Internal controls are a necessary part of every company’s day-to-day operations and it is no different in a not-for-profit organization. However, many people avoid thinking about or discussing internal controls because they are unfamiliar with the term. All they know is that the auditors are obsessed with them and whenever anything goes wrong, it is frequently the fault of a lack of internal controls.

In this blog, I will try to debunk the myths of internal controls. Let’s start with what are internal controls? Simply put they are the policies and procedures that have been designed in an attempt to limit errors or other mistakes from happening.

The first step in designing appropriate internal controls is to imagine what could go wrong in a particular area of activity. For example, let’s think about one area in which not-for-profits spend approximately 70% of their total expenditures each year – payroll. What can go wrong as we pay employees each pay period?

• We could pay them at the incorrect pay rate. Of course, we can count on an employee to tell us if we pay them at a rate lower than they expected, but if we pay them at a rate above what they are supposed to be paid, they may not say anything believing they received a raise.
• Or an employee could get paid for more hours than they actually worked.
• There is also a chance we could charge their time to the wrong program and risk not getting paid for their work at all.

Now that we have identified some of the pitfalls of payroll, what policies and procedures can be put into place to prevent or minimize the risk of errors that could cost the organization money? In regard to authorized pay rates, we should have a procedure whereby the personnel department is the only department that authorizes pay rates. No department head or supervisor should be able to change an employee’s pay rate with the payroll department. Authorizing a pay rate means a written communication signed by the appropriate authorizer which is maintained in the employee’s personnel file.

The company that processes your payroll should be instructed to accept pay rate changes from only one authorized employee (like the payroll supervisor) at the company and to send a notice of pay rate changes back to a different person (like the personnel department) at the organization when a change has been made. Of course, when the personnel department receives such a notice, it is incumbent upon them to go back to their written records to verify that the change was authorized and properly executed. This procedure guards against unwarranted pay increases and incorrect amounts.

Employees should prepare a time sheet on a daily or weekly basis. The time sheet should indicate the number of hours worked and the program in which the employee worked those hours. Even employees who only work in one program and are paid on a salary rather than an hourly basis should prepare such a timesheet record of their work. At the end of the payroll period, the employee should sign their time sheet and the supervisor (or supervisors) of the department(s) in which the employee has charged their time should also sign the timesheet. This way, both the employee and their immediate supervisor have agreed and verified the time worked by the employee. This procedure guards against an employee being paid for the incorrect amount of hours and from charging the time to an incorrect program or cost center.

When the payroll department converts the time on the time sheets to data submitted to the payroll processing company, they should add the amount of hours on every time sheet and confirm this figure to the amount of hours processed by the payroll processing company. This procedure guards against an error being made during data entry from the time sheets to the payroll system. For example, this simple procedure would easily catch the error if someone who worked 31 hours had their time entered into the payroll system as 13 hours – a common transposition of figures.

You can see now that internal controls are not some scary mystery. Rather, they are simple procedures inserted into the organization’s policies that work to prevent errors or quickly discover them when they do occur. One of the primary jobs of the board is to ask questions and evaluate the answers. Identifying risks and thinking about what can go wrong and then asking what steps have been taken to reduce these risks, are all essential responsibilities of the not-for-profit board.

As one of the largest CPA firms in Boston, KLR is unique because they service over 220 not-for-profit organizations with compliance and consulting services. We have extensive experience helping Nonprofit organizations regarding boards, and board responsibilities, charitable contributions, taxes and 990 filing requirements.