A free resource provided by the Virginia Society of Certified Public Accountants

Audit Guide for Audit Committees of Small Nonprofit Organizations

2

Audit Guide for Small Nonprofit OrganizationsA free resource provided by the Virginia Society of Certified Public Accountants

• Introduction

• Selectingtheauditteam

• Auditteamtasks

•Internalcontrols

• Theauditprogram

• Conclusion

• Resources

Introduction Periodically, nonprofit organizations (NPO) have to submitauditedfinancialstatementstotheircontributors,boards of directors and lenders for various reasons. Many grantorscommonlyrequestauditedfinancialstatementsif gross receipts exceed certain dollar thresholds.

Atthestatelevel,someagenciesrequireauditedfinan-cialstatementsifanNPOreceivescontributionsmorethanacertainamount(whichvariesfromstatetostate)and/or if the NPO hires a paid fundraiser. Generally, re-quiremetnswillbestipulatedinthegrantcontract.NPOsshould contact the Secretary of State or Office of the AttorneyGeneralforregulationsinthosestateswhereitraisesmoney.SeetheResourcessectiononpage6forVirginialawsgoverningcharitableorganizations.

At the federal level, NPOs that expend federal grants of morethan$500,000inanyfiscalyeararesubjecttothesingleauditrequirements(GeneralAccountingStan-dardsA-133requirements).

An audit provides the highest level of assurance that an organization’sfinancialstatementsarefairlypresentedandfreeofmisstatements. OnlyanindependentCPAcanperformanauditforanNPO,butawell-informedinternalauditteamcanhelpmaketheprocessrun moresmoothly.

SomeNPOsmaychoosetoobtainanauditevenifnotlegallyrequiredtodoso.Manygrantorscommonlyrequestauditedfinancialstatements.Insomecases,theywillacceptstatementspreparedin-house.Alternatively,

somegrantorsmayacceptanindependentCPAreview,whichdoesn’tundertaketheextensivetestingperformedbyanaudit,butwillprovidealimitedassurancethatthefinancialstatementsarefairlypresented.AreviewcostslessthananauditandforsomesmallNPOs,thereviewmaysatisfythestaterequirements.

Inadditiontotheseexternalrequirements,theboardmayseekreassurancethatthefinancialinformationtheyare considering as part of their oversight function is accurateandcomplete.Anauditmayalsobedesirabletoprotectnewmembersjoiningtheboardfromliabil-ityforanyfraudulentactivitiesthatmayhaveoccurredpriortotheirappointment.

ThisauditguideisintendedtoassisttheinternalauditteamsofsmallNPOstoperformlimitedreviewsoftheirorganizations’financialstatementsandhelppreparethe organization for an audit. Understanding the audit processandfollowingGenerallyAcceptedAuditingStandards(GAAS)willallowforamoreeffectiveteam.Seehttp://tinyurl.com/2gyu5qm(PDF)toviewthesestandards.

Inaddition,foreverymuseum,symphonyfoundationorfamilyserviceorganizationthathasadequatefundstoretaintheservicesofaCPA,therearescoresofsmallchurches,serviceclubs,literarygroupsandsimilarorga-nizationsthatdon’thaveexternalauditrequirementsorsimplylackthefundsforanaudit.

ThisguidewillhelpNPOboardofdirectorsbetterpro-vide oversight of financial activities until they reach the stagewhenanauditisrequiredand/orfundsareavail-able.Theboardcanalsoemphasizetheimportanceofinternal controls in safeguarding the assets of the NPO.

Selecting the Audit Team Theauditteamcanplayacriticalroleinmaintainingtheintegrity of the NPO’s financial reporting. Volunteers withthefollowingqualitiesshouldbeselectedfromtheboardorgeneralmembership:

• Afamiliaritywithhoworganizationalactivitiesarereflectedinthefinancialstatements

• SomeunderstandingoftheauditingprocessandGAAS

• Awillingnesstomatchdocuments,suchasex-pensevoucherstochecknumbersanddonationstobankdeposits

Considerationshouldbegiventoindividualswith

3

experienceinbusiness,suchasbankers,internalaudi-tors, CPAs and corporate officers. Executive officers frompreviousyearsarealsoexcellentchoices.However,makesurethecandidatesbeingconsideredarenotthose engaged in the actual transactions being audited.

Audit Team TasksTohelpillustratethetasksthatwillberequiredbyanin-ternalauditteam,assumethatyouhavebeenappoint-edtotheauditteamofGoodworks,Inc.,afictitioussmallnonprofitorganization.Youaccepttheassignmentwithsometrepidation,asyouunderstandtheattentiontodetailrequiredinpreparingforanaudit.

