Internal controls for small finance teams
Practical internal controls for small NGO finance teams: separating duties, approvals, bank reconciliation and low-cost checks when staff are few.
Short answer
Internal controls are routine checks that prevent errors and misuse of money. In a small team, the core control is to make sure no one person authorises, handles and records the same transaction. Add written approval limits, regular bank reconciliation reviewed by a second person, secure cash handling, and periodic surprise checks. Even a team of two or three can do this.
Key points
- No single person should authorise, execute and monitor the same transaction.
- A second person should see the bank statements and review reconciliations.
- Write down who can approve what, and up to what amount.
- Review the vendor list and test cash and payments from time to time.
- When staff are few, use managers, board members or trusted volunteers for review roles.
What are internal controls?
The National Council of Nonprofits defines internal controls as financial management practices used systematically to prevent misuse and misappropriation of assets, such as theft or embezzlement. They are usually written as policies that set out the procedures and who is responsible. The goal is to create checks and balances that reduce risk.
Controls are not only about fraud. They also catch honest mistakes: a wrong amount, a duplicate payment, a missing receipt. For donors, they show that funds are managed responsibly. See financial policies every NGO needs for the written side.
What is separation of duties?
The Oregon Department of Justice's guidance for small nonprofits says effective internal controls limit any single individual from having control over two or more phases of a financial transaction. It groups duties into four categories: access to assets; access to accounting systems and records; management or control positions; and independent oversight, such as board directors.
Its examples are clear:
- A person who receives cash and issues a receipt should not also record the deposit.
- A person who makes accounting entries should not also have signing authority.
- Bank statements should be received and reviewed by someone independent of those steps.
The same guidance says that even an organisation with no staff can create separation by assigning duties to board directors or volunteers.
A simple control set for a small team
| Area | Control | Who |
|---|---|---|
| Payments | Written approval before payment, with limits by amount | Budget holder approves; finance prepares; manager or signatory releases |
| Bank | Monthly reconciliation of bank and books | Prepared by finance; reviewed and signed by a second person |
| Bank statements | A second person, not the bookkeeper, sees them | Manager or board member |
| Cash | Locked storage, count and sign each time, deposit soon after receipt | Cash holder and a witness |
| Vendors | Periodic review of the list of vendors paid | Someone independent of payments |
| Expense claims | Reimbursed only with prior approval and receipts | Line manager approves; finance checks |
| Payroll | Staff list changes approved by HR or a manager | HR and finance separate |
| Records | Supporting documents filed for every payment | Finance |
The National Council of Nonprofits suggests several of these: reimbursing only expenses approved in advance in writing, periodic review of the vendor list because a common scheme involves fictitious vendors, keeping cash in a locked place and depositing it soon after receipt, and not allowing the same person to prepare payroll and also distribute it.
How do you start? A five-step method
- Map the money flow. The National Council of Nonprofits suggests drawing a flowchart of how money moves through your organisation, so everyone can see who is responsible at which stage and where weaknesses may be.
- Find who does what. List each step: request, approve, pay, record, reconcile, review. Mark where one person does more than one.
- Split or add a reviewer. If you cannot split a step, add a reviewer.
- Write it down. Put approval limits and responsibilities in a short policy, and share it with staff.
- Test it. Try the process with a sample payment. Fix gaps.
The Council also notes that the top priority is to put in place basic controls over who has access to bank accounts and who can authorise spending, whether by cheque, cash, card or other means.
What are two low-cost steps any team can take?
The National Council of Nonprofits suggests two easy steps even very small organisations can take:
- A surprise review. An unexpected examination of how cash and payments flow, and which vendors receive payments, can deter fraud and catches errors.
- A second person sees bank statements. Make sure someone besides the bookkeeper receives and reviews them. This adds transparency and protection.
For related topics, read fraud prevention for small NGOs, cash management in insecure contexts and how to prepare for a donor audit.
What changes in insecure or remote settings?
In Myanmar, banking limits, cash dependence and remote teams can make standard controls harder. Adapt without dropping the principle:
- Use clear cash limits, and record each handover with two signatures where possible.
- Keep photos or scans of receipts and send them securely.
- Have a manager review mobile or remote transactions as soon as a connection allows.
- Document exceptions: when a control could not be followed, write what happened and who approved it.
Laws and donor rules differ, so check your grant agreement and local requirements, and take advice from a qualified accountant for your own situation.
Common mistakes to avoid
- One person does everything because "we trust them".
- The same person reconciles the bank and signs payments.
- Approval limits exist but are not written.
- Controls are skipped when the team is busy.
- No one reviews exceptions.
- Controls are written once and never tested.
How EMPO can help
EMPO is a trusted, Yangon-based training and consultancy provider and one of Myanmar's leading names in practical NGO training, with 1,200+ people trained and 15 partner organisations. Our Budget Management training and our Master Project Budget Tracker (Excel VBA) help finance teams track spending, and we support policy and systems development in English and Burmese, online or in person across Myanmar. See our services or the Budget Tracker.
Sources
- Internal Controls for Nonprofits — National Council of Nonprofits
- Financial Control Recommendations for Small Nonprofits — Oregon Department of Justice, Charitable Activities Section, 2023
Questions people ask
What is the most important internal control for a small team?
Separation of duties. The person who approves a payment should not also prepare it, and the person who records it should not be the only one who reviews the bank statement.
We have only two finance staff. What can we do?
Divide the roles between them, and ask a manager or board member to review bank statements and sign off the monthly reconciliation. Even without finance staff, separation can be created by assigning duties to board directors or volunteers.
Do internal controls replace trust?
No. They protect everyone, including honest staff, by making errors visible and by showing donors that funds are handled with care.