Internal control findings matter because they identify where an organization is relying too heavily on trust, habit, or one person's knowledge instead of a clear process. In small governments and nonprofits, that risk is understandable. Staffing is often lean, people wear many hats, and the same employee may be involved in several parts of a transaction cycle.

A finding does not automatically mean fraud occurred. It also does not mean management is careless. More often, it means the organization needs a stronger control, better documentation, or clearer oversight so errors, noncompliance, or misuse of resources are more likely to be prevented or detected in time.

The most useful response is practical. A small organization does not need a large-company control system. It needs controls that fit its size, address real risks, and leave a clear audit trail.

An internal control finding usually means a control was missing, was not designed well enough, was not operating consistently, or was not documented in a way that showed it operated. The issue may relate to financial reporting, compliance, safeguarding of assets, or operational oversight.

For example, a finance director may review bank reconciliations every month, but if there is no date, signature, electronic approval, review note, or evidence of follow-up, it may be difficult to demonstrate that the review happened. In that situation, the problem may be documentation rather than the absence of oversight.

In plain English, an internal control should answer four questions:

• Who performed the control?
• What information did they review?
• When did the review or approval occur?
• What happened if they found an error, exception, or unusual item?

Limited segregation of duties is one of the most common findings in smaller governments and nonprofits. Ideally, no one person should control too many parts of the same transaction. In practice, a small office may not have enough employees to fully separate authorization, custody, recordkeeping, reconciliation, and review.

Common examples include one person who can:

• Receive money, prepare deposits, record receipts, and reconcile the bank account.
• Add vendors, enter invoices, print checks, and post disbursements.
• Set up employees, process payroll, and review payroll reports.
• Prepare journal entries and post them without review.
• Administer system access and also process financial transactions.

The solution is often a compensating control. For example, a manager, treasurer, executive director, board member, or finance committee member can review bank statements, claims, payroll change reports, vendor change reports, or monthly financial results. The key is to document the review.

Many findings arise because management tells the auditor a review occurred, but the file does not show it. This is frustrating because the organization may actually be doing the right thing. The problem is that the control trail is incomplete.

Examples of missing review evidence include:

• Bank reconciliations without reviewer initials, dates, or electronic approval.
• Journal entries posted without approval documentation.
• Credit card statements with receipts but no supervisor review.
• Payroll registers printed but not signed off by the responsible reviewer.
• Board packets showing financial reports, but minutes that do not reflect review or acceptance.

A simple standard can help: every important review should show who reviewed it, when it was reviewed, what was reviewed, and whether exceptions were resolved.

Cash is often the highest-risk area because it is liquid and touches almost every part of the organization. Bank and investment reconciliations should be completed timely, agree to the general ledger, include all accounts, and be independently reviewed.

Common issues include:

• Reconciliations completed several months after month-end.
• Old outstanding checks or deposits in transit that are not investigated.
• Bank accounts, investment accounts, petty cash, escrow accounts, or restricted accounts omitted from the reconciliation process.
• Book balances that do not agree to the general ledger.
• No evidence that someone independent reviewed the reconciliation and supporting bank statement.

A good monthly process includes a reconciliation, a review of unusual reconciling items, follow-up on stale items, and documentation that the review was completed.

Cash receipts can include taxes, fees, utility payments, donations, program service revenue, fundraising proceeds, grants, rental income, and online payments. Findings occur when the organization cannot show a clear path from receipt to deposit to the accounting records.

Common control gaps include:

• Deposits not made timely.
• Receipt logs, batch reports, or donation records that do not agree to the deposit.
• Insufficient support for cash collected at events, counters, or remote locations.
• No independent comparison of deposit records to bank activity.
• Limited controls over online payment platforms or merchant accounts.

Small organizations can strengthen this area by using prenumbered receipts or system reports, requiring timely deposits, separating collection from reconciliation when possible, and having someone independent compare deposits to bank activity.

Disbursements should show that the purchase was authorized, supported by an invoice or receipt, coded to the proper account, and paid only once. For governments and nonprofits with public accountability, procurement documentation and credit card controls are especially important.

Common findings include:

• Invoices paid without evidence of approval.
• Purchase orders or approvals created after the purchase.
• Missing receipts for credit card transactions.
• No documented review of cardholder statements.
• Vendor setup or vendor changes performed without independent review.
• Procurement files that do not show required bids, quotes, sole-source justification, or conflict-of-interest review.

