Nonprofit internal controls for a small team: What to do with only two people in finance

Nonprofit internal controls are the checks that keep one person from entering, approving, and reconciling the same transaction, and a two-person finance team has to design them on purpose. Numetix builds these checks into the monthly close with a named reviewer. This guide covers what to separate, what the board should review, and what federal awards require.

QUICK ANSWER: WHAT INTERNAL CONTROLS DOES A SMALL NONPROFIT NEED?

• No single person should enter, approve, and reconcile the same money, so split those three jobs across two staff and one independent reviewer.

• When a duty cannot be separated, add a compensating check, such as a treasurer who reviews bank statements straight from the bank each month.

• Write the controls down, because federal awards expect documented, maintained controls and not informal habits that live in one person's head.

Numetix is the expert-led, AI-powered, human-in-the-loop bookkeeping layer for nonprofits and other founder-led organizations, so ledgers, grants, and restricted funds are prepared by software and reviewed by a named person. The sections below set out the rule, which duties to separate, and the checks the board should run.

What are internal controls for a nonprofit?

Internal controls are the policies and routines that protect assets, keep records accurate, and catch errors early. For organizations that spend federal money, the rule is explicit. The Uniform Guidance says a recipient must establish, document, and maintain effective internal control over the federal award, aligned with the Comptroller General's Standards for Internal Control in the Federal Government or the COSO Internal Control-Integrated Framework (2 CFR 200.303). The same section asks for reasonable cybersecurity measures to protect personal information. COSO publishes its framework on its internal control guidance page.

Which duties should two people separate?

The segregation of duties and internal control glossary entries define the basics.

What compensating controls fit a two-person team?

• Give the treasurer read-only online access to bank statements, so they see the source record and not a copy.

• Require two approvals above a dollar limit the board sets.

• Never let anyone approve their own expense or reimbursement.

• Log incoming checks at two points, such as the person who opens the mail and the person who deposits.

• Rotate reconciliation duties each quarter, or hire an outside reviewer for the close.

• Review every manual journal entry that changes revenue or restricted funds.

What should the board review each month?

• The signed bank reconciliations for every account.

• A budget-to-actual report with explanations for large variances.

• A list of new vendors, payroll changes, and unusual entries.

• Restricted fund balances, matched to grant and donor terms.

Our guides to nonprofit board financial oversight and the monthly board financial reports list what a useful packet contains.

What happens when controls fail?

Missing controls let small errors and misuse run for a long time, a point our piece on how common misuse of restricted funds really is develops. Written controls also help in an audit, because an auditor can test a documented routine and cannot test an undocumented habit.

Frequently asked questions

Can a two-person team really separate duties?

Not fully, and that is normal. Split entering, approving, and reconciling where you can, then add independent review where you cannot. A treasurer or an outside bookkeeper who reviews the work monthly covers most of the gap. The aim is that no one person can hide a mistake or a theft.

Who should reconcile the bank account?

Someone who does not record transactions or sign checks. In a two-person team that is often hard, so the treasurer should review each reconciliation and compare it with the bank's own statement. An outside bookkeeper who has no payment authority can also perform the reconciliation.

Do small nonprofits need written policies?

Yes. A short written policy is easier to follow and easier to audit. For federal awards the rule asks recipients to document their internal controls, so an informal routine is not enough. Cover approvals, access, reconciliation, expense limits, and who reviews what each month.

Numetix is the expert-led, AI-powered, human-in-the-loop bookkeeping layer that keeps books, controls, and reports reconciled with a named reviewer. See our bookkeeping services built for nonprofit organizations.