“Significant Diversion” in nonprofit’s tax filing may trigger its demise, absent good controls

An October 2013 investigative report by the Washington Post revealed that more than one thousand nonprofit organizations in the United States in the past five years acknowledged losses of more than $250,000 from embezzlement, fraud, theft or other improper use of funds. The losses, which totaled more than $250 million, were reported as a “significant diversion of funds” on IRS Form 990, which must be filed annually by nonprofits.

Some losses, such as those from investments or employee theft, may go unreported because of the potential reputational harm that accompanies them. The harm resulting from a loss of public confidence could translate into a loss of funding and put the mission of the nonprofit in jeopardy.

Reputation and responsibility

One asset that cannot be purchased is reputation. A nonprofit can never acquire a new reputation. Many nonprofit leaders focus on building a strong reputation because they know it is a huge asset.

They also know the harsh reality of financial risk and the potential for fraud. As the economic downturn worsened, the motivation to commit a financial crime became stronger.

A nonprofit has a responsibility to its mission and to the public at large to identify the risks of fraud and insider espionage and to mitigate these risks. All organizations face the risk of fraud, which can be mitigated through adequate internal controls and prevention techniques that reduce the opportunity for fraud and the methods by which it is committed.

Fraud schemes

There are many asset misappropriation schemes that can afflict a nonprofit organization. Becoming aware of the schemes and threats is a big step toward fiduciary responsibility. The following list is a sampler of fraudulent schemes that can confront a nonprofit organization and detection methods that counter them:

  • Asset Misappropriation – Cash Theft or Larceny
    • Perform an analysis of bank reconciliations and test for accuracy; compare internal end-of-month cash balance with respective monthly bank statement; and examine supporting documentation for large reconciling items.
    • Compare bank deposit to cash receipt records and investigate potential discrepancies.
    • Count petty cash on hand and compare it to the total recorded cash amount.
    • Asset Misappropriation – Fraudulent Disbursements and Vendor Fraud
      • Obtain a vendor list for current and prior periods to compare those that are undergoing the approval process.
        • An employee may place a fictitious vendor in the accounts payable system and submit false invoices for this vendor.
        • Identify vendor names listed only by initials or only a postal box as the address.
  • Benford’s Law (a statistical rule also known as the First-Digit Law) indicates a normal distribution of the first digit in any data set. Any given multi-digit number will start with a 9 about 5% of the time, but is much more likely to start with a 1 (30% of the time).
    • With Benford’s Law in mind, review disbursements to vendors, particularly those disbursed by a single employee, to identify irregular payment amounts.
    • Fraudulent Disbursement Scheme – Check Tampering
      • Review checks or cash disbursements to identify endorsees, payee, dates, amounts and signatures.
        • Endorsements may indicate different account numbers or vendors than typically utilized.
        • The backs of checks often contain very revealing information, such as a handwritten number entered by a teller that reflects the number of a wire transfer purchased by the customer.
  • Review the locations of the intermediary and depository banks for areas outside the primary place of business of the nonprofit. This location may lead to the identity of the ultimate recipient of the payment.
  • Fraudulent Disbursement Scheme – Vendor Contracts
    • Compare vendor contracts and bids to determine if the same vendors win a large percentage of bids and how vendors are chosen.
      • Does the low bid always win?
      • Does the final bidder always win? This may indicate collusion with internal administrators.
  • Identify the frequency of change orders after the original contract is awarded.
  • Fraudulent Disbursement Scheme – Expense Reimbursements
    • Compare expense reports by employee to budgeted amounts or a historical trend of reports for that employee’s counterparts.
    • Compare expense reports to employee calendars, time sheets or internal travel logs.
    • Examine supporting documentation for unusual items or amounts, as well as personal purchases that are not legitimate business expenses.


Many nonprofit organizations have limited administrative resources and few employees. The nonprofit industry is often targeted by financial criminals of various stripes because of its limited internal controls, inadequate fraud information and training, and infrequent external audits of risk controls and assessment.

Failure to recognize the value — and cost-effectiveness — of strong internal controls and their positive impact on the organization’s performance can be foolhardy in the administration of a nonprofit organization. Many financial crime and fraud controls are inexpensive and provide cost-effective solutions to help nonprofit organizations and businesses owners confront financial crime.

Ways to improve internal control and fraud detection

It is worthwhile at this time of year when nonprofit organizations and charities face a tidal wave of financial crime to ponder some basic self protection tenets in the not-for-profit field.

  • Responsibility and Accountability for Policies
    Assign a person or a small group in the organization the task of developing, documenting, implementing, enforcing, monitoring and updating risk management policies and procedures.
  • Update Risk Assessment and Internal Control Review
    The risk assessment process seeks to establish a risk baseline and to identify new or changed risks as they arise. Updating an internal risk assessment involves periodically identifying the risks and developing appropriate responses.
  • Provide Supporting Resources
    For the controls to work, they must be supported by all levels of the organization, from management to administrative staff. Assigning adequate resources, including personnel, budgets and other resources is an integral element of self-protection and compliance.
  • Awareness and Training
     Detailed, scenario-based training should be provided to all employees. Training should be tailored to the distinct jobs and responsibilities that employees discharge.
  • Educational Services
    Employees, including management and board members, should be provided access to forums that address business, technical and legal issues that face nonprofits. The organization should ensure that these employees are aware of emerging financial crime trends affecting the industry.
  • Audited Financial Statements
    Periodic audits should be performed by licensed accounting firms in accordance with government auditing standards and other applicable regulations and standards.
  • Expert Assessment
    Either through capable employees or outside experts, the organization should identify its exposure to financial crime risks and the internal and external resources that may be leveraged to prevent or mitigate them.

Protect reputational assets

The most valuable asset of nonprofit organizations is the one that is hardest to quantify and most at risk. Implementing a risk management plan not only helps the nonprofit protect and enhance its reputation, but usually leads to an increase in public funding. A “significant diversion” for purposes of the IRS and other tax authorities is what a nonprofit organization, especially one that serves a philanthropic cause, does not want to face. Assuring that policies and procedures exist to mitigate these risks and that internal or external experts are available to confront emerging issues is vital to the viability of all nonprofits in all countries.

*John Lash, CFCS, CFE, is Manager of Business Valuation & Litigation Support Services at Alpern Rosenthal, Pittsburgh. jlash@alpern.com