Fraud can create serious financial and operational challenges for not-for-profit organizations. Because many not-for-profits operate with limited staff, limited resources, and a strong focus on mission-driven work, fraud prevention depends on awareness, oversight, internal controls, reporting procedures, and training.
According to recent data, fraud has been on the incline for both not-for-profits and for-profit businesses, bringing some victims to the brink of collapse. That said, not-for-profit organizations tend to be at greater risk of fraud because they have fewer resources available to help prevent fraud and recover from a loss.
This sector is particularly vulnerable due to a lack of oversight and specific internal controls. Bowers works with mission-driven organizations through Not-for-Profit Services, Audit & Assurance Services, and Forensic Accounting.
Why Fraud Risk Is Serious for Not-for-Profits
Not-for-profit organizations often work with constrained budgets, lean staffing, and strong public expectations. When fraud occurs, the financial impact can be damaging, but the loss of trust can be just as difficult for the organization to overcome.
The 2020 ACFE Report to the Nations reviewed 191 cases of not-for-profit fraud. It found the median loss for these organizations to be $75,000, and the average loss was a whopping $639,000!
That is a big chunk of change for a not-for-profit. For organizations that are already trying to direct resources toward programs, beneficiaries, and community needs, losses of this size can interfere with the mission.
The report also identified the top three weaknesses not-for-profits face when it comes to fraud prevention controls:
- Lack of internal controls, 35%
- Lack of management review, 19%
- Ability to override existing internal controls, 14%
These weaknesses show why fraud prevention cannot depend on trust alone. Even organizations with dedicated employees and board members need policies, procedures, reviews, and clear accountability.
The ACFE 2020 Report to the Nations provides broader context on occupational fraud risks and prevention controls. The AICPA not-for-profit fraud resource also discusses warning signs and practical fraud prevention considerations for mission-driven organizations.
Why Limited Resources Increase Risk
Not-for-profit organizations tend to be at greater risk of fraud because they have fewer resources available to help prevent fraud and recover from a loss. Smaller teams can make it difficult to separate responsibilities, especially when the same employee handles multiple parts of a transaction.
Limited resources can also affect oversight. When management, board members, or finance committees do not have enough time or information to review activity, problems can go unnoticed.
This does not mean fraud is inevitable. It means the organization should be intentional about designing controls that work within the size and structure of the organization.
How Fraud Is Often Detected
Fraud detection is an important part of prevention because organizations need a way to identify warning signs early. When it came to fraud detection, the report found the following:
- Tip complaints accounted for 40% of fraud cases discovered
- Internal audits accounted for 17% of cases
- Management review accounted for 13% of cases
- 7% of cases were accidentally discovered
- Examination of documents accounted for 6% of cases
Given this data, we can see that tips are the most common fraud detection method among not-for-profit organizations. That’s a good thing because awareness, along with intelligence and diligence, are needed to minimize a not-for-profit’s risk of fraud.
Fraud detection depends on people having enough knowledge to recognize concerns and enough confidence to report them. If employees, volunteers, managers, and board members do not understand how to report suspected fraud, important information may never reach the right people.
Internal audits and management reviews also play an important role. They help organizations examine documents, review transactions, and evaluate whether internal controls are being followed.
The Journal of Accountancy internal controls refresher explains how effective controls can help organizations prevent fraud and detect it early. This supports the need for both prevention procedures and detection methods.
Why Tips Matter
Tips are the most common fraud detection method among not-for-profit organizations. This is important because studies show that most frauds are known to someone in a defrauded organization.
Additionally, they are revealed after a tip is received from someone with knowledge about the fraud. However, an employee may not report suspicions or knowledge of fraud if they do not know how to report them.
This is especially true if the perpetrator is someone high up in the organization or the employee reports to them. A clear and confidential reporting process can help reduce this barrier.
Implement Internal Controls
One of the best practices for minimizing fraud risk is implementing internal controls. Internal controls are strict rules and procedures implemented by an organization.
They provide reasonable assurance that an organization is operating ethically, transparently, and in accordance with the established industry standards. Internal controls also create a structure for approvals, reviews, documentation, and accountability.
Although the small size of an organization’s office staff limits the extent of separation of duties, specific steps can be taken to separate incompatible duties. The basic premise is that no one employee should have access to both physical assets and the related accounting records, or all phases of a transaction.
One of the most critical areas of separation is cash, where a bookkeeper handles incoming checks, prepares the deposit slip, posts receipts to customer accounts, and receives and reconciles the monthly bank statement. The result is the danger that intentional or unintentional errors could be made and not detected.
