Strengthen approvals, payment controls and documentation.
On this guide Browse sections
Financial controls a small team can actually run
Short answer: Internal financial controls are the rules that stop mistakes and misuse slipping through: who can approve a payment and up to what amount, how purchases are compared, who reconciles the bank, and how exceptions are recorded. Even a three-person NGO can run them by splitting request, approval, payment and checking across different people, and by having a governing body member review the bank statement every month. Your governing body sets the limits; write them down and adopt them.
Who does what in a three-person office
| Task | Coordinator | Accountant | Treasurer (governing body) |
|---|---|---|---|
| Raises a purchase or payment request | ✔ | ||
| Approves within the adopted limit | ✔ | ||
| Makes the payment | ✔ | ||
| Reconciles the bank | ✔ | ||
| Reviews the reconciliation and statement | ✔ monthly | ||
| Logs any exception | ✔ / ✔ | ✔ | signs off |
Where one person must do two jobs, add a check after the fact. The accountant both pays and reconciles here, so the treasurer reads the raw bank statement, not just the summary.
Red flags worth a second look
- Several payments just below an approval limit to the same vendor.
- A vendor whose address or bank account matches a staff member’s.
- Advances that roll over month after month without bills.
- Reconciliations done, but never signed by anyone else.
When something is found, write it in the exception log the same day: what happened, the interim fix, who owns it, and when it was closed. A written log protects honest staff as much as it catches problems.
Next: bookkeeping basics, governance and delegated authority, and the policies checklist. Authority matrix, procurement register and exception log templates are in the Finance Controls pack; donor records covers donation-side controls. Want help with the year-end? See annual compliance.
By Vekho P. Ringa, Editor. Last verified 22 Oct 2026. Sources: practice guidance; the binding limits come from your governing body’s adopted policies, governing instrument and funder agreements. General information only, not legal advice.
Internal financial control means making it harder for mistakes, misuse and unsupported transactions to pass unnoticed. The goal is not bureaucracy. It is a proportionate system in which important transactions require evidence, authority and review.
A small NGO may not have enough staff for perfect segregation of duties. It can still design compensating controls.
NGO financial controls: authority matrix, procurement register and exceptions log
Use these working files to make an NGO’s money-management rules clear, adopted, traceable and independently reviewable. The templates are designed for societies, public charitable trusts and Section 8 companies, but each organisation must adapt them to its governing documents, people, projects and funder agreements.
18 common transaction categories and 21 fields. Amount bands, approvers and finance roles are deliberately blank: your governing body must set and adopt them.
20 editable purchase records and 29 fields covering need, budget, selection, bids where required, conflicts, delivery, payment and review.
20 blank exceptions and 21 fields to trace an observed control gap through interim safeguards, responsible ownership, action, verification and closure.
The files are editable CSVs that open in Excel, Google Sheets and LibreOffice. No private data is uploaded to NGOGrant merely by downloading. The approval matrix is labelled draft, not adopted until the competent NGO authority approves its contents.
1. Separate responsibilities at each material payment
| Control stage | Evidence to prepare | Independence question |
|---|---|---|
| Request and budget check | Need, project/fund code, planned budget, quantity and scope. | Who verifies that funds exist and the cost is permissible? |
| Selection and authorisation | Applicable selection method, conflict disclosure, decision record and authorised approval. | Can an interested person approve their own supplier or contract? |
| Receipt and payment | Work/asset receipt, invoice, bank details verified separately, authorised payment. | Who confirms delivery, and who releases funds? |
| Recording and independent review | Voucher, ledger, bank reconciliation, budget variance and exceptions. | Is the reconciliation reviewed by someone who did not prepare and control all stages? |
CAG’s internal-control guidance treats allocation of responsibilities, segregation of incompatible duties, transaction approvals, reconciliation and follow-up of control deficiencies as important elements of control design. The principles are useful to an NGO, while its own lawful governance and donor conditions determine how to implement them.
