Nonprofit Internal Controls and Policies Template
Small organizations cannot segregate duties, because one person does everything. That is normal, and the compensating control is a director who reviews the bank statement independently every month.
Internal controls are the routines that stop money going astray and stop honest mistakes becoming serious ones. The standard advice is to segregate duties, and at a small organization that advice is unusable, because one person does everything.
So the useful question is not how to achieve textbook segregation. It is which compensating controls actually work when you cannot.
The control that matters most
A board member who reviews the bank statement every month, independently, without it passing through the person who enters transactions.
That single practice does more than any other control available to a small organization. It does not require expertise, it takes fifteen minutes, and it means someone outside the bookkeeping sees every payment that left the account.
Get the statement sent directly to that director, or give them read-only access to the account. A statement forwarded by the bookkeeper is not an independent review.
Compensating controls when you cannot segregate
| Textbook control | What to do instead |
|---|---|
| Separate who receives money from who records it | Two people open post and count cash at events. A log signed by both. |
| Separate who authorises from who pays | Two signatures above a threshold, one of them a director |
| Separate who reconciles from who enters | A director reviews the reconciliation monthly |
| Separate payroll setup from payroll approval | The board approves all salaries, recorded in minutes |
| Independent review of the executive’s expenses | The chair or treasurer approves them. Never self-approval. |
The last row is small and it is the one auditors ask about. An executive director who approves their own expenses has no control over them at all, and the fix costs nothing.
The policies Form 990 asks about
The full Form 990 asks whether the organization has several specific policies. Those answers are public, and their absence is noticed by funders and rating services.
| Policy | Asked about on the 990 | Why it exists |
|---|---|---|
| Conflict of interest | Yes, with annual disclosure and enforcement | Manages transactions with insiders |
| Whistleblower | Yes | Lets concerns surface without retaliation |
| Document retention and destruction | Yes | What to keep, for how long, and when not to destroy |
| Compensation review process | Yes, for the top officials | Evidence that pay was set reasonably |
| Gift acceptance | Yes, for non-standard gifts | Lets you decline gracefully |
| Financial controls | Not directly | Auditors and funders ask |
| Expense reimbursement | Related questions on the form | Prevents the self-approval problem |
Answering yes to having a policy and no to monitoring and enforcing it is a common and avoidable combination. It says the document exists and is not used.
Document retention, and the clause people forget
A retention schedule is straightforward: articles, bylaws, the determination letter and board minutes permanently, financial records and payroll for several years, grant records for a period after the grant closes.
The clause that matters more than the schedule: no document is destroyed while any investigation, audit or litigation is pending or anticipated. Routine destruction under a policy is legitimate. Destruction after a problem appears is not, and the policy is what distinguishes them.
Gift acceptance, which exists so you can say no
It is acceptable to decline a gift, and organizations find that difficult without a policy to point at.
Cash, cheques, cards and transfers need no prior approval. What should require board approval before acceptance: real property, vehicles, gifts with conditions attached, gifts that would cost you money to hold or dispose of, and gifts from sources that could compromise the mission.
Then include the sentence that does the work: the organization may decline any gift. It lets you decline by pointing at the policy rather than at the donor, which is a considerably easier conversation.
Acknowledging donations, which is a legal requirement
Any single gift of $250 or more needs a contemporaneous written acknowledgement stating the amount and whether goods or services were provided in return. Where a payment over $75 is partly a gift and partly a purchase, you must disclose the deductible portion.
Get this wrong and the donor loses the deduction, not you. Put the timing and the required wording in the policy so it does not depend on whoever is sending the letter remembering.
Compensation, and the process that protects you
The full Form 990 asks how the compensation of your top officials was determined, and the answer it is looking for is a process rather than a number.
Three elements. Review comparability data for similar roles at similar organizations in similar places. Have the decision made by directors with no interest in it. Record both the data and the decision in the minutes.
Free sources for the comparability data: the Form 990s of comparable organizations, which disclose compensation of the highest paid people and are searchable on ProPublica Nonprofit Explorer, plus published nonprofit salary surveys.
The interested person must not vote on their own pay, and where a founder serves as executive director this is the arrangement most likely to be examined. Paying above a reasonable amount risks excise taxes that can fall on the individual and on the managers who approved it, which is why the process matters more than the figure.
Cash, which is where things actually go wrong
Almost every case of loss at a small nonprofit involves cash or the nearest thing to it, and almost none involves sophisticated fraud. It is a bucket at an event, a collection tin, or petty cash that nobody counted.
| Situation | Control |
|---|---|
| Cash collected at an event | Two people count it, both sign a log, before it leaves the room |
| Collection tins | Sealed, numbered, opened by two people, logged |
| Petty cash | A fixed float, receipts for every withdrawal, reconciled monthly |
| Cash held overnight | Set a limit in the policy. Bank it the next working day. |
| Card readers at events | Reconcile the device report against the deposit, every time |
The two-person count is the whole of it. It protects the organization and, just as importantly, it protects the volunteer, because a single person handling cash alone has no way to demonstrate they handled it correctly if anyone ever asks.
Technology and data
Two controls that cost nothing and are almost universally missing.
