TPCSA • Governance and risk
Financial Controls for NPOs
Practical checks that help your board and finance team protect funds, explain decisions and keep reporting dependable.
Financial controls for NPOs are the checks, responsibilities and records that help an organisation manage money consistently. They connect the person requesting a transaction, the person approving it, the person paying it and the person reviewing the records. Good controls make it easier to detect errors, challenge unusual activity and demonstrate accountability.
A small organisation does not need a complicated manual to begin. It needs a few clear controls that people follow, evidence that checks happened and a way to deal with exceptions. The approach should reflect the size of the organisation, its funding arrangements and the risks it faces.
Make approval responsibilities clear
Write down who may approve spending, sign agreements, change bank details and authorise payments. Set practical limits and a route for exceptional decisions. An approval should show what was authorised, by whom and when; a general message saying “approved” may not explain the decision later.
Separate incompatible tasks where possible. Someone who creates a supplier should not independently approve that supplier’s invoices and release the payment. Someone preparing a bank reconciliation should have an independent reviewer. The point is to create a meaningful check, rather than collect signatures after the event.
Keep an exception log
Urgent purchases and staff absences can disrupt normal procedures. Record the reason for an exception, the person authorising it and the follow-up action. Repeated emergencies may reveal a planning problem or an approval process that needs redesign.
Protect the bank and supplier process
Review bank access whenever staff responsibilities change. Use individual access credentials, appropriate payment limits and independent payment approval where the banking arrangement supports it. Keep an up-to-date list of authorised users and signatories.
Verify requests to change supplier bank details through a trusted contact method already held on file. A convincing email or replacement invoice is not enough on its own. Retain evidence of the check so the payment reviewer can see how the change was confirmed.
Reconcile every bank account
Compare the bank statement with the ledger each month. Explain outstanding items, investigate unusual entries and clear old reconciling differences. A reconciliation is incomplete if the two totals agree only because an unexplained adjustment was posted.
Record who prepared and reviewed the reconciliation, along with the date. Include savings, project and other bank accounts in the review, not just the main operating account. Explore TPCSA’s bookkeeping and bank reconciliation support if the process is falling behind.
Review payroll changes before payment
Check new starters, leavers, salary changes, overtime, deductions and bank-detail changes against authorised records. Compare the current payroll with the previous month and explain significant movements. A reviewer should be able to trace each adjustment to its approval.
After payment, reconcile payroll totals to the accounting records and retain the supporting schedules. Use the monthly payroll checklist to build a repeatable routine.
Keep restricted funding visible
Track donor-restricted funds and project costs separately in your records. Review whether costs are within the agreed purpose and budget before payment. Shared costs need a documented allocation basis so the same expense is not charged to more than one funding source.
For example, a healthy total bank balance can hide a shortage of unrestricted operating funds. A useful finance report distinguishes the amounts reserved for projects from funds available for general expenses. Our donor reporting guide explains how to connect project expenditure, budgets and supporting evidence.
Build a monthly control review
- Reconcile: check banks, payroll, key suppliers and other significant balances.
- Review: compare actual results with budget, restricted funds and expected cash movements.
- Investigate: follow up unexplained differences, overdue items and unusual transactions.
- Document: record approvals, review notes, outstanding actions and responsible people.
- Escalate: bring significant risks and unresolved issues to the right decision-makers.
Keep source records in a shared, controlled filing structure. The audit readiness folder structure can help organise the evidence. Access should reflect staff responsibilities, and important records should remain available when someone leaves.
Before year-end, use the NPO audit readiness checklist to check which supporting records and schedules still need attention.
Give the board information it can act on
Board reporting should highlight cash availability, restricted balances, budget variances, outstanding obligations and significant control issues. Explain the action required rather than presenting a large set of numbers without context.
Assign an owner and due date to each agreed improvement. At the next meeting, report whether it was completed and whether the control now works in practice. A policy that exists only in a folder does little to reduce day-to-day risk.
Use the right reference for the right responsibility
The DSD’s registered NPO obligations explain recordkeeping and reporting responsibilities. The IFAC guide to internal control over financial reporting provides further professional background. Your governing documents, legal form and funding agreements may add responsibilities that need to be considered separately.
When to ask for a control review
Consider a review when reporting repeatedly arrives late, one person controls the whole payment process, reconciliations contain old differences or growth has outpaced existing systems. Review is also useful after leadership changes, a funding expansion or an incident that exposed a weakness.