What Internal Controls Prevent Fundraising Cash Theft? 2026

Fundraising events are the lifeblood of nonprofit organizations. They bring communities together and generate the revenue needed to deliver on missions. But every cash donation that passes through hands without safeguards is an opportunity for theft.

According to the Association of Certified Fraud Examiners (ACFE), organizations lose an estimated 5% of their annual revenue to fraud. For nonprofits, that loss is especially painful because every stolen dollar was meant for the community. The good news is that the right internal controls can prevent the vast majority of fundraising cash theft before it ever happens.

In this guide, I will walk through the specific internal controls that prevent fundraising cash theft. You will learn what segregation of duties means in practice, how to handle cash at events safely, and how even the smallest nonprofits can build fraud-resistant systems without hiring extra staff.

Internal controls are the financial management practices that systematically prevent misuse and misappropriation of assets. They create checks and balances so that no single person controls every step of a financial transaction. When designed correctly, they protect cash, preserve donor trust, and keep your organization focused on its mission instead of crisis management.

What Are Internal Controls and Why Do Nonprofits Need Them?

Internal controls are the policies, procedures, and checks and balances that protect an organization’s cash and assets from theft, fraud, and honest mistakes. They range from requiring two signatures on a check to performing monthly bank reconciliations. Every nonprofit that handles money needs them, regardless of size.

Fundraising cash is particularly vulnerable because events involve large volumes of cash, temporary volunteers, and fast-paced transactions. Unlike payroll or vendor payments, fundraising cash often flows outside the normal accounting cycle. This makes it a prime target for opportunistic theft.

The fraud triangle, developed by criminologist Donald Cressey, explains why people steal. Three conditions must be present for fraud to occur: opportunity, pressure, and rationalization. Opportunity is the one factor your organization can directly control through internal controls.

Pressure refers to financial strain, such as personal debt, gambling losses, or medical bills. Rationalization is the mental justification a person uses to convince themselves that stealing is acceptable. You cannot always see these two factors, but you can eliminate the opportunity by making fraud difficult to commit and easy to detect.

Risk factors that increase fraud vulnerability in nonprofits include trusting employees without verification, having one person manage all finances, lacking board involvement in financial reviews, and failing to document cash handling procedures in writing. Each of these gaps creates opportunity, which is the doorway to theft.

Segregation of Duties: The Primary Control for Cash Protection

Segregation of duties is the single most effective internal control for preventing fundraising cash theft. It means that no single person should be responsible for all stages of a financial transaction. Specifically, the person who receives cash should not be the same person who records the deposit, reconciles the bank statement, or has access to the accounting system.

The idea is straightforward. If one person handles cash from start to finish, they can skim donations, alter records, and hide the discrepancy. When the work is split among multiple people, each becomes a check on the others. To steal without detection, two or more people would need to collude, which dramatically reduces the likelihood of fraud.

In a well-segregated system, one person collects or counts the cash, a second person prepares the deposit, and a third person reviews the bank statement and accounting records. The person who writes checks should not be the person who signs them. The person who opens the mail should not be the bookkeeper.

For small nonprofits, full segregation can seem impossible with only one or two staff members. But partial segregation still helps. A board member can receive the bank statement directly from the bank before it reaches staff. A volunteer can be present for cash counts at fundraising events. Every separation of duty, even a small one, reduces risk.

Reddit users in the nonprofit community consistently emphasize this point. One user reported discovering a $19,000 shortage from a single program because one person controlled both the cash and the records. The shortage accumulated over months because there was no independent verification. Internal controls are the responsibility of management, not something that can be delegated and forgotten.

Cash Handling Procedures That Prevent Theft

Strong cash handling procedures cover every step of the cash lifecycle: receiving, counting, storing, and depositing. Each step should have documented rules, and every person who touches cash should be trained on those rules. Written procedures eliminate ambiguity and make enforcement consistent.

Receiving Cash

When cash is received, it should be counted immediately in the presence of the donor whenever possible. Issue a written or printed receipt for every donation, including small cash gifts. For mailed donations, two people should open the mail together and log each check and cash amount before it reaches the bookkeeper.

For fundraising events, assign specific volunteers to cash stations. Each station should start with a documented float, and every transaction should be logged on a tally sheet or point-of-sale system. No one should carry cash around the event without a sealed and labeled bag.

Counting Cash Under Dual Custody

Dual custody means two unrelated people count the cash together at the same time. Both people verify the amount, and both sign the count sheet. This single practice prevents the most common form of theft: skimming cash before it is recorded.