Remove access on the day someone leaves. Financial systems, the donor database, email, cloud storage and the bank. Departed staff and former volunteers retaining access is the most common data exposure at small organizations, and it is discovered by accident.
Test the backup. Most organizations have a backup and have never restored from one. A backup nobody has tested is a belief rather than a control. Restore something once a year and see whether it works.
Add one line to the policy about who may see what: fundraising staff do not need access to client case records, and access should follow the job rather than the person.
Adopting them
Adopt by board resolution and record it in the minutes. Circulate the conflict of interest acknowledgement annually and keep the signed copies. Review the whole set once a year at the same meeting, so it is calendar-driven rather than someone’s task.
Then use them visibly. The minute recording that a director disclosed an interest, left the room and did not vote is worth more than the policy sitting in a folder, and it is the evidence anyone assessing your governance will actually ask to see.
Download this template
Free, no email address, no signup. The full text is on this page as well, so you can read it before you download it.
Questions people ask
What policies does a nonprofit need?
Five that the full Form 990 asks about directly: conflict of interest with annual disclosure, whistleblower, document retention and destruction, a compensation review process for top officials, and gift acceptance for non-standard gifts.
Beyond those, financial controls and expense reimbursement are what auditors and funders ask for, even though the form does not ask about them by name.
Small organizations often need fewer written policies than they fear, and need the ones they have to be actually used. A policy nobody has read is not a control, and the 990 asks separately whether you monitor and enforce compliance.
How can a small nonprofit segregate duties?
Usually it cannot, fully, and that is normal rather than a failing. The answer is compensating controls.
The most valuable is a board member reviewing the bank statement every month, independently, with the statement sent directly to them or read-only access to the account. A statement forwarded by the bookkeeper is not an independent review.
Others: two people counting cash at events and both signing the log, two signatures on payments above a threshold with one being a director, and the chair or treasurer approving the executive director's expenses rather than the executive approving their own.
Auditors will still note the limitation in the management letter. What they want to see is that the board considered it and put something in place.
What is a whistleblower policy?
A written commitment that anyone connected to the organization may report a suspected violation of law or policy without fear of retaliation.
It should name who receives reports, and an alternative route where that person is implicated, usually the board chair. It should commit to prompt investigation and to reporting the outcome to the board. And it should state that retaliation against someone reporting in good faith is itself a violation.
The full Form 990 asks whether you have one, and the answer is public. It is a short document and there is no good reason not to have adopted it.
How long should a nonprofit keep records?
Permanently: articles of incorporation, bylaws, the IRS determination letter, board and committee minutes, and annual returns and financial statements. These are the organization's memory and there is no point at which they stop mattering.
Several years: accounting records, bank statements, payroll records, and grant records after the grant closes. Set the specific period in your policy, and check whether any funder or state requirement imposes a longer one.
Donor records for as long as the relationship continues.
The clause that matters more than the schedule is the suspension: no document is destroyed while any investigation, audit or litigation is pending or anticipated.
Do we need a gift acceptance policy?
The full Form 990 asks whether you have one for non-standard gifts, and its real value is that it lets you decline.
Organizations find refusing a gift difficult. A vehicle you cannot maintain, a building with liabilities attached, equipment you would have to pay to store or dispose of, or money from a source that would compromise your mission are all gifts worth declining.
A policy lets you decline by pointing at the policy rather than at the donor, which is a much easier conversation.
Keep it simple. Cash and cards need no prior approval. Property, vehicles, conditional gifts and anything that costs you money to hold should require board approval before acceptance.
Who approves the executive director's expenses?
The board chair or the treasurer. Never the executive director themselves.
This is a small control that auditors ask about specifically, and self-approval is one of the most common findings at small organizations. It costs nothing to fix and it removes an obvious weakness.
Put it in the expense policy in one sentence, alongside the requirement for original receipts submitted within a set period and mileage reimbursed at the applicable IRS rate.
The same principle applies to any payment to a person: nobody authorises a payment to themselves or to a related party.
How often should policies be reviewed?
Annually, at the same board meeting each year, ideally alongside collecting conflict of interest acknowledgements so both become routine.
Review means the board actually looks at them, not that they appear on an agenda. Ask two questions: has anything changed in how we operate that the policies no longer cover, and did we follow them every time they applied this year.
Record the review in the minutes. The full Form 990 asks whether the conflict of interest policy in particular is monitored and enforced, and a minute is the evidence.
Where do we start if we have no policies at all?
In this order, and the first three can be adopted at one board meeting.
Conflict of interest, with an annual acknowledgement form. It is the one the 990 asks about most and the one funders check.
Financial controls, even if the whole policy is four lines: two signatures above a threshold, monthly bank statement review by a director, no self-approval of expenses.
Document retention, including the clause suspending destruction when anything is pending.
Then whistleblower, gift acceptance and expense reimbursement at the next meeting.
Adopt by resolution, record it in the minutes, and put the annual review date in the board calendar the same day.
This is reference information, not legal or tax advice. Rules vary by state and change over time. For a decision that carries real consequences, check the current text at irs.gov or your state registry, and talk to a nonprofit attorney or CPA.