Internal financial controls for charities: what actually stops the money leaving

Two charity staff reviewing financial documents together as a second pair of eyes

Most charity fraud is not sophisticated. It is enabled by a gap that nobody got round to closing, and it is usually visible in the bank statement the whole time.

This guide sets out the financial controls every charity should have, the small-charity version of each, and what a board should be looking at every month. It is written for trustees and finance leads.

Start with the uncomfortable research

In February 2026 the Charity Commission surveyed charity trustees. BMG Research carried out the work and the results were published on 8 July 2026, based on 2,947 completed responses.

Two findings sit oddly together.

99% of trustees say they are confident in their role. 61% describe themselves as very confident.

Asked to identify the most basic financial control, only 68% chose having more than one person involved in all transactions. 71% chose audit.

Across a seven-question test of financial controls, trustees averaged 5.24 correct answers. Only 19% got all seven right. And confidence in managing finances was the one measure that fell, from 89% to 87%.

That is not a criticism of trustees. It is a description of a gap between how confident boards feel and how clearly the basics are understood, and it is exactly the gap that fraud lives in.

An audit is not a financial control

This is the single most important point in this guide.

An audit, or an independent examination, is an independent opinion on a set of accounts. It is formed after the financial year has ended, on a sample basis, by someone looking for material misstatement rather than for a particular person behaving badly.

It is a check. It is not a control.

A fraud that runs for eleven months is very often inside the accounts that get signed off, because the money left through a process nobody questioned. The transactions were recorded. They were just not challenged.

A control is the thing that stops the payment leaving in the first place.

The five controls every charity should have

1. No single person can move money out of the charity alone

Not for any amount. Not in an emergency. Not while the treasurer is on holiday.

Nearly every business banking platform supports a second authoriser at no extra cost. A great many charities have the feature available and have never switched it on.

Small charity version: if you genuinely cannot get two people onto the banking platform, a trustee reviews every payment after the fact, monthly, with read-only access. Weaker, but far better than nothing, and it must be someone who did not make the payments and this process should be recorded as happening.

2. Supplier bank detail changes are verified by phone, on a number you already held

This is the single most common route by which money leaves a charity by mistake. An email arrives, apparently from a supplier, saying their bank details have changed. It looks right. It often comes from a genuinely compromised mailbox.

The procedure is one line: ring them on the number you already had, not the one in the email, and speak to a person.

Small charity version: identical. This one does not scale down, because it costs nothing.

3. Someone who did not make the payments reads the bank statement every month

Not the summary. The statement.

Small charity version: a trustee, from home, fifteen minutes a month, read-only access. This single change does more than any policy document.

4. Income is counted and recorded by two people wherever cash is involved

Collection tins, events, shop takings, donations in person. Two people count, both initial the sheet.

Small charity version: if two people genuinely cannot be present, bank it unopened and reconcile against the paying-in slip.

5. Expenses are approved by someone other than the claimant, and nobody approves their own

Including the chief executive. Especially the chief executive. Their claims go to the chair.

Segregation of duties when there are three of you

“We are too small to segregate duties” is the most common objection, and it is usually wrong.

Segregation of duties is not about having more people. It is about not letting one person authorise a payment, make it, and check it afterwards. Break any one of those three away and most of the risk goes with it.

None of that needs a bigger team. It needs a decision about who is not allowed to do something, which is governance rather than staffing.

For the smallest charities, the honest position is that you will not achieve perfect separation and you are not expected to. You are expected to have thought about it, done what you reasonably can, written down why the rest is not possible, and had the board look at the remaining gap with its eyes open.

What the board should see on a regular basis

Most boards receive either too little to spot anything or too much to read. A useful regular management pack is short:

One trustee or manager should also review:

That last line costs nothing to produce and is the single most useful addition most charity packs could make.

Controls are not a document

We have read a great many excellent financial procedures manuals at charities where one person could still move the money on their own.

The manual is not the control. The second pair of eyes is the control. A policy that describes a control nobody performs is worse than no policy, because it creates the impression that the question has been dealt with.

If something has already gone wrong

Say it early. What determines how badly this ends is rarely the amount. It is how long before someone tells a trustee.

Stop the route before investigating the person. Change the access, add the second authoriser, freeze the card. That is not an accusation.

Do not investigate alone, and do not let the person who may be involved help you investigate.

Report it. The Charity Commission expects trustees to report serious incidents, and significant financial loss or suspected fraud is squarely within scope. Charities that come forward are treated very differently from charities the Commission finds out about another way.

Tell your examiner or auditor before they find it.

Then write down what the gap was and close it.

Frequently asked questions

What are internal financial controls for a charity?

They are the procedures that prevent money leaving the charity without proper authorisation, and that make it quick to spot if it does. The Charity Commission’s guidance is CC8.

Does an audit prevent fraud?

No. An audit is an independent opinion on a set of accounts, formed after the year end on a sample basis. It may detect some fraud, but it is a check rather than a control. Prevention happens at the point the payment is made.

Are small charities exempt from having financial controls?

No. Small charities are often the most exposed, because the same person frequently handles the banking, the bookkeeping and the reporting. Controls should be proportionate to size, but proportionate does not mean absent.

Do we have to report fraud to the Charity Commission?

Trustees are expected to report serious incidents, and significant financial loss or suspected fraud falls within that. The Commission publishes guidance on what to report and how.

What is the most basic financial control?

Having more than one person involved in all transactions. In the Commission’s 2026 research, only 68% of trustees identified this correctly.

Get your controls reviewed

Enaid Accountancy works only with charities and third sector organisations. We review financial controls, design procedures that are proportionate to the size of the organisation, and help boards understand what they should be seeing.

If you want an independent view of how your charity measures up, speak to the team.

Sources