If you’ve ever sat through a workshop on segregation of duties or accounting checks and balances wondering how on earth to implement such things without a mega-staff, take heart. You can make a big difference if you implement just a few key internal controls, says California nonprofit auditor Carl Ho writing for Blue Avocado.

Set the control environment

The top thing to do, he advises, is to set policies and expect everyone to follow them. There can be no exceptions, not even for the top person. When even the most senior people (whether board or staff members) have to use timesheets, get approval for travel expenses, and submit receipts to justify every expense claim, the charity’s expectations become very clear.

Define responsibilities

Ho has found that organizations often lack documentation for their processes. That leads easily to the assumption that “someone else will do it” (check the arithmetic, verify the invoice and so on). Have a written list of key responsibilities with a specific name beside each.

Maintain physical controls

Lock up your computers, your data and your cheques. That means not only passwords on computers, but locks attaching the computers to the desks. Putting cheques into a locked drawer means that no one can take cheques from the middle of the chequebook.

Count cash in pairs

Always have two people count cash. That protects both the organization and the counters.

Reconcile bank statements

If embezzlement is happening, reconciling the bank statement almost always reveals it early in the game. Whoever reviews the bank statement should receive it unopened after it arrives in the mail and look it over carefully before handing it on to the bookkeeper. It’s fine for the initial reviewer to be a member of the board; in fact, with few or no staff, it may be necessary.

Other common controls

Small organizations are actually safer from one common type of payroll fraud, Ho notes. When everyone knows everyone, it’s harder to create sham employees and write them paycheques. Be sure to pay attention to timesheets – have someone who actually knows what work the hourly employee did approve the record.

Requiring two signatures on cheques ensures that someone else sees the large cheques before they’re sent out. Ho warns that banks don’t necessarily enforce that policy, nor can they be held liable if they process a cheque with only one signature.

If possible, don’t allow the person who handles the money to sign cheques. When that isn’t practical, then set a fairly low limit on the dollar amount of the cheques and reserve them for emergencies.

No organization is too small to have someone reviewing expenses, bank statements and government remittances periodically. Combine that with an emphasis on high accountability and following procedures, Ho concludes, and you’ll catch problems before they’re serious.