Internal controls assessment & design for nonprofits.
Controls designed to withstand the testing standards auditors apply.
18+
years of nonprofit-exclusive practice
500+
nonprofit clients served
60+
nonprofit professionals
95%+
client retention rate
Controls matched to your actual team.
We assess your organization’s financial processes against segregation-of-duties principles and the COSO framework, then design practical controls matched to your actual staffing level. Where full segregation is not feasible with a small finance team, we build compensating controls that reduce risk without requiring headcount you do not have.
Why small staff can create structural control risk.
Segregation of duties, the principle that no single person should control an entire financial transaction from initiation to reconciliation, is a basic control every finance textbook recommends. It is also a genuinely difficult standard for a nonprofit with two or three finance staff to meet in practice. When one person can both approve an expense and reconcile the account it is charged to, the organization carries a structural vulnerability regardless of that individual’s integrity.
The most common fraud vectors at nonprofits exploit exactly this gap: check tampering, expense reimbursement fraud, unauthorized vendor payments. When an audit finds a control weakness, the finding costs more than the dollar amount involved. It becomes a documented item in the management letter that funders and board members can see, eroding confidence in financial stewardship well beyond the specific incident.
Control gap assessment.
A structured review of your current financial processes against segregation-of-duties principles and the COSO framework’s five components of internal control. We evaluate how transactions actually move through the organization, including the informal workarounds staff use when the written process does not fit real workflows.
Segregation of duties redesign.
Practical redesign options for organizations too small to fully separate every financial function. Compensating controls that reduce risk without requiring headcount you do not have: board treasurer review of bank statements, dual authorization for payments above a threshold, independent reconciliation of key accounts.
Policy documentation.
Written financial policies and procedures that make controls repeatable and enforceable across staff transitions. Documentation that reflects how the organization actually operates, not an aspirational manual that sits unused because it describes processes nobody follows.
COSO-aligned framework implementation.
Control design mapped to the COSO framework’s five components: control environment, risk assessment, control activities, information and communication, and monitoring. This structure gives your audit committee and your auditor a shared language for evaluating whether controls are adequate and operating as intended.
How we assess & implement controls.
01
Control walkthrough.
We observe your financial processes as they actually run. How transactions move from initiation to reconciliation, including the workarounds that have become routine.
02
Gap identification.
We identify specific control weaknesses, prioritized by fraud risk severity rather than presented as an undifferentiated list. The highest-risk gaps are addressed first.
03
Remediation plan.
We design practical fixes that match your actual staffing level: compensating controls where full segregation is not feasible, policy changes where it is.
04
Implementation support.
We help implement the plan directly rather than handing over a report and leaving execution to an already-stretched team, then check back after the first close cycle to confirm the new controls are working as designed.
Built with an auditor’s perspective.
Han Group’s internal controls work draws on the firm’s nonprofit audit practice. We design controls with a working knowledge of how auditors test them, which prevents a common problem: organizations that redesign controls based on one consultant’s recommendation, then discover during audit fieldwork that the auditor tests against a different standard.
The practical result is fewer management letter comments and a smoother audit testing process. Controls are built with the testing methodology already in mind, well ahead of any audit finding.
Related services.
Compliance & governance.
Structured support for your board’s fiduciary role: audit committee design, financial literacy programming, and governance policy alignment.
Accounting & reporting.
Monthly close, donor-restriction tracking, and board-ready financial reporting built into the operating rhythm of your organization.
Financial audits.
Independent financial statement audits tailored to your organization’s structure, reporting requirements, and stakeholder needs.
Grant & compliance audits.
Single Audits under Uniform Guidance, program-specific audits, and other grant and compliance audits, from determining the applicable audit requirements through testing and final reporting.
Close the control gaps before your auditor finds them.
If your organization’s internal controls have not been formally assessed, or if a recent audit identified weaknesses you need to address, a partner is ready to scope an assessment matched to your actual size and staffing.