Nonprofit Internal Controls Checklist: 35 Controls, Free Template

Nonprofit internal controls are the routines that make it hard for money to be lost, misused or misreported without someone noticing: splitting duties so no one person handles a transaction from start to finish, requiring approval before payments, reconciling bank accounts monthly, and having the board review the numbers. Below is a 35-point internal controls checklist by area, with who does each and how often, how to split duties in a one- or two-person office, the state audit thresholds, and what the Form 990 asks. The checklist is a free Word download.

What internal controls are

The two frameworks auditors and federal agencies use describe the same thing. The US Government Accountability Office’s Green Book, revised in 2025 and effective from fiscal year 2026, approaches internal control “through a hierarchical structure of five components and 17 principles”: control environment, risk assessment, control activities, information and communication, and monitoring. GAO says it may also be adopted by nonfederal entities, including nonprofit organizations. The private sector’s COSO framework uses the same five components and seventeen principles, the first of which is that the organization “demonstrates a commitment to integrity and ethical values.”

For a small charity that translates into four habits. Nobody handles a transaction from beginning to end alone. Someone approves before money goes out. Someone independent checks the bank against the books every month. And the board looks at the finances often enough to notice when something is off. The checklist below is those four habits applied to each area of the office.

Why it matters more than most charities assume

Most charities never have an outside auditor test any of this. Among 269,686 charities filing the full Form 990 in the IRS’s 2024 data, only 36.8% reported audited financial statements, and below $1 million of revenue it is fewer than one in four:

Our analysis of the IRS 2024 Form 990 extract with bin/analyse_soi_controls.py. “Audited” means separate or consolidated audited statements (Part IV lines 12a and 12b). The other columns are Part IV line 26 (loans to or from current or former officers, directors or key employees outstanding at year end), line 28a (a business transaction with a current or former insider) and line 27 (a grant or assistance to an insider or their family). These are disclosures, not wrongdoing: a small loan from a founder to cover payroll can be legitimate if it is approved and documented properly. But each is a transaction where controls matter most. 78 charities reported an excess benefit transaction for the year, the IRS’s term for an insider receiving more than they gave.

Where no auditor looks, the controls are the only protection, which is why state attorneys general publish guidance on them.

The internal controls checklist

Governance and oversight

Cash and cheques received

Payments

Credit cards and expenses

Payroll

Bank and reconciliation

Grants and restricted gifts

Assets, data and records

Adapt the “who” column to your own titles, and set the dollar amounts (for two signatures, two approvers, competitive bids) in a board resolution so they are on record; wording for that is in the board resolution templates. Several items come straight from regulator guidance. The California Attorney General’s Guide for Charities says “No single employee should receive, record, deposit, and reconcile the charity’s receipt of funds,” that “Checks should never be pre-signed,” and that the person submitting credit card charges must never be the one who authorizes paying them. The New York Attorney General’s internal controls guidance for boards calls for budget-to-actual reports “at least quarterly, preferably monthly,” with explanations of variances, and a way for staff, contractors and volunteers to report suspected fraud to the board.

Splitting duties when you are small

Segregation of duties is the control small charities say they cannot manage, because there are not enough people. The answer is to use the board. A treasurer who receives the bank statements directly, reviews the reconciliation and approves payments is doing the independent half of most controls without being in the office.

Whatever the size, the bank statement should go to someone who does not handle the money, and every reconciliation should be signed off by someone who did not prepare it. If those two are true, many common frauds become hard to hide. The treasurer’s other duties are in nonprofit board positions.