If the count does not match the expected amount, document the discrepancy immediately. Investigate any variance, no matter how small. Consistent variances at the same station or with the same person are a red flag that warrants closer attention.

Storing and Depositing Cash

Store cash in a locked safe with restricted access. Only designated individuals should have keys or combinations, and the safe should remain locked whenever cash is not being actively processed. Change combinations periodically and whenever staff turnover occurs.

Deposit cash as quickly as possible, ideally within one business day of receipt. The longer cash sits undeposited, the greater the risk of loss. Use a tamper-evident deposit bag and transport deposits using a secure method. Never let one person both prepare and transport the deposit alone.

The person who prepares the deposit should not be the person who reconciles the bank statement. This separation ensures that any discrepancy between the count sheet and the bank deposit is caught by an independent reviewer.

Authorization and Approval Controls

Authorization controls ensure that no single person can approve a transaction, release funds, or make a purchase without oversight. These controls prevent both outright theft and the more subtle misappropriation of assets through fictitious vendors or inflated expenses.

Establish spending thresholds that require different levels of approval. For example, purchases under $500 might need one supervisor’s approval, while anything over $5,000 requires board authorization. Document each approval in writing so there is an audit trail.

A two-signature requirement on checks is one of the oldest and most effective authorization controls. The person who writes the check cannot be one of the two signers. While banks do not always verify second signatures, the practice creates accountability and makes collusion necessary for check fraud to succeed.

For wire transfers and electronic payments, require dual approval within the banking system. Most commercial banks offer this feature at no additional cost. The first person initiates the payment, and a second authorized user must approve it before the funds move.

Approval controls also apply to new vendors. A common fraud scheme involves setting up a fictitious vendor and routing payments to a personal account. Require documentation for every new vendor, including a W-9 form, and have someone other than the accounts payable clerk approve the vendor setup.

Reconciliation and Independent Review Procedures

Reconciliation is the process of comparing internal records to external records to confirm that all transactions are accounted for. It is the detective control that catches what preventive controls miss. Without reconciliation, fraud can continue undetected for months or even years.

Monthly Bank Reconciliation

Reconcile bank accounts monthly, within ten days of receiving the statement. The person performing the reconciliation should not be the person who handles cash, writes checks, or makes deposits. This is a core segregation of duties principle.

During reconciliation, compare every deposit to the cash count sheets and event tallies. Look for deposits that are smaller than expected, deposits made late, or missing deposits entirely. Investigate any unexplained differences immediately.

Who should see bank statements besides the bookkeeper? The answer is the board treasurer or finance committee chair. Arrange for the bank to send statements directly to a board member, or provide online read-only access. This simple step creates independent oversight without requiring extra staff.

Surprise Audits and Independent Reviews

A surprise cash count is one of the most powerful deterrents to theft. Without warning, an independent person counts the petty cash box, the safe contents, and any cash on hand, then compares the count to the recorded balance. Any unexplained shortfall is a red flag.

Conduct surprise counts at least quarterly and rotate who performs them. You can also bring in an external CPA for an annual review or audit. Even a limited review by an outside professional signals to staff and volunteers that someone is watching.

Board involvement in financial oversight provides legitimacy and accountability. The finance committee should review monthly financial reports, ask questions about variances, and approve the annual budget. Passive boards that rubber-stamp financial reports are a common factor in nonprofit fraud cases.

Fundraising Event Specific Controls

Fundraising events present unique cash handling challenges that office procedures alone do not address. Events involve volunteers who may not know each other, high-volume transactions compressed into a short time, and cash moving through multiple hands in a chaotic environment. Specific controls designed for events close these gaps.

Pre-Event Planning

Before the event, document every cash handling station and assign named volunteers to each. Provide written procedures for how cash will be collected, counted, and stored. Train all volunteers on these procedures before the event begins, and have each person sign acknowledging they understand the rules.

Issue numbered receipt books or use a point-of-sale system at every station. If using cash boxes, document the starting float for each box and have two people verify and sign off on the amount. Numbered tickets or wristbands for paid entry create an auditable trail that can be reconciled against cash collected.

During the Event

Limit the number of people with access to each cash box. Ideally, one person handles transactions while a second person monitors and logs sales. Rotate volunteers at cash stations every two hours to reduce fatigue and create natural checkpoints.

Periodically during the event, have a supervisor perform mid-event cash drops. Move excess cash from stations to a locked safe or secure location in a tamper-evident bag. Each drop should be logged with the time, amount, and signatures of the two people involved.