2. Worked example — one purchase with a proper evidence trail
A programme officer identifies teaching material needed for a donor-supported project. The finance officer first checks the approved activity budget and whether this item is permitted. Staff follow the NGO’s actually adopted procurement method and file quotations or competitive evidence if that method requires them.
The authorised person or committee then records selection and approval. A separate recipient confirms the correct goods arrived. Finance checks the supplier invoice and verified bank details before an authorised signatory releases the payment. The bookkeeper posts the expense to the correct grant head, and an independent reviewer checks the bank reconciliation and evidence trail.
Conflict branch: If a committee member has a financial interest in the supplier, record the interest, examine the governing-policy and grant rules, arrange permissible independent decision-making or recusal and obtain required funder consent before committing funds. A conflict cannot be cured simply by attaching three quotations.
No invented threshold: ₹48,000 is the illustrative price, not a statutory quotation band, mandatory purchase ceiling or suggested spending authority for any NGO.
3. Procurement checklist: from request to accepted goods
4. How a small NGO can use compensating controls
A small NGO may not have four separate finance employees. It can still separate the most sensitive steps. For example, a programme manager may prepare the request and delivery note, while a governing-body member independent of the vendor authorises the purchase; a permitted bank signatory releases funds, and another authorised reviewer examines bank statements and the month-end ledger.
Where duties overlap, document who is independent, what they checked, when they checked it and how exceptions are followed up. A board signature on an unchecked batch of papers does not automatically create an effective review.
5. Exception case: missing delivery confirmation
A vendor invoice and bank payment exist for an approved purchase, but no goods-received evidence is on file. Record an exception ID, the relevant invoice/project, facts discovered, control required and person assigned. Obtain genuine independent delivery confirmation, inspect the asset if relevant and decide whether donor notification or additional review is needed.
If the evidence cannot be established, keep the exception open and escalate according to policy; do not fabricate a goods-received note or mark the item closed. Only a competent authority may approve a permissible policy exception. It cannot waive a statutory or grant requirement that binds the NGO.
6. Monthly review and closing practice
Review high-value or unusual payments, aged advances, supplier bank-account changes, related-party contracts, duplicate voucher IDs, missing goods receipt, project budget deviations and reconciliation differences. Use the exception log to track finding → interim safeguard → owner → action → independent check → closure evidence.
Set realistic review cadence in the NGO’s own policy; do not describe an internal monthly target as a universal statutory filing deadline. The person investigating an issue should not be the sole person certifying their own corrective action as complete.
7. Sources, scope and related free guides
- CAG — Other Manuals and Guidelines (lists the Internal Controls Evaluation Manual, 2009) (government audit guidance on authorisation, segregation of duties, reconciliations and follow-up of deficiencies; not a one-size-fits-all NGO statute).
- CAG — Audit Regulations (government grant accountability and verifying the intended use of assistance).
- Department of Expenditure — General Financial Rules and updates (check only where the relevant Government grant framework requires them).
Compliance calendar
Policy adoption and version controls
Donation and donor controls
Editorial review: 9 October 2026. These sample CSV files are educational, organisation-editable controls, not statutory forms, Government approvals, an audit opinion or proof of compliance. NGOGrant is a private independent platform. Adapt and adopt controls through your genuine governing authority and consult relevant professionals and grant terms.
1. Build controls around risk
Start with the NGO’s highest-risk areas:
- bank payments;
- cash;
- procurement;
- payroll;
- advances;
- grants;
- donor receipts;
- assets;
- online banking;
- accounting master data;
- contracts;
- related/conflict transactions.
Do not spend more control effort on a ₹200 stationery purchase than on a ₹5 lakh project payment.
2. Separate four functions where possible
For significant transactions, try to distinguish:
- Request/prepare
- Approve
- Pay/custody
- Record/reconcile/review
One person may perform more than one role in a small NGO, but the highest-risk combination is where the same person creates the transaction, approves it, pays it and reconciles it without independent review.
3. Delegated authority matrix
Create written approval thresholds and reserved matters.
