Controls, Assurance, and the Compliance Calendar

Internal control is not mistrust. It is a system that protects people from error, temptation, accusation, and impossible concentration of authority.

Five control functions

For each money flow separate where feasible:

1. authorization — permission;
2. custody — access to cash/assets;
3. recording — accounting entry;
4. reconciliation — comparison to independent source;
5. review — investigation and follow-up.

National Council of Nonprofits emphasizes clear authority, segregation, documentation, and monitoring ¹.

Walk the transactions

Donation

mail/portal receipt → gift/restriction record → deposit → accounting → donor acknowledgment → bank reconciliation → development/accounting reconciliation → board reporting

Check:

• two-person mail/cash process;
• payment platform access and MFA;
• donor restriction captured exactly;
• donor database equals ledger;
• acknowledgments do not overstate deductibility;
• refund/reversal authority;
• no donor payment instructions changed from email alone.

Registration/refund

enrollment → payment/deferred revenue → roster → attendance → earned revenue → refund/cancellation → reconciliation

Check approval for complimentary seats, scholarships, refunds, transfers, chargebacks, and instructor payment.

Purchase/payment

need → budget/authority → conflict/procurement → receipt of goods → invoice approval → payment → recording → bank reconciliation

No person should independently create a vendor, approve the purchase, change bank details, release payment, record it, and reconcile.

Payroll

Separate hire/pay authorization, time/changes, payroll processing, bank release, reconciliation, and tax filing review. Directors should receive exception evidence, not employee detail without need.

Small-staff compensating controls

When full segregation is impossible:

• unopened bank statements/read-only bank access to an independent reviewer;
• monthly review of bank reconciliations, cleared images, new vendors, payroll changes, refunds, journals, and card detail;
• dual approval above thresholds;
• automated audit logs;
• mandatory vacation/cross-training;
• direct complaint route;
• rotating spot checks;
• finance committee exception reporting.

Signatures without review are theater.

Assurance levels

Understand the engagement:

• internal management statements: prepared by organization;
• compilation: accountant presents information, generally no assurance;
• review: limited assurance through inquiry/analytics;
• audit: reasonable—not absolute—assurance that statements lack material misstatement;
• agreed-upon procedures: findings on specified procedures.

Ask the CPA what was in scope, materiality, adjustments, control deficiencies, estimates, going-concern issues, restrictions/grants, and management letter. An audit does not guarantee no fraud.

Compliance is a matrix, not one deadline

Maintain:

Verify current requirements every year.

Wisconsin distinctions

• Corporate annual report: maintains corporation information through Wisconsin DFI ².
• Charitable solicitation registration/reporting: separate DFI charitable-organization stream ³.
• Financial statement attachment: current Form 1952 instructions use contribution thresholds for reviewed/audited statements and a waiver process; the March 2024 form identifies review above $500,000 through $999,999 and audit at $1,000,000 or more in contributions ⁴. Recheck the form in the filing year and obtain accounting advice.
• Raffles: Wisconsin requires a raffle license; Class A and B rules differ ⁵. An auction, door prize, sweepstakes, and raffle are not interchangeable labels.
• Sales/use tax: exemption from income tax does not make every purchase or sale exempt; Publication 206 explains Wisconsin nonprofit rules ⁶.

Federal watch items

• Form 990 is generally due the 15th day of the fifth month after year-end, subject to current rules/extensions ⁷.
• Unrelated business income generally has three elements: trade/business, regularly carried on, and not substantially related to exempt purpose; exceptions and modifications apply. Form 990-T filing is generally triggered when gross unrelated business income is $1,000 or more ⁸.
• Public support, payroll, contractor reporting, donor acknowledgments, lobbying/election rules, and grant conditions have separate tests.

For Shake Rag, assess—not assume—the treatment of rentals, lodging, merchandise, food, sponsorship benefits, advertising, raffles, and asset use with a nonprofit CPA or counsel.

Fraud-response plan

Before suspicion:

• reporting channels and non-retaliation;
• authorized response team;
• insurer/counsel/forensic contacts;
• evidence preservation;
• limits on access changes and interviews;
• authority to notify bank, processor, law enforcement, funder;
• communications and recovery.

If concern arises, do not confront casually, alter files, promise outcomes, or let a potentially implicated person control the inquiry.

Quarterly finance assurance

The board receives:

• statements and forecast;
• restriction/grant compliance;
• bank/reconciliation confirmation;
• control exceptions and corrective actions;
• filing calendar status;
• suspected fraud/material error incidents;
• external accountant findings;
• decisions required.

The useful question is not “Did someone file everything?” It is: What evidence shows each obligation and control is owned, reviewed, and corrected?