What are internal controls and why are they important?
Trustees have a duty to safeguard charity assets and to make sure resources are used wisely. A good system of internal controls is key to this. Sound internal controls can reduce the risk of loss through theft, fraud, bad decisions or error.
How long has it been since your last review?
In many charities, internal controls are well documented. However, it may be several years since your last review. Has this been checked or updated since then?
Do you need to have a review?
An annual review is best practice and is expected by the Charity Commission. Indeed, the Annual Return asks whether a review has been carried out. The nature of the review will depend upon the size of the charity and its activities and complexity. For many charities, this is a routine process and follows similar procedures each year. Guidance from the Charity Commission (CC8) includes a checklist of matters to consider. This is a good starting point for all charities.
What part does risk play in the review?
Risk should drive the review. Charities should update their risk register at least once a year, then think about how risks have changed and whether there are any potential gaps in controls. You can then tailor the internal controls review to the risks you’ve identified.
What should an internal controls review cover?
The internal controls review should cover not only finance but also operations and governance. For example, it may cover trustee training, quality of records and information provided to trustees and controls over the detection and prevention of fraud.
Who should do the review?
It can be done in-house by a member of the finance team, or a peer from another department. You could use an external consultant. An external consultant can bring experience of best practice that they have seen elsewhere.
With MHA, we have created Keeping Your Charity on the Right Track, a 12 month programme to help you improve your organisational governance in a stepped and measured way. Each month’s article covers an area of charity governance. The article for month eight considers internal controls reviews further, and includes a checklist of items all charities should do:
- Familiarise yourself with the Charity Commission guidance on internal controls – CC8 Internal Financial Controls for Charities.
- Check your documentation of internal controls to see if it’s up to date.
- Review your risk register and make sure that the internal controls in place are appropriate to manage the risks identified.
- Ensure that the monitoring and review of internal controls is considered at a board meeting at least once a year.
- Make sure the review process is documented, including within board minutes.