Theorganizationmayhaveaneedforavarietyofdiffer-entexaminationsintheaudit:finance,privacy,security,regulatorycompliance,ITgovernance,“valueformon-ey,”“valueandethics”andperformancemanagement,tonameafew.Eachoftheseexaminationsrequiresadifferentfocuswithdifferentmetricsandindicatorstobe gathered and analyzed.

Youalsounderstandthatoncetheanalysisiscomplete,reviewedandapproved,youwillneedtohelpimple-mentasetofcorrectiveactions,whichcanbechalleng-ing.TheauditteamwillneedtoworkwithGoodworks’managementinordertoimplementthecorrectiveactionsorcontrolstoaddressanyissuesfound.Thentheactionsthathavebeenincorporatedwillneedtobereassessedinfutureprogramplansandfutureaudits.

Inaddition,you’llneedtokeepinmindthatasasmallNPO,Goodworkshasalimitedbudgetofapproximately$50,000ayearandemploysonlyonepart-timeadminis-trativeassistant.TheboardofdirectorsmaynotseethemeritindivertingfundsfromkeyprogramsthatsupportitsmissioninordertoengageaCPAtoaudittherecords.

Theabovescenarioisnotuncommon,sobesureyouknowwhatyou’regettinginto.Ataminimum,theauditteamshouldbeconcernedwiththefollowingthings:

• Theadequacyofinternalcontrol(asysteminwhichtheoperatingorrecordingfunctioncanbebrokendownintoelementsthatareperformedbydifferent people, creating a separation that pro-tectsinformationandcross-checksaccuracywiththeworkoftheothers)

• Theaccuracyoftherecordsandthereportstothegoverning body (usually the board of directors)

• Theproperauthorizationofactivitiesandexpen-ditures(comparisonofactualfinancialstothebudgeted financials)

• Theproperclassificationofactivitiestoprograms,managementandfundraising

• Thedeterminationofthephysicalexistenceof assets

• Verificationthatsignaturecardsonthebank accountsareuptodate(checkannually)

• Areviewofthetax-exemptstatusandidentifica-tionofanyactivitiesthatmayendangerthestatus

• Areviewofallspecialeventstodetermineifallthedirectexpenseswereproperlychargedtotheattendees

• Areviewofallmonitoringreportsfromfunders(oftenstafftendnottoupdatetheauditcommit-teeorboardofsuchitems)

• Ascertainingthatpayrolltaxes,licenses,salestax-es,Form990,othertaxesandcorporatereportsareproperlyfiledinatimelymanner

• Determinationthattheorganization’sactivitiesremainconsistentwithitsestablishedexemptpurpose and that sufficient controls are in place to determineandassurecontinuedcompliance

Internal ControlsIndevelopingtheproceduresfollowedbytheauditteam,ortheauditprogram,internalcontrolsarees-sential:

• Topreventlossthrougherrors,misappropriationof funds or theft

• Topreventan“honest”employeefrommakingamistakethatcanruinhisorherlife

• Todocumenttheresponsibilityoftheboardasitsafeguards the assets of the NPO

• Toassurethatalltransactionsareproperlyautho-rizedandrecorded.(SeetheResourcessectiononpage6forexamplesofinternalcontrolforcashreceiptsandcashdisbursements.)

Theadequacyofinternalcontrolsshouldbeofprimaryconcerntotheauditteam.Lackorinadequacyofinter-nalcontrolscanmakethetaskofeventheCPAauditorextremelydifficultand,insomecases,almostimpos-sible.Therefore,allinternalcontrolsshouldbedocu-mentedinaproceduresmanual.VolunteersoftenarededicatedtothemissionoftheNPO,butmaynotknowthe appropriate procedures for running the organization inabusinesslikefashionwithoutsuchamanual.

Say,forexample,Goodworksemployedonepart-timeadministrativeassistant.Imaginethisindividualcol-lecting the funds, disbursing the funds, recording the financialtransactions,signingthechecks,recordingthe

4

minutesoftheboardmeetingsandpreparingfinancialreports.Thiswouldbeanexampleofacompletelackof internal control. Each one of these functions really shouldbeperformedbyadifferentvolunteer.

Commonsensemustbeappliedinconsideringinternalcontrolsaswellastheotherareasbeingreviewedbytheauditteam.Frequently,therearenotenoughvol-unteerstoperformallthedesiredinternalcontrols.Theorganizationisthenchallengedtowriteproceduresthatwillbestprotectitsassets,presentitsfinancialsituationfairlyandbereviewablebytheauditteam.Whateverthesituation,internalcontrolmustbeexaminedandimprovediffoundlacking.