The fix is usually a clear approval trail. The file should show who requested the purchase, who approved it, what support was reviewed, and whether procurement requirements were met.

Payroll is often one of the largest expenditure areas. It also involves sensitive information, recurring payments, employee benefit costs, grant allocations, pension or retirement contributions, and changes in pay rates or status.

Common issues include:

• Pay rate changes without written approval.
• New hires or terminations not supported by approved personnel forms.
• Timecards or timesheets not approved by supervisors.
• Overtime, leave, stipends, bonuses, or special pay not clearly authorized.
• Payroll registers not reviewed before or after payroll is processed.
• Grant-funded payroll charges without time-and-effort or allocation support, when required.

A practical control is to review a payroll change report, payroll register, and employee master file change report each pay period or month. The review should be documented and exceptions should be followed up.

Journal entries can significantly affect the financial statements. They also tend to be less visible than normal cash receipts, disbursements, or payroll transactions. For that reason, auditors often look closely at how journal entries are prepared and reviewed.

Common findings include:

• Journal entries posted without approval.
• Limited descriptions or missing supporting documents.
• Entries posted directly by the same person who prepared the support.
• Late year-end entries not reviewed by management.
• No periodic review of manual journal entries or unusual entries.

A stronger process includes descriptions that explain the purpose of the entry, support attached to the entry, and documented approval by someone with appropriate knowledge.

Grants and restricted resources create two related risks: the financial statements must report the activity properly, and the organization must comply with the underlying restrictions or award requirements. This area affects governments and nonprofits in different ways, but the control expectations are similar.

Common issues include:

• Grant files missing award letters, amendments, budgets, reimbursement requests, or closeout documents.
• Federal award expenditures not reconciled to the general ledger and grant reports.
• Procurement, eligibility, reporting, matching, or subrecipient monitoring support not retained.
• Restricted cash, bond proceeds, capital project resources, or special revenue activity not tracked separately enough.
• Donor-restricted contributions, releases from restriction, or purpose restrictions not supported clearly enough for nonprofit reporting.

A grant or restricted-resource file should tell the full story: what was awarded or restricted, what costs were charged, what was reported or requested for reimbursement, and what remains available or restricted at year-end.

Capital assets and equipment can be a challenge because responsibility is often shared among finance, public works, facilities, IT, program staff, and department heads. Findings occur when the accounting records do not agree to the underlying asset records or when additions and disposals are not communicated timely.

Common findings include:

• Capital asset listings that do not reconcile to the general ledger.
• Missing support for additions, disposals, transfers, or construction in progress.
• No documented capitalization threshold or inconsistent application of the policy.
• Equipment purchased with grants not tagged, tracked, or inventoried as required.
• Old assets remaining on the listing after disposal, sale, trade-in, or abandonment.

Management should maintain a rollforward that agrees beginning balances to the prior year, shows current-year additions and disposals, and ties ending balances to the financial statements.

Internal controls increasingly depend on financial software, payroll systems, online banking, grant portals, donor databases, and cloud applications. If access is not reviewed, employees or former employees may have permissions they no longer need.

Common issues include:

• No periodic review of user access rights.
• Former employees, board members, volunteers, or vendors retaining access.
• Users with administrator rights who also process transactions.
• Shared usernames or generic logins.
• Online banking or payment platform access not aligned with approval authority.
• Multifactor authentication, password settings, or backup procedures not documented or reviewed.

A practical control is a quarterly or semiannual access review. Management should document who reviewed the user listing, what changes were needed, and when those changes were completed.

Policies are only useful if they reflect how the organization actually operates and what the organization is required to do. A policy that is outdated, ignored, or inconsistent with current systems can become a finding even if the underlying transaction was reasonable.

Policies to review periodically include:

• Purchasing and procurement.
• Credit cards and employee reimbursements.
• Cash receipts and deposits.
• Payroll, timekeeping, and leave.
• Capitalization and equipment tracking.
• Grant administration and subrecipient monitoring.
• Conflicts of interest, whistleblower, document retention, and fraud reporting.
• Electronic payments, online banking, user access, and cybersecurity practices.

A good policy should be clear enough that a new employee, department head, board member, or auditor can understand what is required and what documentation should exist.

Boards, councils, and finance committees play an important role in smaller organizations because they can provide independent oversight that the staff structure cannot fully provide. However, that oversight needs to be visible in the record.

