Fraud can create serious financial and operational challenges for not-for-profit organizations. Because many not-for-profits operate with limited staff, limited resources, and a strong focus on mission-driven work, fraud prevention depends on awareness, oversight, internal controls, reporting procedures, and training.
In 2026, fraud prevention remains an important priority for not-for-profit organizations that want to protect their resources, preserve donor confidence, and support mission-driven work. Strong oversight, clear reporting procedures, and consistent internal controls can help organizations reduce risk before fraud causes serious harm.
According to recent data, fraud has been on the incline for both not-for-profits and for-profit businesses, bringing some victims to the brink of collapse. That said, not-for-profit organizations tend to be at greater risk of fraud because they have fewer resources available to help prevent fraud and recover from a loss.
This sector is particularly vulnerable due to a lack of oversight and specific internal controls. Bowers works with mission-driven organizations through Not-for-Profit Services, Audit & Assurance Services, and Forensic Accounting.
Why Fraud Risk Is Serious for Not-for-Profits
Not-for-profit organizations often work with constrained budgets, lean staffing, and strong public expectations. When fraud occurs, the financial impact can be damaging, but the loss of trust can be just as difficult for the organization to overcome.
In 2026, this risk should be viewed as both a financial issue and a governance issue. Fraud can affect cash flow, programs, reporting, donor relationships, board confidence, and the organization’s ability to serve its mission.
The 2020 ACFE Report to the Nations reviewed 191 cases of not-for-profit fraud. It found the median loss for these organizations to be $75,000, and the average loss was a whopping $639,000!
That is a big chunk of change for a not-for-profit. For organizations that are already trying to direct resources toward programs, beneficiaries, and community needs, losses of this size can interfere with the mission.
The report also identified the top three weaknesses not-for-profits face when it comes to fraud prevention controls:
- Lack of internal controls, 35%
- Lack of management review, 19%
- Ability to override existing internal controls, 14%
These weaknesses show why fraud prevention cannot depend on trust alone. Even organizations with dedicated employees and board members need policies, procedures, reviews, and clear accountability.
For 2026 planning, not-for-profits should review whether internal controls are documented, whether management review is consistent, and whether any one person has too much control over transactions or financial records.
Deloitte provides additional perspective on evaluating and strengthening effective internal controls. This supports the importance of governance, reporting, and control design for organizations reviewing fraud risk.
Why Limited Resources Increase Risk
Not-for-profit organizations tend to be at greater risk of fraud because they have fewer resources available to help prevent fraud and recover from a loss. Smaller teams can make it difficult to separate responsibilities, especially when the same employee handles multiple parts of a transaction.
Limited resources can also affect oversight. When management, board members, or finance committees do not have enough time or information to review activity, problems can go unnoticed.
This does not mean fraud is inevitable. It means the organization should be intentional about designing controls that work within the size and structure of the organization.
How Fraud Is Often Detected
Fraud detection is an important part of prevention because organizations need a way to identify warning signs early. When it came to fraud detection, the report found the following:
- Tip complaints accounted for 40% of fraud cases discovered
- Internal audits accounted for 17% of cases
- Management review accounted for 13% of cases
- 7% of cases were accidentally discovered
- Examination of documents accounted for 6% of cases
Given this data, we can see that tips are the most common fraud detection method among not-for-profit organizations. That’s a good thing because awareness, along with intelligence and diligence, are needed to minimize a not-for-profit’s risk of fraud.
Fraud detection depends on people having enough knowledge to recognize concerns and enough confidence to report them. If employees, volunteers, managers, and board members do not understand how to report suspected fraud, important information may never reach the right people.
Internal audits and management reviews also play an important role. They help organizations examine documents, review transactions, and evaluate whether internal controls are being followed.
In 2026, organizations should make fraud reporting procedures clear, accessible, and consistently communicated. Detection works best when employees, managers, volunteers, and board members understand what to report and how to report it.
For organizations reviewing risk, compliance, and controls, McKinsey Insights discusses the importance of strengthening operational risk, compliance, and control processes.
Why Tips Matter
Tips are the most common fraud detection method among not-for-profit organizations. This is important because studies show that most frauds are known to someone in a defrauded organization.
Additionally, they are revealed after a tip is received from someone with knowledge about the fraud. However, an employee may not report suspicions or knowledge of fraud if they do not know how to report them.
This is especially true if the perpetrator is someone high up in the organization or the employee reports to them. A clear and confidential reporting process can help reduce this barrier.
Implement Internal Controls
One of the best practices for minimizing fraud risk is implementing internal controls. Internal controls are strict rules and procedures implemented by an organization.
They provide reasonable assurance that an organization is operating ethically, transparently, and in accordance with the established industry standards. Internal controls also create a structure for approvals, reviews, documentation, and accountability.
Although the small size of an organization’s office staff limits the extent of separation of duties, specific steps can be taken to separate incompatible duties. The basic premise is that no one employee should have access to both physical assets and the related accounting records, or all phases of a transaction.
