Audits and internal control: prepare, prevent, detect

1The different audits of an NGO

An NGO that manages donor funds lives to the rhythm of several audits, which have neither the same purpose nor the same audience:

• Statutory audit (or legal audit): an external auditor certifies the organisation's annual financial statements. The opinion covers the whole, not each project.
• Project audit: required by the grant agreement (often above a threshold, for example 100,000 or 500,000 USD), it covers the project's financial report and the eligibility of expenditure.
• Expenditure verification: agreed-upon procedures on a sample of transactions; the verifier does not give an opinion but reports findings.
• Donor audit or on-site check: carried out by the donor itself or a firm it appoints, sometimes at short notice.
• Internal audit: a function of the organisation that assesses its own processes and reports to the board or audit committee.

The possible opinions of an external auditor: unqualified (the accounts give a true and fair view), qualified (except for a specific point), adverse (the accounts are not reliable) or disclaimer of opinion (insufficient evidence). A qualified opinion on a project almost always results in costs being declared ineligible.

2Preparing for a project audit

An audit is won during the life of the project, not in the week the auditors arrive. Preparation follows a stable checklist:

• Project general ledger reconciled with the financial report submitted: every figure in the report must be traceable in the accounts.
• File of supporting documents for each transaction: request, authorisation, competitive bidding, purchase order, delivery or goods received note, invoice, proof of payment, and for distributions, the signed lists.
• Staff: contracts, signed timesheets, payslips, proof of payment of social charges and taxes withheld.
• Signed monthly bank reconciliations, cash count records, calculation of exchange gains and losses.
• Equipment: fixed asset register, tags, evidence of physical inventory.
• Correspondence with the donor: approvals of reallocations, extensions, waivers of origin rules.
• Follow-up of previous audits: action plan and evidence of implementation.

Auditor sampling. On a project of 2,000 transactions, the auditor often tests 60 to 120, focusing on large amounts, cash payments, period-ends and unusual suppliers. If 3 transactions in the sample, totalling 18,000 USD, have no supporting documents, the auditor may extrapolate the error to the whole population: an error rate of 2% on 1.5 million of expenditure represents 30,000 USD potentially ineligible.

Rule of thumb: a file that cannot be understood by an outsider without oral explanation is not an audit file.

3Financial internal control

Internal control is the set of rules and practices that give reasonable assurance that transactions are authorised and correctly recorded, and that assets are protected. The COSO framework distinguishes five components: control environment (the tone set by management), risk assessment, control activities, information and communication, monitoring.

The key control activities in finance:

• Segregation of duties: the person who requests, the one who approves, the one who pays and the one who records and reconciles are not the same. In a small office, where this is impossible, a compensating control (monthly review by the director, dual signature) is required.
• Delegation of authority matrix: who can commit what amount, by type of expenditure.
• Reconciliations: bank, cash, staff advances, supplier accounts, inter-office accounts.
• Access controls: rights in the accounting software, safe, bank signatories, online banking passwords.
• Analytical review: comparing expenditure month on month and between offices to spot anything abnormal.

Matrix example. A field office of 4 people: the logistician requests, the head of office approves up to 2,000 USD, the accountant pays and records. Weakness: the accountant also holds the cash and does the reconciliation. Compensating control: a monthly surprise cash count by the head of office and a review of the reconciliation by the finance team in the capital.

4Financial fraud: common schemes

The "fraud triangle" (Cressey) brings together three elements: pressure (debt, family, social pressure), opportunity (weak control) and rationalisation ("I'm underpaid", "everyone does it"). The organisation acts mainly on opportunity.

The most common schemes in the sector:

• Fictitious suppliers or collusion between suppliers (cover bids, quotations written by the same hand, same addresses or phone numbers).
• Kickbacks: the supplier overcharges and pays a share back to the buyer.
• Ghost employees or fictitious day labourers on payment lists.
• False expense claims, per diems for missions not carried out, fuel claimed for vehicles that were off the road.
• Cash theft concealed by fabricated documents or by postponing reconciliations.
• Fictitious beneficiaries or duplicates in distributions and cash transfers.

Red flags: late reconciliations, photocopied rather than original documents, amounts just below the approval threshold (1,990 USD for a 2,000 threshold), suppliers who always win, an employee who refuses to take leave, rising expenditure without rising activity, consecutively numbered invoices for the same customer.

5Data analysis and Benford's law

Simple data analysis tools detect many anomalies: searching for duplicates (same amount, same supplier, same date), weekend payments, suppliers whose bank account is that of an employee, and split orders.

Benford's law describes the expected frequency of the first digit in many series of naturally occurring amounts: 1 appears about 30.1% of the time, 2 about 17.6%, and 9 only 4.6%. Formula: P(d) = log10(1 + 1/d). A marked deviation (for example too many amounts starting with 4 or 9 in expense claims) does not prove fraud, but it guides testing.

Split purchasing example. Tender threshold at 5,000 USD. Over a month, the same supplier receives four purchase orders of 4,800, 4,900, 4,750 and 4,950 USD for the same item, a few days apart: a total of 19,400 USD. The purchase should have been formally put out to competition. Even without fraud, the expenditure is at risk of being ineligible for non-compliance with procurement rules.

An anomaly is a question, not an accusation. Document it, check it, then pass it on through the designated channel.

6Responding to suspected fraud

The course of action is set by the organisation's anti-fraud policy and by donor contracts, almost all of which require prompt reporting (often within 48 to 72 hours or "as soon as known") of any suspected fraud or misappropriation of their funds.

• Do not investigate alone or confront the suspected person: you risk destroying evidence and compromising the procedure.
• Report through the designated channel (whistleblowing line, compliance officer, management), with protection for the whistleblower.
• Preserve the evidence: copies of files, blocking of access, safekeeping of original documents.
• Investigation carried out by a designated team, independent of the line management concerned.
• Inform the donor within the contractual deadlines, then send the final report and the measures taken.
• Recover funds where possible, and repay the donor the share lost, often from the organisation's own funds.
• Fix the control that failed: this is the most useful part of the case.

The cost of fraud goes beyond the amount misappropriated: repayment, investigation time, reputation, and sometimes suspension of funding. That is why donors assess an organisation on its ability to detect and report, not on the apparent absence of fraud.