Nonprofit Cash Handling: The Dual-Control Discipline That Prevents Most Fraud

The quiet patterns that take small nonprofits down.

Large, dramatic nonprofit fraud cases make the news. The executive director who diverted a million dollars to personal accounts. The treasurer whose real estate deals used the organization as a straw buyer. These cases draw attention because they are shocking. They are not, however, typical.

Typical nonprofit fraud is quieter. It is the long-tenured finance volunteer who skims a few hundred dollars a month for 14 years. It is the bookkeeper who always handles the offering count alone and who, three years after leaving the organization, is discovered to have been writing small checks to a personal account. It is the department head who adjusted receipts on a pattern that no one ever independently reconciled.

These are not sophisticated schemes. They are the result of missing financial controls. Specifically, one control: dual control over cash handling. Its absence is the single most common precondition for nonprofit internal fraud we have seen. Its presence is the single most effective preventive discipline an organization of any size can implement.

What ACFE data tells us.

The Association of Certified Fraud Examiners publishes a biennial Report to the Nations on occupational fraud. Their long-running findings on nonprofits are consistent:

• Nonprofit occupational fraud has a median duration of 14 to 18 months before detection
• Median loss per case is approximately $75,000, though small organizations lose disproportionately more relative to revenue
• Most perpetrators are long-tenured employees in positions of trust
• The most common detection method is a tip, not an audit
• Billing, expense reimbursement, and cash skimming are the most common fraud schemes
• Organizations with formal internal controls detect fraud significantly faster and lose significantly less when they do

The data is stable across reporting cycles. The patterns are not mysterious. What is remarkable is how many nonprofits still operate without the specific controls the data says matter.

The four controls that do the most work.

A complete anti-fraud program has many components. Four of them do the largest share of the work.

Control 1: Dual control on every cash count.

Two people are physically present for every count of cash or checks. They count separately. They reconcile to the same number. They both sign the tally. Neither is a spouse or close relative of the other. Rotation happens on a schedule.

This is not a committee. It is two named individuals, each individually accountable, working the same task at the same moment.

Control 2: Separation of counting and depositing.

The person or people who count the cash are not the person who takes it to the bank. The person who takes it to the bank is not the person who records the deposit in the accounting system. These three roles are held by three different people.

Separation of duties is the specific control that makes embezzlement hard. A single person who handles all three roles can move money out of the system undetected. Three different people in three separate roles means collusion would be required, which is dramatically less common.

Control 3: Independent bank reconciliation.

The monthly bank statement is reconciled by a person who does not handle the money, does not deposit the money, and does not enter it into the accounting system. Often this is a board treasurer or an outside bookkeeper.

The reconciler has the ability to see what the bank actually received compared to what the organization’s records say was received. Any discrepancy surfaces in the reconciliation. Facilities without independent reconciliation have no way to surface these discrepancies.

Control 4: Rotation of duties.

Any role involving cash is rotated. The specific person in the role changes on a schedule (annually, every two years, etc.). Long-tenured accumulation of control is broken up. Anyone tempted to begin a fraudulent pattern knows that someone new will soon have visibility into the same function.

Rotation is often resisted because it feels disruptive. It is one of the single most effective fraud-prevention practices available.

The Sunday morning offering count.

For churches specifically, the Sunday morning offering count is the single most exposed cash-handling event. Every week, sometimes multiple times per week, cash and checks move through the organization. The patterns are predictable.

A well-run offering count includes:

• Two counters, unrelated to each other, rotated quarterly
• A secure, visible counting room with a camera or transparent glass
• Sealed deposit bags, numbered and logged
• A third person receives the sealed bag and takes it to the bank
• A fourth person, typically the treasurer or outside bookkeeper, reconciles the deposit against the count records
• Written documentation signed at every handoff
• Annual external review by an independent CPA or auditor

Churches that maintain this rhythm have had, in our experience, essentially zero significant internal fraud events. Churches that skip any element of it tend to experience, over a period of years, a fraud pattern that traces back to the missing control.

The event-revenue exposure.

Beyond regular receipts, fundraising events produce bursts of cash that often circumvent normal controls. Silent auctions, raffles, cash bars, and gate revenue at large events all move money through paths that are not part of the regular week.

Specific event-revenue exposures:

• The silent auction treasurer who handles all winning-bid payments alone
• The cash bar that is run by volunteers without rotation
• The gate-revenue team that counts and deposits without dual control
• The raffle proceeds that go to “the office” without specific accounting

These are frequently where substantial amounts go missing at nonprofits. The one-time nature of the event makes it feel different. The anti-fraud principles are the same.

Every event should have a written cash-handling protocol that mirrors normal weekly practice: dual control, separation of duties, documented handoffs, next-business-day reconciliation.

The volunteer question.

Nonprofits run on volunteers. Many volunteers are wonderful. Some volunteer-handling of finances introduces specific fraud exposure.

Specific patterns to avoid:

• The same long-tenured volunteer counting offering every week for 8 years
• Volunteer finance committee members with bank access but no formal rotation
• Volunteer event treasurers who have handled the same event’s money alone for years
• Volunteers with access to sensitive donor data without current background checks

None of these situations indicate bad actors. They indicate conditions in which bad actors, when they emerge, have extended windows of opportunity before detection. The controls that protect the organization also protect the volunteers themselves from ever being in a position where accusation could stick.

Paul is describing the rationale for careful financial handling in the early church: to be above reproach not only spiritually but also operationally. The passage is explicit about the discipline of multiple overseers of financial gifts. The principle has not changed in two thousand years.

The Florida context.

Our region adds specific considerations for nonprofit cash handling.

Seasonal event concentration

Winter-season events in Naples, Fort Myers, and the surrounding areas concentrate significant fundraising volume in a few months. Protocol integrity during peak season, when volunteers are stretched and leadership attention is split, deserves specific planning.

Hurricane-driven giving

After events like Hurricane Ian in 2022, large amounts of money moved rapidly through nonprofits. Rapid money movement under pressure is exactly when fraud controls are most stressed. Organizations that had established controls before the event handled the post-storm giving period well. Organizations that improvised under pressure sometimes did not.

Donor advisory funds

Many Southwest Florida donors use donor-advised funds to direct significant gifts. DAF distributions have specific reconciliation requirements that differ slightly from individual donations. Protocol should account for them.

Starting the conversation with your board.

For nonprofit executive directors reading this and wondering what to do:

• Review the list of named people in finance roles. Note who handles cash, who deposits, who reconciles.
• Identify where one person holds two or more of those roles. That is your exposure.
• Propose dual control as a protection-for-staff measure, not a surveillance measure.
• Schedule rotation on a defined calendar.
• Commission an independent review, by a CPA or qualified outside advisor, annually at minimum.
• Explain to donors, when asked, exactly how your controls work. Donors appreciate it.

The quiet dignity of careful handling.

Nonprofit cash handling, done well, is quiet. Nobody notices that it is happening. That is the point. When it is done poorly, everyone eventually notices, and the noise is damaging to the mission, to the staff, and to the trust that took years to build.

For nonprofits in Fort Myers, Cape Coral, Naples, and Port Charlotte wanting to strengthen cash-handling practices, we can help. Not as auditors, but as security advisors who work with your board, your staff, and your existing CPA to build a program you can run week after week.

See also our nonprofit pillar article and our background check program guide.