What the Form 990 asks about controls

The Form 990 asks several questions whose answers are public and which donors, grantmakers and journalists read:

• Part VI line 11a: whether a complete copy of the Form 990 was given to all board members before filing.
• Line 12a to 12c: whether there is a written conflict of interest policy, whether insiders must disclose interests annually, and whether the organization “regularly and consistently” monitors and enforces it. A template is in the conflict of interest policy.
• Lines 13 and 14: whether there are written whistleblower and document retention and destruction policies; both are in nonprofit policies.
• Line 15: whether pay for the top executive and other officers was set using review and approval by independent persons, comparability data and contemporaneous documentation. Nonprofit executive compensation covers how.
• Part XII: the accounting method, whether the statements were compiled, reviewed or audited, whether a committee oversees that, and whether a required single audit under the Uniform Guidance was done.
• Part IV lines 25 to 28: excess benefit transactions, loans with insiders, grants to insiders and business transactions with them, each reported in detail on Schedule L.

A “No” is not illegal, but it is visible. The Form 990 guide explains each part.

Federal grants: internal control is a condition of the award

An organization that receives federal funds, directly or passed through a state or another nonprofit, must under 2 CFR 200.303 “establish, document, and maintain effective internal control over the Federal award,” which the rule says should align with the Green Book or COSO. The same section requires reasonable cybersecurity measures to protect personal information. If you spend $1,000,000 or more of federal awards in a year, 2 CFR 200.501 requires a single audit; the Federal Audit Clearinghouse says the $1,000,000 threshold applies to fiscal years starting on or after 1 October 2024, up from $750,000. A single auditor tests your controls over each major federal programme, so the checklist above needs to be written down and followed, not just intended. Nonprofit grants covers federal funding more widely.

State audit and review thresholds

Many states require charities registered to fundraise there to file reviewed or audited financial statements above a size, which in practice forces controls an accountant can test:

From California’s Attorney General summary of Government Code 12586(e), New York Executive Law 172-b and the Attorney General’s audit committee guidance, Pennsylvania’s Department of State and Act 71 of 2017, Florida Statutes 496.407 and the Illinois Attorney General’s notice of Public Act 103-0121, read on 27 October 2026. New York’s audit threshold has been $1 million for reports due on or after 1 July 2021; Illinois’s took effect on 1 January 2024. California also requires an audit committee that excludes staff, the president or chief executive and the treasurer or chief financial officer. Other states set their own thresholds; check where you are registered. What an audit, review and compilation each involve, and what they cost, is in nonprofit audits.

How long to keep records

IRS Publication 4221-PC says a public charity “must maintain books and records to show that it complies with tax rules,” and that the statute of limitations generally “runs three years after the date the return is due or filed, whichever is later.” Employment tax records are kept for at least four years. The exemption application, determination letter, articles, bylaws and board minutes are kept permanently. Grantors, insurers and states may require longer, so set the periods in a written document retention policy, which Form 990 line 14 asks about.

Putting it in place

1. Download the checklist and mark each control as in place, partly in place or missing.
2. Fix the bank first: statements to the treasurer, monthly reconciliation reviewed by someone independent, two approvals for large payments.
3. Set the dollar limits by board resolution and record it in the board minutes.
4. Write it down as a short financial procedures policy alongside your other policies.
5. Use the accounting system to enforce it, with user roles and approval workflows; nonprofit accounting software compares the options, and the chart of accounts template sets up restricted fund codes.
6. Review it every year when the board receives the Form 990 and the financial statements, and whenever staff change. A sudden departure is when controls fail, which is one reason to have an emergency succession plan.

Frameworks are from the GAO Green Book (2025) and the COSO Internal Control Integrated Framework (2013). Federal rules are from 2 CFR 200.303 and 200.501 and the Federal Audit Clearinghouse; Form 990 questions from the 2025 form and the Schedule L instructions; record keeping from IRS Publication 4221-PC; state rules and recommended controls from the California, New York, Pennsylvania, Florida and Illinois sources above. The data is our analysis of the IRS 2024 Form 990 extract. All read on 27 October 2026. This is a template, not accounting or legal advice; an accountant who knows your organization should review it.

This is reference information, not legal or tax advice. Rules vary by state and change over time. For a decision that carries real consequences, check the current text at irs.gov or your state registry, and talk to a nonprofit attorney or CPA.