operational detail organizations may communicate clearly; it is separate from the financial control process.

Learn about community partnership opportunities

Frequently Asked Questions

What are the most important internal controls for a small nonprofit?

Start with clear responsibility for approvals, secure access to bank and payment accounts, documented receipts and payments, regular account reconciliation, and an independent review when feasible. The exact combination depends on the organization’s size and activities. Written procedures and a documented compensating review can help a small team manage duties that cannot be fully separated.

Can one person handle bookkeeping and payments?

Some small organizations have limited staff, but concentrating every step with one person makes independent review especially important. Another authorized person can inspect statements, supporting records, and reconciliations on a schedule. Document the review and ask an accounting professional to help assess the arrangement where needed.

How often should nonprofit bank accounts be reconciled?

Set a regular schedule appropriate to the organization’s transaction volume and obligations, and make sure the reconciliation is reviewed. Many organizations include reconciliation in their monthly close, but circumstances differ. Follow funder requirements and professional advice if they call for a different process.

Does a checklist guarantee that funds are safe?

No. A checklist supports consistent work and makes responsibilities visible, but it cannot eliminate every error or misuse. Staff training, leadership attention, access reviews, and follow-up on exceptions all matter. Revisit procedures as the organization changes.

Where should a nonprofit start if it has no written controls?

Map how money currently comes in and goes out. Assign an owner and reviewer for the most important steps, document basic approval and recordkeeping expectations, then schedule a review. Begin with a manageable set of controls and seek qualified guidance for legal, tax, accounting, or grant-specific questions.

Ready to connect your organization with community impact?

Strong internal controls help a nonprofit steward resources thoughtfully and keep its attention on the people and communities it serves. If your organization is exploring ways to engage with Bike to the Beach, learn more about its community partnership opportunities.

Explore service provider partnership opportunities

Use this checklist as a starting point, adapt it to your organization’s real work, and make time to review whether each safeguard is clear, practical, and consistently followed.