One of the most critical areas of separation is cash, where a bookkeeper handles incoming checks, prepares the deposit slip, posts receipts to customer accounts, and receives and reconciles the monthly bank statement. The result is the danger that intentional or unintentional errors could be made and not detected.
This type of situation can create a weakness even when the employee is trusted. Internal controls are not only designed to catch wrongdoing. They are also designed to reduce errors and protect the organization from avoidable risk.
In 2026, not-for-profits should review whether internal controls still match current staffing, technology, banking, donor activity, and financial reporting needs. A control that worked in the past may need to be updated if responsibilities, systems, or transaction volume have changed.
Not-for-profits may also benefit from support related to financial reporting, accounting processes, and recurring review through Client Accounting & Advisory Services.
Separation of Duties
Separation of duties is one of the most important internal control concepts. No one employee should control all phases of a transaction, especially when cash, deposits, accounting records, and bank reconciliations are involved.
For example, the same person should not handle incoming checks, prepare the deposit slip, post receipts to accounts, receive the bank statement, and reconcile the bank account. When one person controls each step, errors or improper activity may not be detected.
Even when a not-for-profit has a small staff, it can still take steps to separate incompatible duties. Management review, board oversight, documentation, and periodic independent review can help reduce risk.
Establish a Fraud Hotline
A fraud hotline gives employees and others a clear way to report concerns. Because tips are such an important source of fraud detection, a reporting process should be easy to understand and available when people are most likely to use it.
Studies show that most frauds are known to someone in a defrauded organization. Additionally, they are revealed after a tip is received from someone with knowledge about the fraud.
However, an employee may not report suspicions or knowledge of fraud if they do not know how to report them. This is especially true if the perpetrator is someone high up in the organization or the employee reports to them.
An effective fraud hotline should have the following features:
- It should be available 24/7. Studies show that 40% of calls to fraud hotlines are made at night or on weekends. Employees typically will not call during normal work hours to report on coworkers or supervisors. Additionally, they often will not call back if their first call is not answered.
- The hotline must allow anonymous calls to protect confidentiality so that employees will not fear possible retaliation if they are identified as the whistle-blower.
- Employees should be made aware of the hotline’s availability and the reasons why they should use it. Organizations can accomplish this via informational posters, memos, or brochures.
A hotline is only useful if people know it exists and understand why it matters. The organization should communicate the purpose of the hotline and remind staff, managers, board members, and volunteers that reporting concerns helps protect the mission.
For 2026, not-for-profits should review whether their reporting process is easy to find, easy to understand, confidential, and supported by leadership. Employees and volunteers should know that reporting concerns is part of protecting the organization.
Anonymous Reporting and Awareness
The hotline must allow anonymous calls to protect confidentiality. Employees may fear retaliation if they believe they can be identified as the whistle-blower.
Anonymous reporting can be especially important when the suspected perpetrator is in a position of authority. If the employee reports to the person involved, the employee may feel they have no safe way to speak up.
Employees should also be made aware of the hotline’s availability and the reasons why they should use it. Informational posters, memos, and brochures can help keep the reporting process visible.
Provide Anti-Fraud Training
Implement mandatory anti-fraud training for staff members, managers, and board members to minimize the risk of fraud. Training can give people the knowledge they need to recognize, report, and help prevent fraudulent activity.
Anti-fraud training educates and equips not-for-profit stakeholders with the ability to detect, report, and prevent fraud. It also reinforces that fraud prevention is not only the responsibility of one department.
Trainees will learn:
- What is fraud and constitutes fraudulent activity?
- Consequences of committing fraud
- How to report fraudulent acts
- Effect of fraud on victims
Training is especially important for board members and managers because oversight is part of fraud prevention. A board or leadership team that understands fraud risk may be better prepared to ask questions, review reports, and support internal controls.
For not-for-profits, training should also connect fraud prevention to the organization’s mission. Fraud can reduce resources available for programs, damage donor confidence, and distract leadership from serving the community.
In 2026, anti-fraud training should be revisited regularly so new staff, managers, volunteers, and board members understand expectations. Training should also be updated when reporting procedures, internal controls, or organizational responsibilities change.
Bowers also offers insight on not-for-profit oversight through resources such as How to Build a Strong Not-For-Profit Board.
Harvard Business Review also discusses how employees can play an important role in identifying and managing risk in its article on employees as risk managers. This supports the importance of involving staff, managers, and governance leaders in fraud prevention.
Training for Staff, Managers, and Board Members
Anti-fraud training should include staff members, managers, and board members. Each group has a role in prevention, detection, reporting, and oversight.
Staff members may be closest to daily transactions and may notice unusual activity. Managers may be responsible for reviewing work, approving transactions, and responding to concerns.
Board members provide oversight and should understand how internal controls, management review, and reporting procedures support the organization. Training helps each group understand what to look for and how to respond.
Most Common Fraud Schemes
Understanding common fraud schemes can help not-for-profits focus attention on areas where risk may be higher. According to ACFE 2020 Report to the Nations data, 86% of fraud schemes are due to Asset Misappropriation.
In this instance, the perpetrator steals or misuses an organization’s resources. The median loss in this type of fraud is $100,000.