SeetheResourcessectiononpage6foradditionalinformationondevelopinginternalcontrols.

Theauditteammustassesstheadequacyofthein-ternalcontrolenvironment,asthiswillgreatlyimpactthesetofprocedurestheauditteamwillfollow.Auditproceduresareeitherofacompliancenatureorofasubstantive nature.

Forexample,ifalldisbursementsinasmallNPOarereviewedforapplicationofexemptpurposeandap-propriateness, authorized separately by the board, recordedintheminutesbythesecretary,supportedwithinvoicesapprovedbythepresidentandpaidbycheckssignedbythetreasurerandoneotherofficer,thenumberofthesetransactionstobereviewedcanbeminimized.Nevertheless,theteamwouldberequiredto satisfy itself that the internal control procedures outlinedabovewereactuallybothdocumentedinaproceduresmanualandbeingfollowed.IftheNPOhasastronginternalcontrolenvironment,itwilldesigntestsofcontrolswhicharecalled“compliancetests.”Thesetests of controls are designed to verify the existence of the internal control procedures and if they are placed in operation on a consistent basis.

WhenanNPOdoesnothaveagoodsystemofinternalcontrol,itisextremelydifficulttodeterminethatalltransactions have been properly recorded. Under these circumstances,substantivetestsshouldbeperformed.Thesetestsaredesignedtoidentifyerrorsorirregulari-tiesdirectlyaffectingtheaccuracyofbalances.Forex-ample,executivesofNPOshavebeenknowntoinflatetheNPOincomesbyfailingtorecordallexpenses,orbymanipulatingperformancemetricsandmisclassify-ingundesirablemanagementexpensesasdesirableprogramexpenses.Checkingcashdisbursementsinthemonthsfollowingtheendoftheaccrualperiodmight

uncoverexpensesandevencampaigndonationsthatshould be reassigned to the audit period.

Confirmationofbalanceswithcreditorsalsowouldidentifyunrecordedliabilities.Testsofbankreconcilia-tions,matchingalldonations(checks,cash,creditcardsandin-kind)todepositslips,matchingallchecknum-berstoexpensevouchers,reviewsofminutes,compari-sons of current and previous financial reports and of the period’stransactionswiththebudgetareexamplesofsubstantive procedures that can prove evidence of the completenessoffinancialstatementaccountbalances.

The Audit Program Indevelopingtheproceduresfollowedbytheauditteam,ortheauditprogram,theadequacyoftheinter-nalcontrolsisaninfluencingfactor.TheauditprogramwillvarywiththetypeofNPO,itsvolumeofincomeandthecomplexityofitsoperations.Theteamshoulddevelopawrittenplanforeachaccountbalanceorclassoftransactionselectedforexamination.Theplanshouldindicatetherelationshiptothefinancialstatementas-sertionsandauditobjectives.

AssumethatGoodworks,Inc.hasamuseumstorethatmaintainswithaninventoryofmerchandise.Theauditteamdesirestogatherevidenceastotheexistenceoftheinventorylistedasanassetonthebalancesheet.Thechartonpage5demonstrateshowauditobjectivesaredevelopedandlinkedtofinancialstatementassertions.

Oncetheauditteamdevelopsauditobjectivesfortherelevantaccountsonthebalancesheetandincomestatement,theteamcanthenfocusonspecificauditproceduresfortheauditprogram.Belowisadiscussionofthethreeareasofemphasistoincludeintheauditprogram.

1. The Proper Authorization of Activities and Expenditures Thebudgetandtheboardofdirectorsminutesaretheusual source of verification of NPOs’ activities. Gener-ally,committeechairsarerequiredtoauthorizeanyex-pensesfromtheirbudgetfunds.Employeesoftendocu-menttheirowntimesheetsandexpenserecords,withasecondpartyreviewingthesedocumentseachmonth.Additionally,thecorporatecharterandbylawsshouldbereviewedtodeterminethatallactivitiescomply,thatthedesignatedindividualsareperformingtheirproperfunctions and that these functions are properly assigned toprograms,managementandfundraising.Areviewor

5

Account: Museum Shop Inventory Financial Statement Assertion Audit Objective

Existence or occurrence Inventories included in the balance sheet physically exist and

transactions and events that have been recorded and

disclosed have occurred.

