Risk Management for NPOs
NPO Risk Management
for South African
BoardsPROTECT THE MISSION AND THE MONEY
Donor money, small finance teams and cash-heavy programmes make non-profits a target for error and fraud. We help boards see their real risks and put proportionate controls in place.
What Does NPO Risk Management Involve?
Most NPO failures we see are not dramatic. A single person approves and pays. A grant is spent on the wrong cost line. A funder’s reporting deadline slips. NPO risk management is about spotting those weak points before a donor, auditor or the press does. We work with boards to build a risk register that reflects your programmes — not a corporate template — and to agree who owns each risk. If you want a quick view first, the Needs Analysis is a good starting point.
We then test the controls that matter: segregation of duties, bank and payment approvals, procurement, payroll, asset registers and donor-condition tracking. The output is a short, prioritised action list sized to your staff numbers and budget.
NPO Risk Management Services
Risk register setup
Fraud risk assessment
Procurement controls
Policy framework
Board risk reporting
Internal control review
Delegation of authority
Donor compliance checks
Audit readiness review
Our approach
Proportionate Controls, Not Paperwork for Its Own Sake
A ten-person community organisation and a multi-donor programme need different controls. We start by walking through how money actually moves — from donor agreement to bank to beneficiary — and map where it could go wrong. Controls are then matched to the risk and to the people you have.
For donor-funded organisations, including those with US government awards, we check that systems can meet funder rules on allowable costs, procurement and record keeping. Clean controls make the later NPO audit and review services faster and cheaper, whoever your auditor is.
Risk work often surfaces accounting or structure issues. Where it does, our NPO accountants and NPO legal structuring teams pick them up directly, and NPO training helps staff and boards apply new policies.
Why NPO Boards Trust TPCSA With Risk
- Led by Farida Lavangee CA(SA), Registered Auditor, with experience of USAID Yellow Book and Green Book requirements
- Auditor’s eye on controls — we know what testing looks for
- Findings ranked by impact, with owners and dates
- Policies written for your size, in plain English
- Linked accounting, tax and governance support in one firm
Frequently Asked Questions About NPO Risk Management
What is NPO risk management?
It is the board’s process for identifying what could harm the organisation — financial loss, fraud, non-compliance, reputational damage, programme failure — and deciding how to reduce it. In practice that means a risk register, sensible internal controls and regular reporting to the board.
Who is responsible for risk in an NPO?
The board, directors or trustees carry ultimate responsibility. Management runs the day-to-day controls. A risk register makes those responsibilities clear and gives the board something concrete to review.
We are small. Do we really need internal controls?
Yes, but scaled to you. Even with two finance staff you can separate who captures, who approves and who releases payments, and add board review of bank statements. Small organisations are often the most exposed because one person does everything.
How do you assess fraud risk?
We look at where cash, payments, procurement, payroll and stock could be misused, interview key staff and test a sample of transactions. You receive a short report of the main fraud risks and practical controls to reduce them.
Can you help us meet donor compliance requirements?
Yes. We review grant agreements against your systems — allowable costs, procurement thresholds, document retention and reporting — and identify gaps before a funder monitoring visit or audit.
Do you work with organisations receiving USAID or other US government funds?
Yes. Our audit director has experience with the US Government Auditing Standards (Yellow Book) and federal internal-control standards (Green Book). We can review readiness against those expectations.
Which policies should an NPO have?
Typical core policies cover finance and delegation of authority, procurement, conflicts of interest, fraud and whistleblowing, data protection under POPIA, and asset management. We prioritise based on your risks rather than handing over a generic pack.
Do NPOs have anti-money-laundering obligations?
Non-profits can be misused for money laundering and terrorist financing, and South Africa has strengthened oversight of the sector. Know-your-donor and know-your-beneficiary checks are good practice. Check the FIC and DSD guidance for current obligations.
Is a risk review the same as an audit?
No. An audit gives an opinion on financial statements. A risk review looks forward at where things could go wrong and how to fix controls. Good risk work makes audits smoother.
How do we get started?
Book a Needs Analysis or contact us. We scope a risk review around your size, funders and biggest worries, and quote a fixed fee.
Related support: NPO consulting services | NPO audit and review services | NPO accountants | NPO training | Needs Analysis
Compliance references: DSD NPO Directorate | Financial Intelligence Centre | Information Regulator (POPIA) | Nonprofit Organisations Act 71 of 1997 | SARS Tax Exempt Institutions
Get in touch
Let’s talk about your NPO
Speak to our team about your risk and internal control needs.
We’ll help you find the right support for your organisation.