The second most common fraud scheme is Corruption. A perpetrator misuses their influence in business transactions violating their duty to the employer to gain a benefit.
The median loss in this type of fraud is $200,000. Corruption can be especially damaging because it may involve misuse of authority or influence.
The third most common fraud scheme, Financial Statement Fraud, is also the most damaging. This involves the intentional misstatement or omission of material information in an organization’s financial reports.
The median loss in Financial Statement Fraud is $954,000. Because financial statements are used by leadership, board members, donors, lenders, regulators, and other stakeholders, false reporting can create serious consequences.
For 2026, these common fraud schemes remain useful categories for reviewing risk. Not-for-profits should consider where assets are handled, where influence can be misused, and where financial reporting depends on accurate records and ethical judgment.
For additional accounting industry perspective, Accounting Today provides professional coverage of accounting, tax, advisory, and risk-related topics.
Asset Misappropriation
Asset Misappropriation occurs when the perpetrator steals or misuses an organization’s resources. According to the draft data, this is the most common fraud scheme.
For not-for-profits, asset misappropriation can affect cash, deposits, disbursements, inventory, or other organizational resources. Strong internal controls and separation of duties can help reduce this risk.
Corruption
Corruption occurs when a perpetrator misuses their influence in business transactions while violating their duty to the employer to gain a benefit. This type of fraud can involve conflicts of interest or improper influence.
Organizations can reduce corruption risk by maintaining oversight, requiring approval processes, and encouraging reporting when concerns arise. Management review and board involvement can also help strengthen accountability.
Financial Statement Fraud
Financial Statement Fraud involves the intentional misstatement or omission of material information in an organization’s financial reports. It is identified as the most damaging of the three common fraud schemes discussed here.
Examples of Financial Statement Fraud schemes include:
- Improper Revenue Recognition
- Side Agreements
- Failure to Record Sales Provisions or Allowances
Because financial statements help users understand an organization’s financial position, intentional misstatements or omissions can be harmful. Review, oversight, and ethical reporting practices are important safeguards.
Building a Stronger Fraud Prevention Culture
While fraud has the potential of causing a lot of damage to not-for-profits, the good news is organizations can take proven steps to prevent it. These steps include internal controls, fraud hotlines, training, oversight, and review.
Fraud prevention works best when it becomes part of the organization’s culture. Staff members, managers, and board members should understand that protecting the organization’s resources also protects its mission.
Awareness, along with intelligence and diligence, are needed to minimize a not-for-profit’s risk of fraud. That means people should know the warning signs, know how to report concerns, and understand the importance of following internal procedures.
Internal controls provide structure. A hotline provides a reporting path. Training provides knowledge. Management review and internal audits provide additional layers of oversight.
No single step eliminates all fraud risk, but each step helps strengthen the organization. Together, they make it harder for fraud to occur and easier for problems to be detected.
For 2026, not-for-profits should treat fraud prevention as an ongoing governance responsibility. As programs, staffing, funding sources, technology, and reporting needs change, the organization should revisit controls and procedures to make sure they still work.
Bowers provides additional support through Advisory Services and resources for organizations through CFO advisory support for not-for-profits.
Prevention Requires Oversight and Follow-Through
Fraud prevention should not be treated as a one-time project. Internal controls, reporting procedures, and training should be reviewed periodically to make sure they still fit the organization.
As staff roles change, programs grow, or funding sources shift, the organization may need to adjust its procedures. Management and board members should continue to review whether oversight is effective.
Not-for-profits can also seek support when evaluating controls, investigating concerns, or improving financial procedures. The goal is to reduce risk before fraud causes serious harm.
FAQ
These frequently asked questions summarize the main fraud prevention points for not-for-profit organizations in 2026.
Why are not-for-profits at greater risk of fraud?
Not-for-profit organizations tend to be at greater risk of fraud because they often have fewer resources available to help prevent fraud and recover from a loss. This sector is also particularly vulnerable due to a lack of oversight and specific internal controls.
What are the top fraud prevention weaknesses?
The top weaknesses identified in the draft are lack of internal controls, lack of management review, and the ability to override existing internal controls. These weaknesses can create opportunities for fraud or errors to go undetected.
How is fraud most often detected?
Tip complaints accounted for 40% of fraud cases discovered, making tips the most common fraud detection method among not-for-profit organizations. Internal audits, management review, accidental discovery, and examination of documents were also identified as detection methods.
Why are internal controls important?
Internal controls provide reasonable assurance that an organization is operating ethically, transparently, and in accordance with established standards. They help separate incompatible duties and reduce the risk that intentional or unintentional errors will go undetected.
What should an effective fraud hotline include?
An effective fraud hotline should be available 24/7, allow anonymous calls, protect confidentiality, and be clearly communicated to employees. Employees should know the hotline exists and understand why they should use it.
What are the most common fraud schemes?
The most common fraud schemes discussed are Asset Misappropriation, Corruption, and Financial Statement Fraud. Financial Statement Fraud is identified as the most damaging because it involves intentional misstatement or omission of material information in financial reports.

