In a small church the same generous person often opens the mail, pays the bills, enters them in the books and reconciles the bank. Nobody planned it that way. It is simply who was willing. The trouble is not that this person is untrustworthy. It is that if a number is ever questioned, nobody else can vouch for them. Internal controls fix that with a few assigned roles and a second pair of eyes.
Four jobs that should not belong to one person
- Approving. Deciding that a bill should be paid or a purchase made.
- Paying. Signing the check, releasing the online payment or holding the card.
- Recording. Entering the transaction in the books and reconciling the accounts.
- Reviewing. Reading the bank statements and reports afterwards, independently.
Four different people is the ideal. Two is the workable minimum: whoever records should not be able to move money alone, and whoever reviews should not do either.
Who approves
The budget is the first approval. A cost that is in the approved budget and within its line can be approved by the ministry leader or staff member responsible for that line. Anything outside the budget, or above an amount the board sets, goes to the treasurer, finance committee or board. Two rules do most of the work:
- Nobody approves a payment to themselves or to a member of their own household.
- The approval is recorded on the invoice or request, with a name and a date, before payment.
Who pays
Check signers and online payment approvers should be people who do not keep the books. Choose a dollar limit above which two people must approve a payment, and set it up where it will actually be enforced. A "two signatures required" line printed on a check only works if someone checks for it, so ask your bank whether it does. A dual-approval setting in the bank's online payment system, where one person enters a payment and a second releases it, is enforced by the system itself. Ask your bank what it offers.
- No checks signed in advance, and none made out to cash.
- Blank check stock is kept locked, by someone who is not a signer.
- Each person has their own online banking login. Shared passwords erase the record of who did what.
- Signers and logins are updated at the bank when roles change.
Who records
The bookkeeper, whether a volunteer, a staff member or an outside bookkeeper, enters transactions from documents: an approved invoice, a signed count sheet, a payroll report. The bookkeeper should not be a check signer and should have view-only access to the bank where the bank allows it. Offerings follow the same principle, with counters who are separate from the person who records the deposit; that routine is in counting and depositing offerings.
Who reviews: the bank statement goes to a non-signer
If a church adopts only one control from this guide, this is the one. Each month, a person who neither signs checks nor keeps the books receives the bank and card statements directly, by online access or straight from the bank, not as a copy passed along by the bookkeeper. Reading them takes a few minutes:
- Are there payees you do not recognize, or payments to people in money-handling roles?
- Do the check images match the payee and amount recorded in the books?
- Are there transfers, withdrawals or new electronic payees nobody mentioned?
- Does the ending balance agree with the reconciliation report the bookkeeper produced?
The reviewer initials and dates the statement, and reports to the finance committee that the review was done. Where this fits in the monthly routine is shown in the month-end checklist for church books.
Card controls
- Each card is issued in one person's name, with a limit that fits the role.
- Every charge has a receipt and a note of the ministry purpose, handed in by a set date each month.
- Someone other than the cardholder reviews the statement. The pastor's card is reviewed by a board or finance committee member, not by staff who report to the pastor.
- No personal charges, even with the intention of repaying.
- Cards are canceled the day a role ends.
Receipts, mileage and what to do about a missing receipt are covered in reimbursing church expenses.
When there are only two or three volunteers
Full separation is not always possible, and saying so is better than pretending. Substitute review for separation. If one person must both pay and record, keep the statement review with a non-signer, require a second approval above the limit, and have the board see a list of every payment made during the month. Rotating duties from time to time helps too, since a fresh person notices what a familiar one has stopped seeing. Bringing in an outside bookkeeper is another way to separate recording from approving and paying.
Put it in a written policy
One or two pages, approved by the board and recorded in the minutes, reviewed each year and whenever the treasurer changes. A working policy names roles, not individuals, and covers:
- Who may approve spending, and up to what amount
- Who may sign or release payments, and the limit above which two approvals are needed
- Who keeps the books, and what bank access that person has
- Who reviews bank and card statements, and how the review is recorded
- Card rules and the reimbursement deadline
- How conflicts of interest are handled
A written policy also answers the questions an insurer, a lender or an outside reviewer will ask. An audit or financial review is the work of an independent CPA and is outside bookkeeping. For how an outside bookkeeper fits into the separation of duties, see how we work.