This type of situation can create a weakness even when the employee is trusted. Internal controls are not only designed to catch wrongdoing. They are also designed to reduce errors and protect the organization from avoidable risk.
The National Council of Nonprofits internal controls resource provides additional background on internal controls, financial accountability, and nonprofit fraud prevention resources.
Not-for-profits may also benefit from support related to financial reporting, accounting processes, and recurring review through Client Accounting & Advisory Services.
Separation of Duties
Separation of duties is one of the most important internal control concepts. No one employee should control all phases of a transaction, especially when cash, deposits, accounting records, and bank reconciliations are involved.
For example, the same person should not handle incoming checks, prepare the deposit slip, post receipts to accounts, receive the bank statement, and reconcile the bank account. When one person controls each step, errors or improper activity may not be detected.
Even when a not-for-profit has a small staff, it can still take steps to separate incompatible duties. Management review, board oversight, documentation, and periodic independent review can help reduce risk.
Establish a Fraud Hotline
A fraud hotline gives employees and others a clear way to report concerns. Because tips are such an important source of fraud detection, a reporting process should be easy to understand and available when people are most likely to use it.
Studies show that most frauds are known to someone in a defrauded organization. Additionally, they are revealed after a tip is received from someone with knowledge about the fraud.
However, an employee may not report suspicions or knowledge of fraud if they do not know how to report them. This is especially true if the perpetrator is someone high up in the organization or the employee reports to them.
An effective fraud hotline should have the following features:
- It should be available 24/7. Studies show that 40% of calls to fraud hotlines are made at night or on weekends. Employees typically will not call during normal work hours to report on coworkers or supervisors. Additionally, they often will not call back if their first call is not answered.
- The hotline must allow anonymous calls to protect confidentiality so that employees will not fear possible retaliation if they are identified as the whistle-blower.
- Employees should be made aware of the hotline’s availability and the reasons why they should use it. Organizations can accomplish this via informational posters, memos, or brochures.
A hotline is only useful if people know it exists and understand why it matters. The organization should communicate the purpose of the hotline and remind staff, managers, board members, and volunteers that reporting concerns helps protect the mission.
Anonymous Reporting and Awareness
The hotline must allow anonymous calls to protect confidentiality. Employees may fear retaliation if they believe they can be identified as the whistle-blower.
Anonymous reporting can be especially important when the suspected perpetrator is in a position of authority. If the employee reports to the person involved, the employee may feel they have no safe way to speak up.
Employees should also be made aware of the hotline’s availability and the reasons why they should use it. Informational posters, memos, and brochures can help keep the reporting process visible.
Provide Anti-Fraud Training
Implement mandatory anti-fraud training for staff members, managers, and board members to minimize the risk of fraud. Training can give people the knowledge they need to recognize, report, and help prevent fraudulent activity.
Anti-fraud training educates and equips not-for-profit stakeholders with the ability to detect, report, and prevent fraud. It also reinforces that fraud prevention is not only the responsibility of one department.
Trainees will learn:
- What is fraud and constitutes fraudulent activity?
- Consequences of committing fraud
- How to report fraudulent acts
- Effect of fraud on victims
Training is especially important for board members and managers because oversight is part of fraud prevention. A board or leadership team that understands fraud risk may be better prepared to ask questions, review reports, and support internal controls.
For not-for-profits, training should also connect fraud prevention to the organization’s mission. Fraud can reduce resources available for programs, damage donor confidence, and distract leadership from serving the community.
Bowers also offers insight on not-for-profit oversight through resources such as How to Build a Strong Not-For-Profit Board.
Training for Staff, Managers, and Board Members
Anti-fraud training should include staff members, managers, and board members. Each group has a role in prevention, detection, reporting, and oversight.
Staff members may be closest to daily transactions and may notice unusual activity. Managers may be responsible for reviewing work, approving transactions, and responding to concerns.
Board members provide oversight and should understand how internal controls, management review, and reporting procedures support the organization. Training helps each group understand what to look for and how to respond.
Most Common Fraud Schemes
Understanding common fraud schemes can help not-for-profits focus attention on areas where risk may be higher. According to ACFE 2020 Report to the Nations data, 86% of fraud schemes are due to Asset Misappropriation.
In this instance, the perpetrator steals or misuses an organization’s resources. The median loss in this type of fraud is $100,000.
The second most common fraud scheme is Corruption. A perpetrator misuses their influence in business transactions violating their duty to the employer to gain a benefit.
