Trust is Not an Internal Control
by Jaime Campbell, CPA Tier One Services –
February 9, 2018
The three sides of the fraud triangle are incentives/pressures, rationalization and opportunity. When these three lights switch to green for a nonprofit, it’s just a matter of time before funds or in-kind donations disappear, donor funds never show up or the organization’s funds are used to buy personal liquor (true story).
Segregation of duties plays a significant role in preventing fraud because collusion is then required in order to perpetrate the fraud, and that is both risky for the would-be perpetrator and more difficult to pull off.
In the context of fraud prevention, the three types of duties being segregated are authorization, recordkeeping and custody. Those with authorization duties decide if a vendor invoice is legit, how much to charge a member and when to write off an unpaid donor balance. Those with recordkeeping duties enter transactions into the accounting system, and those with custody duties move money and other assets.
Make sure there are enough people to cover the three segregated duties. Even in a startup nonprofit, there are at least three people, if only to legally open the organization. Consider that two of the three functions do not require any accounting knowledge: authorization and custody. This opens up the ability for your startup team to develop internal controls.
Make sure there are backup people in case someone isn’t available. Segregation of duties is about the opportunity side of the fraud triangle. It’s not about having two executive directors. It’s about a plan B in case something happens, temporarily or permanently, to the person in charge of that function. With documented processes, this can be seamless.
Make sure your team members know where their duties end. Even in a high-collaboration environment, don’t let the waters get muddied. Overstepping happens in organizations with too few people, but it also happens in larger organizations in which people have been promoted from within; it can be tempting for people to lend a hand with a function they used to handle. They shouldn’t.
Fluid communication is key, especially if you’re moving your organization from one person trying to handle it all to a full accounting team with segregated duties.
Evaluate how clear everyone is about the flow of financial information. Then consider: how seamlessly could a new team member start performing those duties?
Process documentation can include flowcharts, screencasts, videos, screen-shots, photos, prose, bullet-point lists and checklists. Update documentation when a process or policy changes.
Use physical or digital places for moving and storing information so it is available to the right people on a timely basis. Remember that the backup person will need to access this information as well.
Segregation of duties does not mean segregation of all information. Don’t store data on local computers; use a shared information environment (SharePoint, ShareFile, server). Rather than individual to-do lists, use a team tool (Asana, Wrike). Quickly get information in the payables cycle, for example, from authorization (the bill is legit) to recordkeeping (record the payable) to custody (pay the bill) to recordkeeping (record the payment).
Some accounting software includes an approval function for payables (Xero), and there are apps that include an approve button (Bill.com, Mineral Tree). Apps such as Entryless and Expensify can also assist with easily securing expense documentation.
Any audit trail, be it in a bank account, accounting records or app, is only useful if the users have unique IDs and passwords, and those passwords are not shared.
Attaching backup to transactions in the accounting system is a must. Even with approvals via signature on paper, it’s difficult to see that transactions are substantiated if the files are maintained on paper and/ or in a system that is separate from the accounting records. Keep them together by leveraging technology to keep your organization’s assets secure.
If you have a hard time selling segregation of duties to the team or the board out of a concern of bringing the perception of mistrust or drama into the conversation, remember that segregation of duties not only helps to prevent fraud, but it also protects the reputation of those who are doing right.
This article appeared in the Jarnuary/February 2018 issue of New Jersey CPA magazine. Read the full issue.