Possible dimensions:
- operating expense;
- procurement;
- contract;
- staff appointment;
- travel;
- asset purchase;
- grant acceptance;
- budget reallocation;
- bank signatory;
- write-off/refund;
- emergency spend.
The thresholds should be adopted by the competent governing authority and aligned with donor restrictions.
4. Procurement controls
Before purchase:
- documented need;
- budget/fund confirmation;
- specification;
- appropriate selection route;
- conflict check;
- approval.
After selection:
- purchase/work order or agreement where appropriate;
- delivery/service evidence;
- invoice;
- payment approval;
- bank proof.
Avoid splitting one purchase artificially to remain below an approval/quotation threshold.
5. Vendor control
Maintain a vendor/service-provider master with proportionate verification.
For material vendors:
- legal/trade name;
- contact;
- bank details;
- tax details where needed;
- conflict disclosure;
- agreement/order;
- bank-detail change history.
Any change to bank details should be independently confirmed before payment.
6. Payment control
A payment packet should answer:
- what is being paid;
- why;
- who approved;
- budget/fund;
- supporting evidence;
- payee;
- bank details;
- amount;
- deductions where applicable;
- payment reference;
- ledger entry.
Avoid paying from screenshots or forwarded messages without the supporting approval trail.
7. Banking access
Banking controls may include:
- organisation-owned mobile/email where feasible;
- individual user IDs rather than shared credentials;
- maker/checker or dual-authorisation for material payments where available;
- current signatory mandate;
- access review when staff/office bearers change;
- transaction alerts to an appropriate reviewer;
- secure storage of tokens/DSC/credentials.
Never put passwords or OTPs into a document-management or enquiry system.
8. Bank reconciliation as an independent control
The reconciliation should be prepared/reviewed by someone with enough independence from the payment process.
Review:
- unpresented payments;
- unidentified receipts;
- charges/interest;
- reversals;
- old outstanding items;
- unusual transfers.
Long-outstanding reconciling items require action, not repeated copying into next month.
9. Cash controls
Where petty cash is necessary:
- approved float;
- named custodian;
- permitted uses;
- voucher requirement;
- replenishment based on actual expenditure;
- surprise/periodic counts;
- independent review.
Avoid cash withdrawals merely to create flexibility.
10. Advances
Controls:
- written purpose;
- budget;
- recipient;
- amount;
- settlement date;
- no fresh advance where old one is materially overdue unless approved;
- evidence and unused-cash return;
- ageing report;
- escalation.
11. Payroll controls
A payroll change should be supported by a genuine personnel decision.
Control changes to:
- joining;
- salary;
- allowance;
- bank account;
- deduction;
- leave without pay;
- termination.
Compare payroll to prior month and investigate unexplained changes before payment.
12. Asset controls
For significant assets:
- approved purchase;
- asset ID;
- register;
- physical tagging where practical;
- location/custodian;
- periodic verification;
- transfer record;
- disposal approval;
- donor restriction.
13. Donor and fundraising controls
Separate fundraising message, money receipt, bank reconciliation, receipt issuance and accounting.
Controls should detect:
- receipt without bank credit;
- bank credit with no donor record;
- duplicate receipt;
- unauthorised collector;
- restricted donation used elsewhere.
14. Grant controls
Each grant should have:
- grant ID;
- agreement/sanction;
- budget;
- approved amendments;
- project code;
- release record;
- expenditure controls;
- advance register;
- reporting calendar;
- closeout.
Funder rules can override the NGO’s normal internal process where the agreement lawfully imposes stricter conditions.
15. Accounting access and master data
Control:
- new account codes;
- vendor master;
- donor master;
- project/fund code;
- opening balances;
- journal entries;
- period reopening;
- deletion/voiding.
High-risk manual journals should be reviewed.
16. Month-end control pack
Each month review:
- bank reconciliations;
- cash;
- advances;
- payables;
- project/fund balances;
- payroll;
- major procurement;
- assets;
- unusual journals;
- donor reconciliation;
- compliance deadlines.