Useful oversight evidence may include:

• Minutes showing review or acceptance of financial reports, claims, budget amendments, grants, contracts, and policies.
• Finance committee packets with bank activity, budget-to-actual reports, and explanations of significant variances.
• Approval of major purchases, debt, leases, grant applications, or restricted-resource decisions.
• Documented follow-up on audit findings, management letter comments, and corrective action plans.
• Review of Form 990 governance information and policies for nonprofits, when applicable.

Good governance documentation does not require lengthy minutes. It requires enough detail to show what was reviewed, what was approved, and whether follow-up was assigned.

Repeat findings often happen because everyone agrees with the recommendation, but no one owns the follow-up. Corrective action should be managed like a small project with an owner, due date, status, and evidence of completion.

A practical follow-up process includes:

• A list of prior-year findings and management letter comments.
• A responsible person for each corrective action.
• A target completion date.
• A short description of the action taken.
• Evidence that the new or revised control operated.
• Periodic reporting to management and the board or council until the item is closed.

• What duties are performed by the same person, and what compensating review exists?
• Do bank reconciliations show who prepared and reviewed them, and when?
• Can we trace cash receipts from receipt to deposit to the accounting records?
• Do disbursements show approval, support, business purpose, and proper coding?
• Are credit card transactions supported by itemized receipts and documented review?
• Are payroll changes, time records, leave, and payroll registers reviewed and approved?
• Are manual journal entries supported and reviewed?
• Are grants, donor restrictions, restricted cash, and special funding sources reconciled and supported?
• Do capital asset and equipment records agree to the general ledger and physical records?
• Have user access rights been reviewed for accounting, payroll, banking, grant, and donor systems?
• Do policies match current systems, staffing, and actual practices?
• Are prior-year findings assigned, tracked, and reported to the board or council until resolved?

Common findings include limited segregation of duties, missing evidence of review, late bank reconciliations, weak cash receipt documentation, inconsistent purchasing or credit card approvals, payroll approval gaps, unreviewed journal entries, incomplete grant or restricted-resource support, outdated policies, and limited user access review.

No. An internal control finding does not automatically mean fraud occurred. It means a process, review, approval, documentation trail, or oversight activity needs improvement to reduce the risk of error, noncompliance, or misuse of resources.

Small organizations can use compensating controls, such as independent review by management, a treasurer, executive director, board member, council member, or finance committee. The review should be documented and should include follow-up on unusual items.

Evidence may include a dated signature, initials, electronic approval, review checklist, meeting minutes, exception report, or written note showing who reviewed the item, when it was reviewed, what was reviewed, and whether exceptions were resolved.

Bank reconciliations are common audit issues because cash is high risk, bank activity is frequent, and old reconciling items can hide errors or unresolved transactions. Timely preparation and independent review are important controls.

Nonprofits should track donor-restricted contributions by purpose, time restriction, or other donor restriction; support releases from restriction; reconcile restricted balances to the ledger; and retain donor communications or award documents.

Organizations with federal awards should maintain grant files, reconcile expenditures to the ledger and reports, document procurement and eligibility support, monitor subrecipients when applicable, and maintain controls over compliance with award terms.

Many small organizations review user access at least quarterly or semiannually, and whenever employees, officers, volunteers, or vendors change roles or leave. The review should include accounting, payroll, banking, grant, donor, and payment systems.

Boards and councils can review financial reports, budget-to-actual results, claims, bank activity, significant contracts, grants, policies, audit findings, and corrective action status. The minutes or board packet should show that oversight occurred.

Start with the prior-year audit findings and management letter comments. Assign an owner, due date, corrective action, and evidence-of-completion requirement for each item, then report progress to management and governance until each item is closed.

Internal controls do not need to be complicated to be effective. The strongest improvements are often simple, consistent, and visible: reconcile timely, review independently, document approvals, restrict access, retain support, and follow up on exceptions. For small governments and nonprofits, the goal is not more paperwork. The goal is a clear process that protects public and donor resources and supports reliable financial reporting.

Please contact your Gabridge & Company engagement team with questions about strengthening internal controls or preparing for your next audit.

• U.S. GAO Green Book
• U.S. GAO Government Auditing Standards, 2024 Revision
• 2 CFR 200.303 - Internal controls
• IRS Form 990 Part VI governance information
• Committee of Sponsoring Organizations of the Treadway Commission, Internal Control - Integrated Framework, 2013.
• Applicable state statutes, local ordinances, nonprofit bylaws, grant agreements, donor restrictions, debt agreements, contracts, and internal policies.