Completeness Inventory quantities include all products, materials and supplies

on hand and all transactions and events have been recorded.

Inventory quantities include all products, materials and

supplies owned by the client that are in transit or stored at

outside locations.

Inventory listings are accurately compiled in the inventory

accounts.

Rights and obligations The entity has legal titles or similar rights of ownership to the

inventory.

Valuation or allocation Inventories are properly stated at cost or market value (if

lower than cost).

Presentation and disclosure Inventories are properly classified in the balance sheet as

current assets.

Account: Cash DonationsFinancial Statement Assertion Audit Objective

Existence or occurrence Each donation has a donation form. The donation forms are

for campaigns conducted during the fiscal year.

Completeness Each donation is totaled on an adding tape. The sum of the

adding tape matches a bank deposit (either a physical

donation of checks or an automatic deposit of credit cards).

Rights and obligations Each donation is marked as restricted or unrestricted in the

accounts. If restricted, the donation is marked with the

donor’s choice of funds.

Valuation or allocation Cash donations are recorded at face value. Bank fees and

credit card fees are also recorded.

Presentation and disclosure No personal information is included in the public financial

statements. No unencrypted credit card numbers are

retained. Each donation is credited to the proper donor in

the CRM system.

6

test of specific transactions should be included in the auditprogramandperformedatleastannually.

2. Determination of the Physical Existence of Assets Verificationofbankbalancesandcurrentbanksigna-tures,anactualcountofsecuritiesownedandacountofmerchandiseareproceduresthathelptheauditteamdeterminethephysicalexistenceofassets.Anexamina-tionofdeedsandtaxassessmentsisanotherprocedureapplicablewhenrealpropertyisownedbyanNPO.Securingappraisalsofdonatedpropertymightbeap-propriate in the case of unusual donations. All of these records—suchasmonthlybankstatements,brokeragestatements,deedsanddonationforms—shouldbeavailabletotheauditteam.

3. Ascertaining That Returns and Reports Are Filed in a Timely Fashion AnNPOhasthesameobligationtofiletaxreturnsandcorporatereportsasafor-profitorganization.FailuretocomplywiththeserequirementswillexposetheNPOtopossiblefinesorpenalties.TheU.S.InternalRevenueService(IRS)hasbecomeespeciallyharshwithanynon-compliancewithForm990filingdates.Atitsplanningmeeting,theauditteamshouldpreparealistofthesetaxes and reports, including:

• Payrolltaxes,ifwagesarepaid

• Salestaxesandlicenses

• Form990,ReturnofOrganizationExemptFromIncomeTax,ifgrossreceiptseachyearexceedthefilingthreshold(currently$25,000)

• Form990-N(e-Postcard)ifgrossreceiptsarecurrentlyunderthefilingthresholdlimits;somedonorsandgrantorsmaystillpreferthetranspar-encyofForm990tothesimplicityofForm990-N

• Annualcorporatereport,tobefiledwiththestate

• Auditreport,ifapplicable

Theprecedingmaterialisonlyalimiteddiscussion,andtheremaybeadditionalareasofconsiderationthatanNPOwillneedtotakeintoaccount.

Conclusion Thepurposeofthisguideistoaidtheauditteamtoperformitsreviewoftheorganization’sfinancialstate-mentsandoperationsinarelevantmanner.Theteamshouldsatisfyitselfthatincomeandexpendituresarebeingclassifiedinaconsistentmanner;otherwise

comparisonsoffinancialreportsovertheyearswillhavelimitedsignificance.Thenwhenthetimecomestoen-gageanindependentCPAtoperformanauditfortheorganization, there should be no surprises.

Thetaskoftheauditteamrequiresdiplomacywithdetermination.Thepurposeistoassureaccuracyandprotection, not to find indiscretions by staff or officers. However,inassuringaccuracy,misuseoffundsmaybeuncoveredandmustbetakenseriously.NPOsmustprotect the public’s trust and assure that public funds areusedeffectivelyfortheexemptpurposeintended.

Irrespectiveofwhetheranauditiscompleted,establish-ing internal controls protects both the organization and theboardmembers,officersandstaff.Thereisnothingharder on an organization than a theft investigation of avolunteerorstaffmember,whetherwarrantedornot.Internalcontrolsprotectassetsandreputations.TheyareamustforeventhesmallestNPO.

TheVirginiaSocietyofCertifiedPublicAccountants(VSCPA) offers free resources, including a Nonprofit Pro BonoAssistanceprogramandtheFindaCPAdirec-torytohelpconnectnonprofitorganizationswithaCPAintheirgeographiclocationswhocanbestmeettheirfinancialandbusinessneeds.Formoreinformation,visittheVSCPANonprofitResourceCenterat http://www.vscpa.com/NPOResources.

