Nonprofit finance, plainly

One person touches all the money. Here is why that scares auditors

You are preparing for an audit, and the auditor keeps asking who opens the mail, approves payments, records transactions, and reviews the bank statements. The uncomfortable answer is the same person, often the person sitting across from them. This does not mean anyone has done something wrong. It means your organization has outgrown a financial setup that depends too heavily on trust without enough verification.

First, the honest version

Auditors worry when one person controls an entire financial process from beginning to end. In accounting, segregation of duties means dividing financial responsibilities so that no one person can authorize a transaction, handle the money, record it, and confirm that it was recorded correctly.

This is not a judgment about your employee’s character. Tiny nonprofits often arrive here for understandable reasons. There may be only two staff members. The executive director may be focused on programs and fundraising. The person who understands the bookkeeping becomes the person who does everything because that seems efficient.

The risk is not limited to theft. One person can make an ordinary mistake, enter something twice, pay the wrong amount, miss a deposit, or misunderstand a restriction without anyone noticing. Restricted funds are donations that a funder or donor has limited to a particular purpose. If those funds are tracked incorrectly, your reports may give the board and funders an inaccurate picture even when every dollar was spent honestly.

There are three separations that matter most.

First, separate approval from payment. The person who creates a bill payment, check, or electronic transfer should not be the only person approving it. Someone else should confirm that the expense is legitimate, supported by documentation, within budget, and paid to the correct recipient.

Second, separate receiving money from recording it. If one person opens checks, deposits them, and enters the deposits into the accounting system, there is no independent confirmation of what arrived. Another person should create or review a simple list of incoming checks and electronic deposits before they are recorded.

Third, separate recording from review. The person entering transactions should not be the only person reviewing the bank reconciliation. A bank reconciliation is the process of comparing the accounting records with the bank statement and explaining every difference. Independent review helps catch missing transactions, duplicate entries, unusual payments, and old items that never cleared.

With two staff members, perfect separation may be impossible. Auditors generally understand that. What concerns them is an organization that knows one person controls everything but has not added any other review. When duties cannot be fully separated, you need compensating controls, which are additional reviews that reduce the risk created by limited staffing.

What to do this week

Start by writing down who currently performs each money-related task. Include receiving checks, making deposits, entering bills, approving payments, signing checks, initiating electronic transfers, processing payroll, recording transactions, reconciling bank accounts, and reviewing financial reports. Do not write the process you think should exist. Write what actually happens.

Next, mark every process where one person performs all the steps. Focus first on cash receipts, payments, payroll, and bank reconciliations. These are the areas where a second set of eyes is most useful.

Then assign the executive director, board treasurer, or another appropriate board officer a small but specific review role. A reviewer does not need to redo the bookkeeping. They can examine the monthly bank statement, review canceled check images and electronic payments, compare payroll totals with the staff list, and sign or initial the completed reconciliation. The review should be documented so an auditor can see when it happened and who performed it.

Ask the bank whether account alerts can be sent to a second person. Useful alerts may include new payees, transfers, large transactions, password changes, and low balances. Keep the thresholds appropriate for your organization rather than copying another nonprofit’s limits.

For incoming checks, create a deposit log that lists the date, payer, purpose, and amount. Have one person prepare the log and another compare it with the deposit record and accounting entry.

Finally, put approval rules in writing. State who can approve expenses, who can initiate payments, when two approvals are required, and what documentation must be retained. If an exception occurs, document who approved it and why. A short procedure that people follow is stronger than a detailed policy that lives unread in a folder.

The free Month-End Close Checklist can help you organize the recurring reviews that should happen before monthly financial reports are considered complete.

The structural fix

Well-built books do not depend on one trustworthy person remembering every step. They create a visible path from approval to payment, from deposit to accounting entry, and from bank activity to monthly review. Responsibilities are assigned by role, documentation is stored consistently, and someone outside the daily bookkeeping process reviews the results.

For a two-person staff, that structure may include board participation. One employee can enter bills and transactions while the executive director approves payments. The board treasurer can review the bank reconciliation and monthly financial reports. Payroll changes can require written approval from someone who does not process payroll. Online banking access can be limited so that creating a payment and releasing it are separate actions.

The goal is not to build a large finance department. It is to make mistakes easier to catch, unusual activity easier to question, and good work easier to demonstrate during an audit.

If you need a clear starting point, the Nonprofit Financial Health Check is a $500 fixed-fee assessment of ten operational areas. You receive a written report the board can read, with practical priorities for strengthening the organization’s financial setup. The fee is credited in full toward the first month of any engagement.

Millennial M&C Co. provides nonprofit accounting and operational support. We prepare and present; your CPA files. Nothing here is tax or legal advice for your specific situation.