%202.svg)
Internal controls protect a nonprofit's money, reputation, and 501(c)(3) status. Get the five components, the core controls, and a usable checklist.
Last updated: June 29, 2026
Internal controls are the written policies and routines a nonprofit uses to safeguard its money, keep its records accurate, and prevent misuse of funds. Money changes hands constantly in a nonprofit through donations, grants, purchases, payroll, and reimbursements, and weak controls put both the organization's reputation and its 501(c)(3) status at risk.
The good news is that strong internal controls do not require a large finance team or complicated systems. They require clear rules, consistent habits, and a second set of eyes where one person cannot handle every step alone.
Internal controls are the checks and balances on staff, board members, and outside vendors that reduce the risk of error, theft, and misappropriation. They fall into two broad categories that work together.
Preventive controls stop a problem before it happens, such as requiring written approval before a purchase is made.
Detective controls catch a problem after the fact, such as an independent review of the monthly bank statement.
Both types matter. A nonprofit with only preventive controls may miss ongoing issues, while one that relies only on detective controls often discovers problems too late to prevent damage.
Controls scale to the size of the organization. A two-person shop and a fifty-person organization need the same core principles applied at different levels of formality.
The goal is never perfection on paper. It is reliable protection that actually works when real people handle real money under real pressure.
For a broader view of how these controls fit into overall financial operations, see our guide on nonprofit expense management best practices.
Donors and grantors expect their money to be stewarded well, and a clean control environment is how a nonprofit demonstrates that commitment in practice. The board carries a fiduciary duty to protect the organization's assets and mission, and internal controls are how that duty becomes daily reality rather than a statement in the bylaws.
Strong controls also make audits, grant reviews, and Form 990 preparation far less painful because the records are already organized and the transactions already documented.
Perhaps most importantly, good controls let leaders delegate spending with confidence. When the rules are clear and the visibility is real, staff and volunteers can act quickly without creating hidden risk. Controls are guardrails that protect the mission, not red tape that slows it down.
The recognized framework for internal control comes from the Committee of Sponsoring Organizations of the Treadway Commission, often called COSO. Nonprofits of every size benefit from applying these five components, even if they never use the formal name. Here is how each one shows up in practice.
These components are not a one-time project. They form a cycle that repeats as the nonprofit evolves. For deeper reading on the official framework, visit the COSO website.
Most of the controls below are either preventive or detective, and a healthy organization runs both. The strongest systems combine clear rules that stop problems before they start with independent checks that catch anything that slips through.
The cornerstone control is simple in principle: the person who authorizes a transaction, the person who records it, and the person who holds or has access to the asset should not be the same individual. In practice this means the person who opens the mail and logs incoming checks should not also make the bank deposit.
The person who prepares payroll should not also distribute or sign the checks. When these duties sit with one person, that individual can both create and conceal errors or misuse.
Small and mid-size nonprofits rarely split every duty cleanly across separate people. That reality leads directly to the next set of practices.
When full segregation is not possible, add a second set of eyes through compensating controls that do not require extra headcount. A board member or treasurer reviews the monthly bank statement before the bookkeeper files it.
A second person, not the bookkeeper, receives the unopened statement from the bank. The board or finance committee runs an occasional surprise review of how cash and checks move through the office.
These steps add independent verification without adding staff. The key is that the reviewer must have enough knowledge to spot problems and enough independence to act on them.
Real-world example: A private Christian K-12 school with ~540 students and ~100 staff previously relied on just five shared cards across the entire campus (including a children's center). Staff often played "hide and seek" to locate a card, leading many teachers to front purchases personally and request reimbursements.
After implementing 60+ individual and loaner cards with per-person budgets and real-time visibility, the school reduced lost or chased receipts from roughly five per week to fewer than five across seven months of the school year. Month-end credit card reconciliation dropped from a lengthy manual process to just a few minutes of weekly checks.
Written approval rules and thresholds make expectations consistent. Define who can approve what and at what dollar amount the decision moves up a level.
Require expenses to be approved in advance and in writing whenever possible, with a receipt required above a modest threshold. Keep the rules simple enough that staff will actually follow them rather than work around them. Approval workflows that fit how your team already operates reduce both risk and friction.
Many nonprofits get purchasing controls wrong because they focus on the physical card rather than the authority behind it. A high-limit card kept in a drawer and checked out by staff feels like control, but the person holding it can spend far beyond what they were authorized to spend.
Real control ties a right-sized budget to each person who spends so the amount they can spend matches the amount they were approved to spend. A detective layer strengthens it further: real-time visibility means finance sees a charge the moment it posts, not weeks later when the statement arrives.
One school finance office put this into practice by giving administrators a self-loading limit they could manage within their own budgets, with anything above a set threshold routing automatically for higher approval. Classroom teachers received smaller fixed limits for day-to-day supplies.
Shared visibility across the team let finance spot and resolve questions quickly. The result was fewer lost receipts, faster month-end work, and spending that stayed aligned with approved budgets. Explore spend management tools designed for these exact controls.
Monthly reconciliation is a core detective control. Someone independent of the person who records transactions should review the reconciliation for completeness and accuracy.
The most common failure is the bookkeeper reconciling their own work with no second review. Connecting cards and bank activity directly to the accounting system shortens the close and reduces manual entry errors that create their own control problems.
Sync with your accounting software turns reconciliation from a monthly scramble into a routine check.