Resources Virginia state law governing NPOs and charitable contributions:

VirginiaDepartmentofAgricultureandConsumerSer-vices(VDACS)includesregistrationformsforcharitableorganizationsthatsolicitdonationsandotherrequiredformsandinformationonstatelaws,includinginstanceswhenanauditmayberequired.

• VirginiaSolicitationofContributionsLaw: http://tinyurl.com/mtyom

• VDACSformspage:http://tinyurl.com/28z68ws

American Institute of CPAs (AICPA) essential reading for any audit team:

• GenerallyAcceptedAuditingStandards(GAAS):http://tinyurl.com/2gyu5qm

• TheAuditCommitteeBrief,developedbytheAICPA,explainsthebenefitsthataneffectiveauditcommitteecanproduceforanonprofitorganiza-tion:http://tinyurl.com/258o5qz

7

• “Not-for-ProfitEntities:Audit&AccountingGuide” can be purchased here: http://tinyurl.com/23f88yy

Some suggested controls for cash disbursements:

• Checksshouldbepre-numberedandusedinsequence,withadequatecontrolsoversuppliesofblankchecks.Allchecknumbers,evendestroyedchecksfor$0,shouldbeenteredintotheaccount-ingprogram.

• Checksshouldbepreparedbypersonsotherthanthosewhoapproveinvoices.Thesupportingorganizational invoices should be signed by the responsiblecommitteechairforthattypeof funding.

• Checksshouldbepreparedfromoriginalorgani-zationalinvoiceswithattachedcopiesofpurchaseorders, vendor invoices and receiving reports and presentedforsignaturewiththeseattached.Theorganizationalinvoicesshouldbenumbered(bythe treasurer after receipt), include the originals of allreceipts,andberetainedinnumericalorder.

• Checksshouldbeenteredinthedisbursementjournalexactlyastheyhavebeenprepared.

• Thegoverningboardshouldauthorizeallchecksigners.Allchecksformorethanacertainamountshouldbesignedbytwopersons.

• Signingofblankchecksshouldnotbepermitted.

• Anofficerorexecutivedirectorshouldreceivetheunopenedbankstatementbeforeturningitovertoaperson,otherthanonewhohandlesthere-ceiptanddisbursementofcash,forreconciliation.Thisofficershouldreviewthebankreconciliation,thendateandinitialit.Thereconciliationshouldberetainedfortheauditteam.

Some suggested controls for cash receipts:

• Incomingmailshouldbeopenedandlistedbypersonsotherthanthosewithaccesstocashreceiptsjournalsandaccountsreceivablerecords.Ifthereisnodonationformwiththecheck,oneshouldbeprepared.Allinformationonthecheck

shouldbecapturedonthedonationform.

• Apersonwithnoaccesstocashshouldcomparecash receipts records and authenticate deposit slipswithmaillisting.Thedepositslipandtheaddingmachinetapeshouldbeattachedtotheappropriatebundleofdonationforms.Thedepos-itshouldbenumberedsequentially.Thebundleddonationforms,addingmachinetapeanddepositslipshouldberetainedfortheauditteam.

• Checksshouldbestamped“ForDepositOnly”bythepersonopeningthemail.

• Pre-numberedreceiptsshouldbegivenforcontri-butions, gifts, etc.

• Cashreceiptsshouldbeenteredinjournalsbypersonsotherthanthoseopeningmailandlistingreceipts.

• Receiptsofchecksandcashshouldbedepositedeach day intact.

• Individualshandlingcashshouldnotmakeentriesto the general ledger or subsidiary ledgers.

• TheNPOboardshouldauthorizebankaccountsandthesignersofchecksannually.Thebestbankaccountswilllinkeacheveningwiththeorganiza-tion’saccountingsystem,andupdatetheaccountswiththatday’sbanktransactions.

• Individualshandlingcashshouldbebonded.

This guide was last updated in September 2012 by CPAs serving on the VSCPA Nonprofit Resource Guides Task Force. CPAs and nonprofit organizations are freely encouraged to email or copy this guide to share with officers and directors serving on nonprofit boards. For permission to duplicate this guide or modify it for any other purpose, please contact the Virginia Society of CPAs at 4309 Cox Road, Glen Allen, VA 23060, (804) 270-5344 or vscpa@vscpa.com.

8

Learnmoreatwww.vscpa.com