Strong controls, weak links: where charity fraud risk can emerge

The Charity Commission reminds trustees that they remain responsible for implementing and monitoring their charity’s internal financial controls, so it’s crucial that each control connects clearly with the next step. Instead of asking “Do we have a control for this?”, trustees should ask “Does this control link to the next step?”

Weaknesses often emerge at the joins: between teams, between written policy and software, and between trust and oversight, especially when no one closes the loop.

In large charities, approvals and tasks go through many people. That spreads responsibility but also creates handover points where things can fall through the cracks. As a charity finance director observed:

“When you’re a big organisation, sometimes things get lost between teams. One person thinks someone else is checking it, and that’s when fraud happens.”

In other words, a control might exist on paper (for example, requiring two approvals), but if Person A assumes that Person B will finish the process, the final check may never happen. Gaps like this often don’t show up until something goes wrong. To avoid this, clarify who owns the next check. Make sure each step has a clear owner and don’t let tasks get lost in the handover.

Good systems can strengthen controls, but problems arise when the system cannot do what the policy requires. Imagine a charity with a policy that “two people must sign off every payment.” If the finance software only allows one approval, that rule only survives on paper. One audit partner described it this way:

“So you’ve got a policy that says ‘two people sign everything,’ but the system doesn’t allow it. Now you’re relying on people to remember to forward the email. That’s where it breaks down.”

This shows that a policy is only as strong as its execution. In effect, a good rule can be subverted by an inefficient system. If a rule can’t be implemented in practice, it’s as if it doesn’t exist. Trustees and finance teams should test their systems: can the software enforce your rules, or does a workaround leave room for error?

Trust is a virtue in charities, but if it leads to fewer independent checks, it can dull vigilance. Several charity professionals described how familiarity with trusted colleagues can make people less likely to question their work. As one put it:

“You start trusting someone… and because of that, you start letting things go. It’s not malicious, it’s just complacency.”

In essence, the danger comes when trust replaces the independent checks meant to keep things honest. In practice, this means a check may become a mere formality. Even reliable volunteers or staff need an independent eye. Just because “she’s always done it right” doesn’t mean you can skip the second check. Keep double-checking, even for someone with a perfect track record.

Instead of adding more rules, charity leaders can ask:

1. Who owns the next step? After one person signs off, who double-checks their work?
2. Can our system enforce the policy? For example, if two approvals are needed, can the software actually force two or is there a manual workaround?
3. Are trusted colleagues still being checked? Or have we grown complacent because we trust those handling the work?
4. Does the entire control process work end to end? Trace a transaction through each handover, check and approval. Are all steps actually being enforced?

Fraud resilience isn’t just about having controls. It depends on whether the people, processes and technology around those controls truly reinforce each other. Only by looking at how controls connect in practice can charities be confident the overall process actually works.

Look for the gaps between your controls. That’s often where vulnerabilities hide. For trustees, the lesson is clear: don’t just add more rules. Make sure each step actually connects to the next, so controls work on paper and in practice.

• Charity Commission guide: Internal financial controls for charities (CC8)
• Charity Governance Code

* The views expressed are the author's and not ICAEW's.