Writing controls down makes expectations clear and consistent across staff and volunteer turnover. Require receipts and vendor invoices with enough detail to show what was purchased and why.
Maintain a written reimbursement policy that treats the person being reimbursed as a vendor and tracks those payments separately from payroll. This separation keeps bank reconciliation clean and avoids unnecessary payroll-tax complications.
Keep receipts matched to every transaction so the audit trail stays intact.
Donor-restricted gifts can only be spent on their stated purpose. Controls must keep restricted money separate in both the records and the actual spending so it does not accidentally support general operations.
Without clear tracking, restricted dollars can be spent on the wrong things, creating both a compliance problem and a donor-trust problem. Tracking restricted funds protects both the money and the relationships that generated it. For more on this critical area, see our guide to tracking restricted funds in a church or nonprofit.
The governance layer sits above day-to-day operations. The board or finance committee reviews financial statements on a regular schedule, approves the annual budget, and adopts the organization's control policies.
A conflict-of-interest policy signed annually by board members is a basic board-level control because board members have a fiduciary duty to act in the organization's interest rather than their own. The IRS asks about governance practices on Form 990, so good oversight also supports clean filings. Learn more about church and nonprofit spending controls.
Use this checklist as a starting point and adapt it to your organization's size and activities.
These gaps appear frequently and are straightforward to close once named.
One person controls authorizing, recording, and holding money. Segregate the duties you can and add independent review for the rest.
No one but the bookkeeper sees the bank statement. Route the unopened statement to a second person for review before it reaches the bookkeeper.
High-limit cards sit unused with no budget tied to the holder. Replace the shared high-limit card with right-sized budgets per person so actual spending authority matches approved limits.
Reimbursements run through payroll and muddy the books. Set up the person being reimbursed as a vendor and pay by ACH on a separate track from payroll.
There is no conflict-of-interest policy. Adopt a simple policy and have board members and key staff sign it annually.
Receipts go missing and no one follows up. Require photo capture at the point of purchase and use automated reminders or temporary card locks when documentation is late.
The board reviews financials once a year, if that. Move to a quarterly or monthly review schedule so problems surface while they are still small.
Responsibility is shared across layers. The board sets policy and provides oversight through regular financial reviews and approval of major decisions.
Executive leadership designs the specific controls and enforces them in daily operations. Staff follow the procedures and document their work so the audit trail stays complete.
An outside auditor or accountant tests the controls independently and reports on any material weaknesses.
Controls fail when any one layer assumes another layer has it covered. The board cannot delegate oversight entirely to staff, and staff cannot assume the board will catch every issue. Clear communication across these layers keeps the system working even when people change roles.
Internal controls are the written policies and routines that safeguard assets, keep records accurate, and prevent misuse. They include segregation of duties, spending approvals, reconciliations, documentation requirements, and board oversight.
These practices reduce the risk of error and misappropriation while making financial reporting more reliable.
The five components are control environment, risk assessment, control activities, information and communication, and monitoring. The control environment sets the ethical tone and clear roles.
Risk assessment identifies where problems are likely to occur. Control activities are the daily actions such as approvals and reconciliations.
Information and communication ensure accurate records reach the right people on time. Monitoring confirms the controls continue to work and adjusts them when needed.
The 33% rule is the IRS public support test. A 501(c)(3) public charity generally must receive at least one-third of its total support from the general public or government sources over a rolling five-year period to maintain public charity status rather than being reclassified as a private foundation.
A 10% facts-and-circumstances test offers an alternative for organizations that fall slightly short. New nonprofits are not tested until their sixth year. Learn more from the IRS.
The 80/20 rule is a common benchmark used by watchdogs and some donors, not a legal requirement. It suggests that roughly 80% of spending should go to program activities and no more than 20% to overhead and administration.
The exact ratio varies by organization type, size, and stage of growth. A healthy nonprofit funds the overhead it needs to deliver its mission effectively rather than chasing an arbitrary percentage.
Review internal controls at least once a year and again whenever a key finance role changes or the organization grows significantly. Role changes are the moment when informal workarounds and assumptions quietly stop working, so a fresh look prevents gaps from widening unnoticed.
The highest-risk areas are almost always who can access the money and who can authorize spending it. Segregate the duties you can, add a second set of eyes where you cannot, and write the rules down so they survive staff and volunteer turnover.
Real organizations see measurable improvements when these principles are put into daily practice. Nonprofits that pair strong foundational controls with modern spend management tools often find the process becomes lighter rather than heavier.
Preventive controls (clear approval thresholds and right-sized per-person budgets) and detective controls (real-time visibility, automated receipt capture, and independent reviews) work together seamlessly.
For example, the K-12 school referenced earlier staged its rollout deliberately. Starting with the operations department (maintenance, IT, and vehicles) helped iron out workflows.
Then the team expanded to administrators, and finally to teachers and coaches. They now use self-loading limits for admins (with escalation above $5,000) and labeled loaner cards tracked on a dashboard.
Amazon purchases sync automatically with line-item detail and receipts. This eliminates the old "Amazon, $X — go figure it out" reconciliation headache.
If your nonprofit wants spending limits, approvals, real-time visibility, and receipt automation built into the tools your team uses every day, explore how KleerCard supports these exact internal controls for nonprofits and schools.
Ready to strengthen your controls without adding complexity? Sign up for free or schedule a demo to see the platform in action.
Speak to a member of our team and we can have you up and running in minutes, not weeks.
