Internal controls, fraud and audit

1Internal controls

• Segregation of duties: the person who requests, the one who approves, the one who pays and the one who records are different people.
• Written delegations of authority: who can approve what and up to what amount.
• Physical controls: safe, keys, access to software with personal passwords.
• Independent checks: surprise cash counts, reviews by headquarters, verification visits.
• Asset management: an asset register (computers, vehicles, generators) with tags, an annual inventory, and transfer rules at the end of the project.

2Preventing and dealing with fraud

Common forms: false invoices, overbilling, ghost employees, double funding of the same expense by two donors, aid diversion, collusion with suppliers, abuse of advances.

• Red flags: invoices without numbers or from suppliers who cannot be traced, abnormally high prices, repeated round figures, refusal to take leave, “lost” documents.
• Zero tolerance: any suspicion is reported through the designated channels (focal point, whistleblowing line), without investigating alone or alerting the person suspected.
• Most donors require prompt notification of suspected fraud involving their funds; the contract specifies the deadline.
• Screening of partners, suppliers and employees against sanctions lists (UN, European Union and national lists, depending on donor requirements).

3Audit and capacity assessment

• Project audit: an external auditor checks that the expenditure reported is real, eligible and justified, and that procedures have been followed.
• Prepare from day one: documents filed by budget line and by month, reconciliations done, complete procurement files, timesheets for staff charged to the project.
• Disallowed costs (ineligible) must be refunded to the donor from the organisation's own funds: a real risk for a national NGO.
• Donor and pooled fund capacity assessments (due diligence) (for example the HACT approach for certain UN agencies): statutes, governance, audited financial statements, procedures manual, policies (fraud, PSEA, safeguarding); their outcome often determines the risk level and the funding modalities.
• After the audit: an action plan for each recommendation, with an owner and a deadline.