Tools For Treasurers: The Verification Report

     I’m often asked questions about the role of a treasurer, and my short answer is, “It depends.” For a more in depth explanation of a treasurer’s role and responsibilities, check out this article. For the purposes of today’s topic, I’ll just remind you that a treasurer’s role can range from a treasurer who does it all, to a treasurer who makes sure it has all Benn done. But today, instead of discussing a treasurer’s role, I want to share with you about a very important tool that you can use to ensure that the fiduciary duty of your nonprofit and your board members is being fulfilled.

Are Your Nonprofit’s Internal Controls Still Effective? 

     Today's topic is about the verification report. You may not have ever seen one of these. It's a tool that I find so effective and helpful in the nonprofits that I work with. We can all agree that internal controls, (also known as checks and balances or safeguards) are important. They’re important for any nonprofit, but they’re incredibly essential for a board member, who has a fiduciary duty to make sure that the nonprofit is protecting its assets and ensuring that resources are used for their intended purpose. Internal controls also ensure that there's no theft or loss of funds, so you’ll want to work hard to set up those checks and balances, which is where today’s topic picks up- ensuring that they remain consistent and effective after they’ve been set up.  

How Nonprofit Internal Controls Fail

     It often happens that after these internal controls have been established, through the course of time, these policies are eventually relaxed or even forgotten. Sometimes this is due to staff turnover or gaps during transitions with quick handoffs or insufficient training. These situations make it more likely for policies to be overlooked and procedures to be forgotten.  

     Sometimes internal controls are gradually relaxed in situations where the existing staff get very  familiar with each other and begin skipping procedural steps because they trust each other. Well,  like Ronald Reagan, I like to say, “Trust, but verify.” So this verification report is all about verifying, and it's one of the best practices I have ever seen put in place. 

What Is A Verification Report?

     This report has two elements. First, there’s a small section (sometimes up to a page) about the key separations of duties. This is simply a quick bulleted list of your internal control procedures. For example:

•   How is cash handled? “We require two people to be present and we use a receipt book.”
•  How is payroll processed? Does one person have the ability to process payroll without anyone else verifying it?
•  How are expense payments handled? Who signs the check? Who verifies ACH payments at the bank? 

     These types of policies are outlined in the very first part of the verification report, which documents what the procedures are. 

     Now, once your procedures have been documented, every time you produce this report, you want to highlight any changes that have been made. This may include a  change in staff, where someone has left or transitioned to a new role. So your verification report  might indicate that Person A is now gone so now Person B is doing that job. Be sure to list the names and clarify who has the duties that are creating the checks and balances.

     The next step is to create a report that lays out which things are being done to confirm that these internal control processes are still being used. There are also a few things that need to be done every month that may not have been covered in detail in your first section with the summary of internal control processes. This second section of your verification report should cover:

•  Bank reconciliations- who did the bank reconciliation? On what date was it completed? What were the bank balances? This may work best as a spreadsheet format with the list of accounts down the left column and then columns to the right listing the person who completed the reconciliation, the date, the account balance, and most importantly, the person who reviewed the bank reconciliation.   Bank reconciliations are great opportunities to see all the transactions of the organization. There's some really important things you want to be doing when you look at a bank reconciliation. (I’ll be covering that topic in greater depth in a future post.) 
•  Payments- I would recommend someone looking at all the payments made for the month. Bank reconciliation is one place to find these. You may want to pick a handful of payments depending on your organization.  If your organization made 2,000 payments, then you should be selecting a larger sample of payments than if you made only 50 payments. However many payments you decide to review, document that number on your verification report, and then list out each payment reviewed, including vendor, the amount, and the purpose of the payment. The person doing this work should be someone separate from the person who originally made those payments. They should be reviewing whether each expense was properly approved. Did the right person in the organization sign off on that payment and ensure that the goods or services were received, and the expense was within their budget?
•  Supporting documentation- This is a step by which the person verifying is actually pulling those documents to personally look at them. Ideally, you're using your software tools and this is a purely digital process in which the reviewer has  view rights to look at all necessary documents. But, if absolutely necessary, this may involve pulling paper files to look at these documents. 
•  Payroll- Have someone pull a batch of payroll from within your review period to confirm that each person paid is truly an employee. Check for names, ensure that rates are approved, number of hours looks correct (part time, full time, overtime)  If you use a third party payroll processor, they may offer “audit reports.” These highlight hours worked and any payroll changes that were made so you can quickly see when new employees have been added and determine whether they are a legitimate employee.

      In each of the above sections, the reviewer is documenting what they’re inspecting, confirming all was well and reporting any exceptions. Remember, whoever does that work needs to be independent of it and needs to sign off indicating what they just did. 

     These are just a few ideas of what you might include in a verification report. Ultimately, the list just depends on your unique situation. This is definitely not a one size fits all formula. That's why I'm not handing you a verification example. It really is something you need to spend time customizing to your needs, and your board can be so valuable in helping to create this. Once you’ve crafted this verification report based on your organization and based on the processes you've decided are best for you, it should be provided regularly to the board or the treasurer (possibly in very large nonprofits). Now “regularly” might be monthly, which is ideal, or it might be quarterly, which is understandable if you have a smaller nonprofit. 

     So, what am I loving about this? Why am I finding this to be so valuable? Well, it's because we are doing the most important thing, which is inspecting what we expect. And this keeps the conversation about the separation of duties front and center. It prevents the inadvertent relaxing of practices, so that our expectations and our practices can remain in alignment. Ultimately, this lowers the risk of theft opportunities developing in your organization, which is worth putting in the time and effort for this report.