Standard financial controls advice assumes a finance team. Separate the person who spends money from the person who approves it, and from the person who reconciles the account. Three roles, three people.
A charity with a part-time administrator and five trustees cannot do that, and most guidance leaves it there – which is why so many small charities quietly conclude that proper controls are for organisations bigger than theirs.
The Charity Commission’s guidance actually answers the question. It’s just buried in a document with thirteen sections.
If nobody has looked at how money moves through your charity in a while, that’s a governance question worth an afternoon.
The duty sits with all trustees, whoever does the work
You can delegate the detail – to a treasurer, to one or two trustees, to a member of staff. What you cannot delegate is responsibility. All trustees remain responsible for the charity’s financial management and for implementing and monitoring its controls.
Two things follow that get overlooked.
Everyone in the charity needs to understand and follow the controls, which means they have to be written down somewhere other than one person’s head.
And the controls must not be capable of being overridden by anyone. That includes the chief executive, the treasurer, and the trustee who has been there longest. A control that the most senior person can wave through is not a control.
What the Commission says when you can’t split duties
Here is the chapter worth knowing. Where duties cannot be fully split because of a lack of people or money, the Commission says you can manage the risk instead – by having all trustees review transaction reports, and by checking that the internal controls are being followed and sharing the results with all trustees.
That reframes the problem. You are not failing to comply. You are compensating, deliberately and visibly.
In practice, it means the bank statement and a list of transactions go to every trustee, not just the treasurer. Someone other than the person doing the bookkeeping looks at them. And what that check found gets reported to the board rather than mentioned in passing.
There’s a second point in the same section aimed squarely at small charities. Where trustees handle things directly, duties should be split among all the trustees, so that one trustee is not overburdened and does not end up exercising sole responsibility.
The charity where one person does everything financial is not efficient. It is exposed – and so is that person, who has no protection if anything is ever questioned.
The controls that matter most at your size
The bank. Accounts should be in the charity’s name, matching the governing document. Keep a list of them and close the ones nobody uses. Reconcile monthly, and have a second person review the reconciliation.
Two details are easy to miss and worth acting on. Changes to the bank mandate should need dual authorisation, and the second person should be a trustee. And the people named to authorise changes to your account details should not be the same people who reconcile bank statements or collect income – that separation is what stops a single person redirecting money.
Tell the bank when trustees change. Mandates listing people who left three years ago are common and are a real risk.
Money in. Record and bank cash and cheques quickly, and bank them gross rather than netting off expenses. Two people should handle and record cash from collections. Post containing donations should be opened in the presence of a second person where possible, and where it genuinely isn’t, use a compensating check – comparing what came in against similar appeals or periods.
Reconcile what your donation platform says arrived against what reached the bank. And check that expected amounts from committed donors actually turn up, which is the control that catches failed recurring payments before they become lapsed supporters.
Money out. Write down who can authorise what, and up to what value. Nobody approves their own expenses claim – that one rule prevents more trouble than any other on this page.
Card statements should go to someone other than the cardholder. Petty cash should be checked by someone independent of whoever maintains it. And run a regular check that you are not still paying people who have left, or paying current staff the wrong amount.
Not sure whether your controls would survive a proper look?
Most small charities have some controls, inherited rather than designed, and nobody has checked whether they still match how the charity operates. A free Charity Consultation is a straightforward way to find the gaps.
Where small charities get caught
Three patterns account for most of it.
Payments to people connected to the charity. Where money goes to a trustee, or to a company a trustee controls, you need specific authority for it, and you must be satisfied it is in the charity’s best interests. The Commission is blunt that using a trustee’s company because it’s the easiest option is not a good enough reason. The conflict has to be declared, managed and recorded.
Expenses without a policy. You can reimburse trustees, staff and volunteers for reasonable costs. What’s needed is a written policy covering what can be claimed, what evidence is required, when permission is needed first, how claims are approved, and the rule that nobody approves their own. Mileage rates should stay within HMRC’s published rates, or you create a tax liability for someone.
The person who does everything because they always have. Usually a long-serving volunteer treasurer, entirely trustworthy, holding the bank access, the records and the reconciliation. Nobody wants to suggest a change because it sounds like an accusation. It isn’t. It’s the arrangement that leaves them unprotected and the charity unable to function if they’re ill.
What the board should see, and when
The charity’s financial position should be a standing item on every trustee meeting agenda, with the papers sent to trustees before the meeting rather than handed round at it.
What trustees need: the latest management accounts showing performance against budget, an explanation of any significant differences between forecast and actual, and cash flow with closing bank balances.
The reason is not procedural. Reviewing this regularly is how trustees confirm the charity is still a going concern, and the earlier financial difficulty is spotted, the more can be done about it.
One expectation the Commission states plainly: trustees should question what they don’t understand and raise concerns. A board where nobody asks about the finance report is not a board that has understood it. Financial papers are also decisions in waiting, and the principles that make a decision defensible apply to them.
Underneath all of it sits your record-keeping, because controls without records leave nothing to check.
Reviewing the controls
At least once a year. Always after a significant financial loss, or after one you narrowly avoided. And always around a significant change in how the charity operates – a new structure, a large new funder, a change in how income arrives.
Keep a record of what the review looked at and what you did about anything it found. That record is what demonstrates the board was monitoring rather than assuming.
Where a review finds that funds have been misused, or may be being misused, the charity should act immediately.
When something goes wrong
Record it – every incident of financial crime, abuse, or breakdown in the controls, however small it seemed at the time.
Then report it where it needs to go. Fraud to the police reporting service, tax fraud to HMRC, data breaches to the ICO. And serious incidents to the Charity Commission, where failure to report may itself result in regulatory action.
One thing charities don’t always realise: auditors and independent examiners have their own duty to report matters of material significance to the Commission. A problem your examiner finds is not a conversation that stays between you.
Controls are not an expression of distrust. They protect the person handling the money at least as much as they protect the charity, because the treasurer who can point to a second signature and a reviewed reconciliation is a treasurer nobody can question. That’s also part of what your reserves policy and your annual reporting rest on: numbers you can stand behind.
This article is general information for UK charities and not legal or accounting advice. It summarises Charity Commission guidance for England and Wales; charities in Scotland and Northern Ireland should check OSCR and the Charity Commission for Northern Ireland. Anything involving a suspected loss, a payment to a connected party, or a possible breach of duty should go to your independent examiner or a solicitor.
If the honest position is that your controls were never designed and nobody knows where the gaps are, that is a defined piece of work – and a one-off governance project will close it.
