A nonprofit internal controls audit examines how well your organization safeguards assets, prevents fraud, and maintains accurate financial records. This is separate from a financial statement audit—auditors specifically dig into the systems and processes you've built to manage money and donations. Understanding what gets tested helps you prepare documentation, identify gaps before the audit starts, and avoid costly findings that could derail your Form 990 filing.
Why Auditors Focus on Internal Controls
The IRS and nonprofit watchdogs view strong internal controls as proof that your organization operates with integrity. When auditors test controls, they're assessing risk across five key areas: asset safeguarding, accurate financial reporting, regulatory compliance, operational efficiency, and grant or donation stewardship. A weakly controlled nonprofit risks questioned costs, audit adjustments, and reputational damage that affects donor confidence.
The Five Core Areas Under Examination
Cash Management and Bank Reconciliations
Auditors trace cash from receipt to deposit to ensure no funds disappear between collection and accounting. They'll examine:
- Bank reconciliations (monthly reconciliation of statements to GL is standard)
- Segregation of duties (who receives cash vs. who records it vs. who reconciles)
- Petty cash counts and authorization levels
- Lock-box or remote deposit procedures if you use them
Expect auditors to request 2–4 months of complete bank statements, reconciliation workpapers, and documentation of any unusual timing differences. Organizations with annual budgets under $250K often face tighter scrutiny here because fewer staff mean harder segregation of duties.
Donation and Pledge Controls
Nonprofits receiving restricted gifts need controls that track donor intent throughout the spending cycle. Auditors verify:
- Documentation showing how donors restricted gifts (email, pledge form, gift agreement)
- Evidence that restricted funds went to their intended purpose
- Timely communication with donors if restrictions can't be met
- Accounting entries that clearly flag restrictions in the GL
Missing pledge documentation or funds spent outside donor intent are common audit findings. Have a centralized gift log showing donation date, amount, donor name, and any restrictions clearly noted.
Payroll and Personnel Records
This is often where auditors find the most control gaps in smaller nonprofits. Testing typically covers:
- W-4 forms and I-9 verification for all employees
- Timekeeping records (timesheets, punch clock, or time-tracking software)
- Payroll authorization (who approves time, who processes payroll, who reconciles)
- Tax withholding and benefits compliance
- Board approval of executive compensation
Auditors will cross-check payroll registers to tax returns and Forms W-2. If your executive director's salary isn't documented by board minutes approving it, that's a red flag finding.
Grant and Contract Compliance
If you receive government grants (federal, state, or local), auditors perform a Single Audit or Grant Audit under OMB Uniform Guidance. This tests:
- Budget vs. actual spending for each grant
- Allowable cost documentation (invoices, timesheets, receipts)
- Time tracking for grant-funded staff (often a compliance requirement)
- Indirect cost allocation if you claim overhead
- Compliance with grant-specific reporting deadlines
Grant audits add $3,000–$8,000+ to your audit cost, depending on grant volume and complexity.
Expense Reimbursement and Procurement
Auditors want evidence that your board and staff follow written policies when spending money. Documentation requirements include:
- Receipts for expenses over a set threshold (often $25–$50)
- Approval authorization based on dollar amount
- Competitive bidding documentation for major purchases
- Board approval of significant commitments
- Conflict-of-interest disclosures for board and staff with vendor relationships
Nonprofits without written expense policies often struggle here; auditors may require you to adopt one before finalizing the audit.
Preparing for the Test
Start 2–3 months before your audit fieldwork begins. Compile organization charts showing reporting lines and responsibilities, written policies on cash handling and spending, and a general ledger that's current and reconciled. Identify areas where duties overlap (a red flag for auditors) so you're not blindsided.
When hiring an audit firm, ask specifically how they test internal controls and what weaknesses they typically find in nonprofits your size. Providers on platforms like Mercoly let you compare audit firms, pricing, and client reviews to find one experienced in your subsector.
Frequently Asked Questions
Q: How much does a nonprofit internal controls audit cost? A: Standalone internal controls audits run $2,500–$5,000 for smaller nonprofits; if bundled with a financial statement audit, the combined cost is typically $4,500–$15,000+ depending on complexity and staff size.
Q: What's the difference between testing internal controls and a financial statement audit? A: A financial statement audit verifies that your 990 numbers are accurate; an internal controls audit examines the systems preventing errors and fraud, though auditors often assess both in one engagement.
Q: What happens if auditors find control weaknesses? A: Weaknesses are documented in an audit report or management letter; material weaknesses may require you to disclose them on your Form 990 or to funders, and you'll need a remediation plan.
Use Mercoly to find and compare audit firms that match your nonprofit's size, budget, and sector expertise.