The median loss in this type of fraud is $200,000. Corruption can be especially damaging because it may involve misuse of authority or influence.
The third most common fraud scheme, Financial Statement Fraud, is also the most damaging. This involves the intentional misstatement or omission of material information in an organization’s financial reports.
The median loss in Financial Statement Fraud is $954,000. Because financial statements are used by leadership, board members, donors, lenders, regulators, and other stakeholders, false reporting can create serious consequences.
Asset Misappropriation
Asset Misappropriation occurs when the perpetrator steals or misuses an organization’s resources. According to the draft data, this is the most common fraud scheme.
For not-for-profits, asset misappropriation can affect cash, deposits, disbursements, inventory, or other organizational resources. Strong internal controls and separation of duties can help reduce this risk.
Corruption
Corruption occurs when a perpetrator misuses their influence in business transactions while violating their duty to the employer to gain a benefit. This type of fraud can involve conflicts of interest or improper influence.
Organizations can reduce corruption risk by maintaining oversight, requiring approval processes, and encouraging reporting when concerns arise. Management review and board involvement can also help strengthen accountability.
Financial Statement Fraud
Financial Statement Fraud involves the intentional misstatement or omission of material information in an organization’s financial reports. It is identified as the most damaging of the three common fraud schemes discussed here.
Examples of Financial Statement Fraud schemes include:
- Improper Revenue Recognition
- Side Agreements
- Failure to Record Sales Provisions or Allowances
Because financial statements help users understand an organization’s financial position, intentional misstatements or omissions can be harmful. Review, oversight, and ethical reporting practices are important safeguards.
Building a Stronger Fraud Prevention Culture
While fraud has the potential of causing a lot of damage to not-for-profits, the good news is organizations can take proven steps to prevent it. These steps include internal controls, fraud hotlines, training, oversight, and review.
Fraud prevention works best when it becomes part of the organization’s culture. Staff members, managers, and board members should understand that protecting the organization’s resources also protects its mission.
Awareness, along with intelligence and diligence, are needed to minimize a not-for-profit’s risk of fraud. That means people should know the warning signs, know how to report concerns, and understand the importance of following internal procedures.
Internal controls provide structure. A hotline provides a reporting path. Training provides knowledge. Management review and internal audits provide additional layers of oversight.
No single step eliminates all fraud risk, but each step helps strengthen the organization. Together, they make it harder for fraud to occur and easier for problems to be detected.
Bowers provides additional support through Advisory Services and resources for organizations through CFO advisory support for not-for-profits.
Prevention Requires Oversight and Follow-Through
Fraud prevention should not be treated as a one-time project. Internal controls, reporting procedures, and training should be reviewed periodically to make sure they still fit the organization.
As staff roles change, programs grow, or funding sources shift, the organization may need to adjust its procedures. Management and board members should continue to review whether oversight is effective.
Not-for-profits can also seek support when evaluating controls, investigating concerns, or improving financial procedures. The goal is to reduce risk before fraud causes serious harm.
FAQ
These frequently asked questions summarize the main fraud prevention points for not-for-profit organizations.
Why are not-for-profits at greater risk of fraud?
Not-for-profit organizations tend to be at greater risk of fraud because they often have fewer resources available to help prevent fraud and recover from a loss. This sector is also particularly vulnerable due to a lack of oversight and specific internal controls.
What are the top fraud prevention weaknesses?
The top weaknesses identified in the draft are lack of internal controls, lack of management review, and the ability to override existing internal controls. These weaknesses can create opportunities for fraud or errors to go undetected.
How is fraud most often detected?
Tip complaints accounted for 40% of fraud cases discovered, making tips the most common fraud detection method among not-for-profit organizations. Internal audits, management review, accidental discovery, and examination of documents were also identified as detection methods.
Why are internal controls important?
Internal controls provide reasonable assurance that an organization is operating ethically, transparently, and in accordance with established standards. They help separate incompatible duties and reduce the risk that intentional or unintentional errors will go undetected.
What should an effective fraud hotline include?
An effective fraud hotline should be available 24/7, allow anonymous calls, protect confidentiality, and be clearly communicated to employees. Employees should know the hotline exists and understand why they should use it.
What are the most common fraud schemes?
The most common fraud schemes discussed are Asset Misappropriation, Corruption, and Financial Statement Fraud. Financial Statement Fraud is identified as the most damaging because it involves intentional misstatement or omission of material information in financial reports.

