Fraud prevention for small NGOs
How small NGOs can prevent and detect fraud: where it happens, six low-cost controls, warning signs, and what to do when you suspect it.
Short answer
Small NGOs prevent fraud by making sure no single person controls a whole transaction. Split duties for approving, paying and recording money. Require two signatures, reconcile the bank every month, keep receipts for every payment, and give staff a safe way to report concerns. Fraud often involves small sums and trusted people, so controls must apply to everyone, including the director.
Key points
- Fraud can involve small amounts and trusted people. Controls must apply to everyone.
- Split duties so one person never approves, pays and records the same payment.
- Reconcile the bank account every month, and have someone else review it.
- Write a short fraud response plan before you need it.
- Create a safe, simple way for staff and communities to report concerns.
What is fraud, and why does it affect small NGOs?
Fraud is when a person acts dishonestly to gain a benefit or to cause someone else a loss. The Australian charity regulator describes common methods: false statements, abuse of a position, hiding information and other forms of deception. It can mean theft of funds, goods or assets, false expense claims or overpaid wages.
Small NGOs are not safe because they are small. The same regulator notes that fraud with small amounts can still cause serious harm, especially to organisations with few resources. It also notes that many reports involve senior or trusted people, and that anyone with some responsibility can commit fraud. Fear of damage to reputation stops some organisations from reporting. That silence makes the problem worse.
Where does fraud usually happen?
Look at where money, goods and trust move through your organisation.
| Area | Typical fraud | Simple control |
|---|---|---|
| Payments | Fake invoices, duplicate payments, "ghost" suppliers | Approver is not the payer; check invoice against receipt of goods |
| Cash | Cash taken before it is recorded | Two people count and sign; bank quickly |
| Payroll | Ghost staff, inflated hours | Supervisor signs timesheets; review the payroll list monthly |
| Expenses | Claims without receipts, personal costs | Pre-approval and original receipts for every claim |
| Procurement | Favouring one supplier, split orders | Written quotes and a committee for larger purchases |
| Goods and assets | Items taken or sold | Asset register and regular stock counts |
Six controls every small NGO can afford
- Separate duties. One person should not authorise, make and record the same payment. If your team is tiny, ask a board member to review bank statements.
- Use two signatories. Require at least two people for bank transfers, new cards and online banking. Limit who holds banking passwords, and change them regularly.
- Reconcile every month. Compare the cash book with the bank statement. A person who does not make payments should review it and sign it.
- Compare budget with actuals. Unexplained gaps between plan and spending are an early warning sign. Our guide on budget management shows a simple monthly method.
- Set approval limits. Higher amounts need higher approval. Spot-check smaller payments at random.
- Write it down. Keep a short financial policy with approval levels, cash handling and travel claims. See financial policies every NGO needs.
Charity regulators in the UK and Australia give similar advice, and none of it needs expensive software. It needs discipline and a written record that the checks happened.
What are the warning signs?
Watch for patterns, not just single events:
- A staff member who never takes leave and will not share a task.
- Missing receipts or documents that are always "being found".
- Suppliers with no address, or with a bank account in a personal name.
- Payments just below an approval limit, or orders split into smaller ones.
- Staff or officers who resist audits, reviews or questions.
- A lifestyle that does not match known income. Treat this as a reason to look, not as proof.
A conflict of interest can also lead to fraud. Make staff declare relationships with suppliers and candidates. Read more in managing conflict of interest.
What should your fraud response plan say?
Write a one-page plan now, while no one is under pressure. Include:
- Who receives reports. Name a primary person and an alternate, such as the board chair, in case the report concerns the first person.
- First steps. Secure bank access, records and equipment. Keep evidence, such as emails and receipts.
- Who decides. Agree who leads the review, and who is told: the board, the donor, the authorities where required.
- Protection. State clearly that people who report in good faith will not be punished.
- Learning. After each case, fix the control that failed.
Laws and donor rules differ. Check your grant agreement and, where needed, ask a qualified adviser before you act on a specific case.
How do you make speaking up safe?
A control system fails if people are afraid to speak. Give staff, volunteers and community members at least two ways to report: a named person, and an anonymous option such as a locked box or a phone number. Explain the process in staff induction. In Myanmar settings where trust in formal channels may be low or connectivity poor, a trusted focal person who speaks the local language often works better than a web form. Respond to every report, and tell the reporter what happened where it is safe to do so.
How EMPO can help
EMPO is a reliable, Yangon-based training and consultancy provider and one of Myanmar's leading names in practical NGO training, with 1,200+ people trained and 15 partner organisations. We work in English and Burmese, online and in person across Myanmar. Our organisational development service covers finance policies, controls and systems, and we run budget management training. See our services or contact us to discuss your team.
Sources
- Protect your charity from fraud — Australian Charities and Not-for-profits Commission
- Compliance Toolkit: Protecting Charities from Harm, Chapter 3: Fraud and financial crime — Charity Commission for England and Wales, 2017
Questions people ask
We only have five staff. Can we still separate duties?
Yes. Use a board member, a volunteer or a staff member from another team for the review step. The aim is that no one person handles a payment from start to finish.
Should we report fraud to the donor?
Check your grant agreement. Most donors require prompt notice of suspected fraud or loss. Tell the donor early, and describe the facts and your response plan.
What is the first thing to do when we suspect fraud?
Secure the records and the money, limit access for the person concerned, and tell the board chair. Do not confront anyone until you have the facts and a plan.