The Financial Controls Most Small Nonprofits Don't Have Until Something Goes Wrong

Earlier this year an eight-person nonprofit came close to wiring a grant payment to a stranger. An email showed up on an existing thread with a partner organization, from the right name, saying the partner's bank details had changed. The finance staffer called the partner before sending anything and learned their email had been hacked. That phone call was the only thing standing between the organization and the loss, because there was no IT person and no written rule that said to verify a change like that by phone. There was just one employee who happened to be careful that day.

I have worked with nonprofits for more than 25 years, and versions of this story come up in nonprofit forums every month. Most of them do not end as well.

Why the pressure is higher this year

Small nonprofits have always been thin on financial oversight. The typical setup is an executive director who came up through programs, a volunteer treasurer who sees the numbers once a month, a part-time bookkeeper, and QuickBooks. That arrangement holds together as long as money is reasonably steady and nobody important leaves.

Neither of those is a safe assumption anymore. The Nonprofit Finance Fund's 2025 survey found 36 percent of nonprofits ended the year with an operating deficit, the highest share in the ten years they have asked the question. The Center for Effective Philanthropy's 2026 survey of nonprofit CEOs put it at 39 percent, up from 22 percent four years earlier, and half of the organizations in the NFF sample had three months of cash or less.

When money is tight, boards start asking harder questions about where it went, funders and auditors start asking for evidence that controls exist, and the people who kept everything straight in their heads start leaving. Nonprofits cut more than 28,000 jobs in 2025, about five times the previous year's number.

The fraud attempts are also getting better. Community IT, which supports a few hundred nonprofits, reported spear phishing up 29 percent and brute-force login attempts up 54 percent in one year, and its 2026 report described a new round of scams: fake invoices with ACH details, fake copyright notices, fake job offers from HR. Their takeaway was that insurers, auditors and funders now want to see written controls rather than take your word for it.

"Finances is a struggle for me"

An executive director with a program background wrote that recently, after discovering a large deficit her predecessor had left behind. A CFO in the same thread told her that finances are what make or break small nonprofits, and another commenter said this environment is taking organizations down.

I bring it up because the people responsible for a small nonprofit's money are rarely finance people. They are social workers and educators and shelter managers who became the ED because they were good at the mission. Nobody handed them a list of what financial oversight requires, so they inherit whatever the last person did and hope it was enough.

In a different thread, a board treasurer posted a monthly oversight checklist he had built himself and asked what he was missing. He should not have had to build it from scratch, and that is really what this post is about.

What internal controls are, in plain terms

Once you strip away the audit vocabulary, internal controls are a handful of habits that make it hard for any one person to lose or take the organization's money without someone else noticing. For a small shop, these are the ones that matter most.

Separate the hands. The person who records a deposit should not be the only person who opens the mail, and the person who approves a payment should not be the one who enters it. With three staff this can feel out of reach, but a board member can receive the bank statements and a volunteer can log incoming checks before the bookkeeper sees them. You are aiming for two sets of eyes on every dollar in and out, and one of those sets can belong to someone unpaid.

Verify every payment change by phone. If a vendor, partner, grantee or employee says their bank details changed, someone calls a number you already had on file, never the number in the email. Write this down as a rule so the next person follows it without having to be told.

Reconcile monthly, with a second person looking. Bank reconciliation is where both errors and theft tend to surface. The treasurer or a finance committee member should see the reconciliation and the actual bank statement side by side each month rather than a summary someone prepared.

Decide who can approve what before you need to. A written spending authority that says who can approve what, up to what amount, and what needs two signatures or a board vote. Most small nonprofits carry this around in their heads and nowhere else.

Lock down the accounts. Multi-factor authentication on the bank, payroll, the donation processor, and the email of anyone who touches money. Remove access the day someone leaves. It is common for a former board member or a departed ED to be the only administrator on something that matters.

Keep restricted money restricted. If a grant was given for a program, you need to be able to show it was spent on that program. A simple fund tracker or the class feature in your accounting software is enough. Spending restricted funds on general operations, even by accident, is how good organizations end up in uncomfortable conversations with funders.

Write it down and have the board adopt it. Controls that live in one person's habits leave when that person does. A two-page policy the board has voted on survives turnover, satisfies auditors, and gives a new ED something to point to when a longtime board member says this is how we have always done it.

If you are starting from nothing

Do not try to produce a full financial policy manual this quarter. Pick the three items above that would have hurt most if they had been missing last year, put them in place this month, and document them on a page. The rest can come over the next two board meetings.

If you are a new ED who inherited a mess, the same list works as a diagnostic. Sit down with your treasurer and mark each item as in place, in someone's head, or missing. That conversation usually tells you more about the organization's real condition than the financial reports do.

Mark each control honestly. The middle column is the one to worry about. Click to open full size.

A checklist to work from

I put together an Internal Controls Checklist for this exact situation: a small nonprofit that wants to know what good looks like without paying an auditor to tell them. It covers cash handling, payments and approvals, bank and credit card reconciliation, payroll, restricted funds, account access, and board oversight, with notes on how to handle each when you have three staff instead of thirty. It is meant to be worked through with your treasurer in one sitting.