NFP Internal Controls and COVID-19

Internal Control Concerns in an NFP Due to COVID-19

The “new normal” of the post COVID-19 world poses significant risks to NFP organizations. Aside from the myriad of operational issues, internal control effectiveness may have deteriorated as well.  Much of the daily accounting work was done at home without segregation of duties. For instance, checks may have been printed  with one person controlling the check stock, writing the checks and signing the checks out of necessity.  When you compound the current sometimes limited level of internal control with the “new normal”, NFP management and boards will need to be more attentive  to fraud and mismanagement flags.  Even NFPs with an independent audit are not immune from potential issues.  Remember, independent auditors do not audit to find fraud.  Even the typical audit procedures may not be as effective as before since much if not all of an audit may be conducted remotely.

What should NFPs do in order to protect themselves?  Here are ten concrete steps Boards and Management should consider:

1. Have a reporting system in place that detects and reports unusual payments. Payments above a certain threshold should be reported to a responsible offer for review. 
2. Insist financial reporting be brought up to date as quickly as possible. Small accounting staffs wear  many hats and are often challenged getting out monthly financial reports already.  Depending on the workload, a slowdown in financial reporting in the current environment is to be expected. However, the relaxation of internal controls does increase the risk of fraud and management to an organization.  Timely financial statements provide a valuable detective control. The faster they are brought up to date the less the risk there is to the organization. 
3. Make sure the quality of financial reporting does not deteriorate.  Variance explanations between actual results and budget need to be maintained at the same level as before, if not increased. 
4. Make sure all payroll taxes are being paid. Personal liability attaches to responsible parties for delinquent payroll taxes and withholding. If you are an officer, you could be left “holding the bag”.  If  payroll taxes have been deferred under recently enacted guidelines, make sure there is sufficient liquidity to pay them when due.  Remember, employee withholding still needs to be remitted. 
5. Make a list of and make sure any other statutory payments are being made.  For instance, your organization may owe the government money from a performance audit.  It is critical such payments are made  in compliance with contractual provisions.  Government contracts may be a big source of revenue for NFP organizations.  An action as simple as not paying a bill should not be allowed to jeopardize the future prospects of the organization. 
6. Be alert for any unanticipated losses, increases in other expenses, or increases in other assets.  These are common ways  for fraudsters to hide illicit payments. 
7. Have an audit committee even if there is no external auditor.  Just knowing someone is watching can deter some fraudsters. 
8. Require separation of duties be restored as quickly as possible.  It may have been necessary to make exceptions during the COVID Crisis, but the “old normal” of segregation of duties should be brought back as soon as possible. 
9. Review the controls around electronic banking.  Electronic banking has exploded during the crisis. Make sure adequate controls are installed around this process as soon as possible. 
10. Remain vigilant! Good internal control and a healthy skepticism is always warranted when liquid assets are concerned. This is even more true in a crisis environment!