A review signature without evidence of review is weak; document queries and corrections.
17. Compensating controls for small NGOs
If the NGO has one accountant:
- Treasurer or Secretary independently reviews bank reconciliations.
- Governing authority approves major payments.
- Bank alerts go to another office bearer.
- Vendor bank changes require separate confirmation.
- Periodic external bookkeeping review may be used.
- Cash and assets receive surprise checks.
- Finance reports go to the governing body.
The control should address the risk created by limited staffing.
18. Exception register
Controls should allow documented exceptions rather than informal bypass.
Record:
- control normally required;
- reason for exception;
- risk;
- alternative evidence/control;
- approving authority;
- date;
- follow-up.
Repeated exceptions mean the policy may not fit operations.
19. Fraud/red-flag response
Examples:
- altered invoices;
- repeated round-amount payments;
- duplicate vendors;
- personal bank accounts;
- unexplained cash;
- old advances;
- bypassed procurement;
- related-party transaction not disclosed;
- missing delivery evidence;
- receipts outside the official sequence.
Do not accuse a person based on a red flag alone. Preserve evidence, restrict access where appropriate and escalate under the NGO’s policy/professional advice.
Practical control self-assessment
For each high-risk process ask:
- Can one person complete the whole transaction alone?
- Is authority documented?
- Is evidence independent?
- Is there a reconciliation?
- Are exceptions visible?
- Is access reviewed?
- Can a reviewer trace the transaction?
- Does the donor/grant impose a stricter rule?
- Is the control actually performed?
Source and applicability notes
This guide is derived from NGOGrant’s Finance Controls & Audit Readiness system.
It is a practical internal-control framework, not an assertion that one procurement threshold, approval matrix or cash limit applies to every NGO.
On controls, approvals and segregation
What are the most important controls for a small NGO?
Monthly bank reconciliation reviewed by someone who did not prepare it, written approval limits, two signatories on the bank account, and an advances register. Start with those four.
Who sets the approval limits?
Your governing body, by resolution, within the powers its governing document gives it. Record the resolution and share the matrix with staff. General information only, not legal advice.
We have only two staff. Can we still segregate duties?
Partly. Use the governing body as the second person: they approve, review the statement and sign off the reconciliation. That compensating check matters more than the org chart.
Do we need three quotations for every purchase?
Only if your policy or a funder says so. Many NGOs set a value above which quotations are needed; set yours by resolution and stick to it.
What should we do if we suspect misuse?
Secure the records, restrict access, inform the governing body chair, and record facts in the exception log. Take professional advice before confronting anyone.
How often should controls be reviewed?
At least once a year, and whenever the team, the bank mandate or a major funder changes.
Are internal controls a legal requirement?
Some legal forms and funders set specific requirements; no one checklist binds every NGO in India. Check your governing law, audit requirements and grant agreements. General information only, not legal advice.
NGOGrant boundary
NGOGrant can help design control matrices, payment/procurement records and reconciliation workflows. Statutory audit and professional certification remain with qualified professionals.
When is the free guide enough—and when might a document pack help?
Start free: The free approval-authority matrix, purchase review register and exception log on this guide may be sufficient for a small organisation starting basic controls. Adopt genuine approvers and review thresholds rather than copying invented figures.
Consider a connected system if: A Treasurer managing repeated transactions may benefit from connected payment, procurement, bank and cash control workflows, month-end routines, advance management and an audit evidence handover.
What the optional pack actually describes: The optional pack describes 60 editable resource pages in six DOCX modules, an eight-sheet XLSX workbook and PDF guidance, plus an illustrative monthly close and audit-readiness case.
What it does not do: It is not an audit, professional opinion, financial certification, banking authorisation or exemption from the organisation’s actual donor and legal requirements.
View the finance and audit-readiness pack →
This link opens the matching pack in NGOGrant’s document catalogue. Purchases are not available yet. You can review the listed price, contents, scope and licence, and check the Shop for availability updates. The free guidance above remains available without purchase.