Here is the full text of my article, Essentials of Internal Control, appearing in Church Management News from Bank of the West.  The online article is here.

The article discusses three key ideas:

• The bookkeeper should not sign checks
• Trust is NOT an internal control
• Review unopened bank statement by someone outside of accounting

Essentials of Internal Control

By James L. Ulvog, CPA

The business administrator of a nearby church has been formally charged with embezzling close to $1 million over four years, according to a recent newspaper article. Few details are publicly available. I have friends who worship there, so this hits close to home. I grieve for my friends, the congregation, believers whose faith has been shaken, and even the accused man and his family.

Last year, the bookkeeper of a women’s shelter in my area was sentenced to one year in prison for embezzlement. The executive director of the center was quoted in a newspaper article as saying the shelter had to sell one of their several houses in order to keep operating. The director said eighty women and their children were denied services.

I was going to start this article with a rational appeal to logic as the way to encourage more emphasis on internal controls in our churches. Instead, I would like you to ponder the devastation that follows in the wake of a disaster that can arise from a breakdown in internal controls. The previous reports are only two examples. One of the main goals of developing internal control is to prevent these situations. I could tell you of many more tragedies. A few moments of searching the internet will find dozens of stories.

CPAs can talk for hours about internal control. Can the concepts in all those long presentations be made a little simpler to grasp? Let’s try to boil down all those internal control ideas to one sentence. Ready? Internal controls are the procedures you put in place so that one person cannot do something wrong and hide having done so.

Using this simple explanation, let’s talk about why one simple internal control is so valuable, why one thing you may think is an internal control really is not, and another powerful procedure you may not have thought about.

The bookkeeper should not sign checks
Sometimes the staffing in a church is really tight, so there aren’t many people on staff who can sign checks. When you want to get bills paid, it can be difficult to get an elder to stop by the office to sign checks. When it is so complicated to get checks signed, a church will sometimes have the person who does all the accounting work sign them so the bills can get paid timely. Even if there are other signers, they may not be available soon enough, so the bookkeeper just signs the checks.

To see the danger here, let’s go back to the one sentence definition of internal control, which is not being in the position where one can do something wrong and hide it. Who in your church has the greatest ability to alter documents, make them go away, or ‘fix’ the accounting? That would be the bookkeeper. That is the person who will also be preparing the checks for signature. If that same person could sign the check, there would be a wide-open opportunity to do something wrong (for example, sign a check for an inappropriate disbursement) and hide it (perhaps change the documentation or alter the accounting entries). In that situation, something could go terribly wrong and you would be blissfully unaware.

In contrast, the very simple step of having someone else sign the check would greatly reduce the chance that the bookkeeper could do something wrong. That is internal control. You can apply this idea to many other tasks in the finance area.

Let’s look at one more idea that is closely related. New technology makes it easy to pay bills electronically and to do so at low cost. Many churches and non-profit organizations have set up their bookkeeper as the authorized user. After the appropriate elder or program leader approves an invoice, the bookkeeper logs on to the banking web site and pays the bill. Do you see the danger here?

The risk is that when the bookkeeper can pay the bill without any other approval of the electronic transaction, it is the same as writing and signing a check. The bookkeeper could do something wrong (for example, send out an improper electronic payment) and quite easily hide the transaction in the accounting records. It is just as dangerous to have the bookkeeper send electronic payments as it is to sign checks. You should work with your finance team and bank to develop some sort of additional controls, such as requiring a separate electronic approval before releasing a payment.

Trust is NOT an internal control
Sometimes in a church, we have the attitude that we don’t need all those internal controls procedures because we trust all our staff. I know what you are thinking, “Hey, we trust the business manager and her team completely!” I understand. I have complete trust in the team at my church.

Obviously you have extremely high trust in everyone handling money in your organization. That’s why they are in those positions. You would unquestioningly trust them with your own money. It’s a good thing you trust them so much because every payday they do handle your money along with your bank account and Social Security number. If you did not completely trust them you would never let them get anywhere near your payroll.

However, trust is not an internal control. It is a starting point. Being completely trustworthy is the entry level skill set needed to get into the count room or touch anything related to payroll.

Let’s go back to the brief definition of internal control: avoiding the situation where one can do something wrong and hide it. Just because you trust someone does not prevent the person from successfully hiding something that was done wrong. Only splitting up the work or checking on what was done will prevent the problem.

To think that trust is an effective internal control ignores the overwhelming pressures of modern life. When someone is under extreme pressure, such as staring at a tall stack of unpaid medical bills, facing foreclosure next week, or fighting off befuddled thinking due to addiction, your trust in them will be absolutely no deterrent to “borrowing” some money to stop an imminent disaster.

Look at it another way: Only people you deeply trust can get their hands on enough money to do real damage.

Review unopened bank statement by someone outside of accounting
Reconciling the balance in your bank account to the amount on the general ledger is extremely important. Doing so on a timely basis verifies that no transactions hit your account that belong to someone else and that all the legitimate banking transactions were recorded on your books. The ideal approach would be for the reconciliations to be prepared by someone other than the bookkeeper. In reality, this is rarely possible in most churches. There are just not enough people on staff to split out that work.

Here is a creative idea for you. Have a member of the board, or some other astute person, review the unopened bank statement.

The person doing the review would look at the statement for unusual or unexpected items, then review the checks for proper signers, look at the payees and amounts paid, then glance at the endorsements (which shows who really received the money). After finishing, the reviewer could initial and date the statement to document that the review was performed.

What would this accomplish? The key idea is that most transactions of a local church are routine expenses. After a few months, the reviewer would have a good feel for typical transactions. A person familiar with the church’s activities would quickly recognize unexpected payments, out-of-the-ordinary amounts, or unusual postings by the bank. Most of the items that seem unusual at first glance would make sense after thinking about something new or different the church did recently. A quick phone call or email to the bookkeeper would readily explain the remaining odd items. With probably fifteen minutes of effort or less, an informed person could be comfortable that all transactions on the bank statement during the month made sense.
Who could perform this review? The treasurer or an elder would be ideal. However, it would not have to be someone in a formal leadership position.

While this procedure is not as effective as having another person actually preparing the bank reconciliation, it captures most of that value at very low cost in terms of time.

Conclusion
Here is a brief description of internal control: avoid the situation when a person can do something wrong and hide it. As we saw, separating the check signing from other bookkeeping work is a superb illustration of this concept. We also discussed that no matter how much you trust your beloved finance team, your trust in them is not an internal control. Finally, we looked at the idea that having an informed person outside the finance area review the unopened bank statement is a very easy low-cost way to improve the internal control over cash.

Like almost every other church in the country, today you have more work to do with less staff than a year ago. The ideas discussed here can help you maintain and improve your internal control.

James L. Ulvog, CPA, has over two decades experience focused on serving the religious nonprofit community by providing audits, reviews, and consulting services. He runs his own accounting firm in the Southern California area. Most of his experience is working with small- to medium-sized organizations. He may be reached at james@ulvogcpa.com or www.ulvogcpa.com†. Please visit his blog at www.ulvog.wordpress.com†.

†This link connects to a non-Bank of the West website. Bank of the West does not endorse the content of this website and is not responsible for the operation or content or accuracy of the website.