Preventing and Detecting Fraud at Not-for-Profits: Environment, Policies, and Controls Can Help Organizations Steer Clear of Problems

[ILLUSTRATION OMITTED] Organizations in all industries must deal with the potential for fraud to occur, and design controls to prevent and detect it. Some not-for-profits have a unique environment that can contribute to fraud. Common characteristics such as an outlook of trust, significant control by a limited number of people (founder, executive director, CEO), limited human and financial resources, reliance on volunteers, higher turnover, and weaker internal controls can contribute to the likelihood of fraud. Fortunately, not-for-profits can use many strategies and controls to prevent fraud. These methods start with the creation of an environment that makes it clear to everyone that fraud will not be tolerated and that appropriate action will be taken if it occurs. This control environment can be created when management and boards set the tone, identify specific risks, and create effective policies and procedures to ensure that the organization can achieve its mission to prevent fraud, and detect fraud if it should occur. TONE AT THE TOP Executives and boards, including the audit committee where there is one, should set the anti-fraud tone. This tone can be established with a set of core values, a mission statement, or a general message about how everyone is expected to act. If management and the board demonstrate through their actions a commitment to do the right thing, and make it clear to their organizations that they have high expectations that their employees and volunteers will do the same, people see it and are more likely to understand what is expected of them. On the other hand, if the CEO, CFO, chief legal counsel, and/or board demonstrate through their actions that they are not really committed to ethical behavior or core values, employees and volunteers are likely to follow their lead. Hillary Coley, CPA, CGMA, the CFO and chief administrative officer for fisheries conservation organization Trout Unlimited, said sharing tone at the top and an anti-fraud environment is especially important in the not-for-profit sector. "When management shares their commitment, it helps the organization's leaders and volunteers to understand that fraud can happen to them," she said. "This is a foreign concept for many not-for-profits because this is an organization they love, and they don't understand how anyone could steal from them. They believe that people are good at heart, but things happen in life that make people rationalize doing things they wouldn't normally do. " Having a committee structure within the board is important, even for smaller not-for-profits, said Donald Murphy, CPA, CGMA, the CEO and managing associate of The Wesley Peachtree Group, CPAs, a fullservice firm based in metropolitan Atlanta that has a strong focus on higher education, faith-based organizations, and other not-for-profits. "It is a challenge for not-for-profits to attract qualified board members with credentials specific to their industries, and creating separate committees like finance and audit with board members with the appropriate qualifications can make the board more effective," he said. Boards can maintain an appropriate focus with periodic retreats and ongoing education in not-for-profit business and governance matters, including fraud. Not-for-profits can understand where they are vulnerable by undertaking a critical assessment of fraud risks specific to their circumstances. These include the risks of material misstatement to the entity's financial statements and enterprisewide risks based on the not-for-profit's sector. The extent of the risk-assessment process will vary based on the organization's size and the nature of its activities. Once the risks are identified and documented, management and the board can discuss the risks on an ongoing basis, with input from external auditors. The board's responsibilities for oversight include ensuring that management is performing the appropriate analysis and oversight. …