In a lot of small nonprofits, the same person opens the mail, records the donation, and signs the checks. And maybe even reconciles the bank account at the end of the month. That person is often trustworthy, hardworking, and deeply committed to the mission. None of that changes the underlying problem. Trust is not an internal control.
When one person controls a financial process from beginning to end, without a second set of eyes on any part of it, you have created conditions where errors go undetected and fraud becomes possible. Not because of who that person is but because of how the system is structured.
Segregation of duties is one of the most important concepts in nonprofit financial management, and one of the most frequently skipped. This post covers what it means, why it matters, and how to build meaningful controls even when your team is small.
What Is Segregation of Duties and Why Does It Matter?
Segregation of duties is the practice of dividing financial responsibilities so that no single person has complete control over any transaction from start to finish. The logic is straightforward. If the person who requests a payment is different from the person who approves it, and different again from the person who reconciles the bank statement, then any error or intentional misuse must pass through multiple checkpoints. That makes problems far more likely to be caught early.
In larger organizations, this happens naturally. Different departments handle different parts of the financial cycle. But in small nonprofits, where a handful of people are doing the work of many, those natural separations often do not exist. The result is a structure that creates risk not out of negligence, but out of necessity.
The Association of Certified Fraud Examiners consistently finds that small organizations are disproportionately affected by fraud committed by employees, and that the median loss per incident is higher in smaller organizations than in larger ones. The reason is simple: smaller teams mean fewer controls, and fewer controls mean more opportunity.
The Core Elements of a Nonprofit Internal Controls Checklist
You do not need a large finance team to build meaningful controls. You need clear structure and consistent habits. Here are the foundational elements every nonprofit should have in place, regardless of size.
Separate authorization from execution. The person who approves a payment should not be the same person who processes it. Even in a two-person finance operation, this separation is possible and important.
Independent bank reconciliation. Someone who does not have check-writing authority should review and sign off on bank reconciliations monthly. This is one of the simplest and most effective controls available.
Dual signatures on checks above a threshold. Establishing a dollar threshold above which two authorized signatories are required adds a layer of oversight to your largest disbursements.
Restricted system access. Not everyone needs access to everything. Configuring your accounting software so that users can only access the functions relevant to their role reduces both error and opportunity.
Documented approval hierarchies. Decisions about who approves what should be written down and consistently followed, not informally understood.
Regular board review of financial statements. Board members reviewing actual financial statements, not just summaries, serves as an independent check on the information being produced by staff.
Protecting Your Staff, Not Just Your Organization
There is an important reframe worth making here. Internal controls are often presented as protection against bad actors. That framing misses something. Strong controls protect honest people too.
When one person handles the full financial cycle without oversight, they are also the first person suspected when something goes wrong. Even if they did nothing incorrect, the lack of controls makes it difficult or impossible to prove it. That is an unfair position to put anyone in.
Beyond that, research on fraud committed by employees consistently finds that many cases begin with small, rationalized decisions made by people under financial pressure. Controls do not just catch misconduct after the fact. They reduce the temptation by making it clear that the transaction will be reviewed.
Framing controls as infrastructure rather than surveillance changes how your team receives them. These are not policies that say we do not trust you. They are policies that say we have built a system where trust is not required to be blind.
Building Controls Without Adding Headcount
The most common objection to stronger internal controls in small nonprofits is straightforward: we do not have enough people to separate these duties. That is a real constraint, but it is not the obstacle it appears to be. A few approaches that work in practice:
Involve board members in specific oversight functions. The board treasurer or finance committee reviewing bank statements, signing off on reconciliations, or approving large disbursements is entirely appropriate and adds real oversight without adding staff.
Cross-train across departments. Program staff or operations staff can perform specific review functions, such as reviewing expense reports or reconciling petty cash, without needing deep accounting expertise.
Use technology to create separation. Many accounting platforms allow you to configure approval workflows that require a second user to authorize transactions above certain thresholds, regardless of team size.
Bring in an external review layer. An outsourced finance function can serve as the independent oversight that small teams cannot provide internally, reviewing reconciliations, approving disbursements at certain levels, and providing board-level financial reporting.
The goal is not a perfect system. It is a system where no single person has unchecked access to the full financial cycle. Even incremental progress toward that goal meaningfully reduces risk.
When was the last time your organization mapped out who controls what from start to finish? That conversation is worth having before there is a reason to have it.