End-of-Night Reconciliation

At the close of the event, two unrelated people should count all cash together. Count each station separately and compare the total to the ticket sales, tally sheets, or POS reports. Document any discrepancies and investigate before anyone leaves for the night.

Have a board member or non-staff volunteer present for the final count whenever possible. The person who manages the event finances should not be the sole person counting and depositing the cash. Deposit the proceeds the next business day, and send a copy of the deposit slip and count sheet to the treasurer.

Online Donations and Restricted Funds

Encourage online donations wherever possible. Digital payments create automatic records and eliminate the physical cash risk entirely. For donations that are restricted to a specific purpose, document the restriction at the point of receipt and track the funds separately in the accounting system.

Background Checks, Bonding, and Whistleblower Policies

Beyond procedures and approvals, certain organizational policies strengthen your fraud prevention framework from the outside. These controls address who has access to money, what happens if they steal, and how concerns get reported.

Background Checks for Money Handlers

Run background checks on all staff and volunteers who handle cash, sign checks, or have access to financial systems. A criminal history check can reveal prior fraud or theft convictions that would not surface in an interview. Repeat the check periodically, not just at hire.

Fidelity Bonding and Insurance

A fidelity bond, also called crime insurance, reimburses the organization if an employee or volunteer steals funds. It is a financial safety net that complements your preventive controls. Many grantmakers and insurers require bonding as a condition of funding.

Review your insurance coverage annually to confirm it matches your current operations. Confirm that the bond covers volunteers, not just paid staff, since fundraising events often rely heavily on volunteer cash handlers.

Whistleblower Policy

A whistleblower policy gives staff and volunteers a safe, confidential way to report suspected fraud without fear of retaliation. Without this channel, people who notice irregularities may stay silent. Require that all reports be investigated promptly by someone independent of the suspected individual.

Document the whistleblower policy in your employee handbook and volunteer orientation materials. Make sure everyone knows how to report a concern and that they are protected for doing so. The mere existence of a known reporting channel deters would-be thieves.

Implementing Internal Controls in Small Nonprofits

Small nonprofits often feel that internal controls are designed for large organizations with accounting departments. The reality is that every organization can implement meaningful controls, even with a staff of two. The key is leveraging board members, volunteers, and technology to create separation where staffing alone cannot.

Start with the Highest-Impact Controls

If you can only implement a few controls, prioritize these five. First, segregate cash handling so that no single person collects, records, and deposits. Second, require monthly bank reconciliation by someone other than the bookkeeper. Third, have bank statements sent directly to a board member. Fourth, document all cash handling procedures in writing. Fifth, conduct surprise cash counts at least quarterly.

Leverage Your Board

Board members are an underused resource for financial oversight. The treasurer can review monthly statements and reconciliation reports. Finance committee members can rotate through surprise audit duties. A board member can serve as the second signature on checks or the second person at event cash counts.

Use Technology to Create Separation

Accounting software lets you assign different permission levels to different users. The data entry person cannot approve payments. The executive director can view reports but not modify transactions. Online banking portals support dual approval for electronic transfers. These built-in controls create segregation without requiring additional headcount.

Document Everything in Writing

Unwritten rules are unenforceable rules. Write down every procedure, from how to count a cash box to who signs checks over $1,000. Keep these documents in a financial policies manual that every staff member and key volunteer receives. Update the manual annually and have the board review and approve any changes.

What to Do When You Suspect Fraud

If you suspect theft, do not confront the individual immediately. Instead, quietly secure the records and contact your CPA or legal counsel for guidance. Preserve all documentation. A premature accusation can alert the person and lead to evidence destruction. Professional guidance helps you follow proper legal and investigative steps.

FAQs

Conclusion

Understanding what internal controls prevent fundraising cash theft comes down to one core principle: no single person should control a financial transaction from start to finish. Segregation of duties is the foundation, supported by cash handling procedures, authorization controls, reconciliation practices, and organizational safeguards like background checks and whistleblower policies.

Fundraising events demand extra attention because they concentrate cash in fast-paced, volunteer-driven environments. Event-specific controls like dual custody counts, mid-event drops, and end-of-night reconciliation close those gaps. Even the smallest nonprofits can implement meaningful protection by leveraging board members and technology.

Start with the five highest-impact controls outlined in this guide, document everything in writing, and review your procedures annually. Every dollar you protect through strong internal controls is a dollar that advances your mission and honors the trust your donors have placed in you.