Compliance, internal control, fraud and audit

1Internal control: principles and architecture

The COSO framework (2013) defines internal control as a process that provides reasonable assurance on three objectives: effective operations, reliable financial information, and compliance with laws and contracts. It rests on five components: control environment (tone at the top, ethics, competence), risk assessment, control activities, information and communication, monitoring.

The Institute of Internal Auditors' three lines model (2020) divides the roles: the first line (operations: programmes, logistics, field finance) manages risks day to day; the second line (compliance, risk management, financial control) sets the rules and checks them; the third line (internal audit) provides independent assurance to the board.

Key controls for a field-based NGO:

• Segregation of duties: the person who requests a purchase is not the one who approves it, receives the goods or pays.
• A written delegation of authority, with signature thresholds by amount and by type of expenditure.
• Monthly bank reconciliations signed by someone who handles neither cash nor the bank.
• Surprise cash counts, physical inventories and stock control.
• Verification of beneficiaries and payment lists, preferably by a team independent from targeting.

In a small base, full segregation is impossible. Compensate with detective controls: monthly review of supporting documents by the next level up, job rotation, surprise remote checks.

2Understanding fraud: triangle, schemes and red flags

The fraud triangle (Cressey) combines three conditions: pressure (debts, family pressure, unrealistic targets), opportunity (weak controls) and rationalisation ("I'm underpaid", "everyone does it"). Management acts mainly on opportunity, but also on rationalisation through culture and example.

The most frequent schemes in humanitarian work:

Aid diversion by armed groups or authorities (taxation at checkpoints, imposed lists, levies on beneficiaries) is a major risk in conflicts. It is managed through risk analysis, independent verification, suspension where necessary, and coordination with other organisations so as not to give in separately.

3Handling a suspicion: reporting, investigation and sanctions

An anti-fraud policy must provide for: several reporting channels (including one outside the line management and anonymous), protection of whistleblowers against retaliation, a rule of zero tolerance for inaction (every credible suspicion is handled), and the obligation to notify donors within contractual deadlines, often very short (for example within a few working days of becoming aware of a credible suspicion).

Steps of an internal investigation:

1. Initial assessment: is the report credible and within the scope of the policy? Who must be informed? Is there a risk to anyone's safety?
2. Preserving evidence: copying data, securing documents, suspending access if necessary, without alerting the person implicated.
3. Investigation by trained people, independent from the line management concerned, with an investigation plan, interviews with witnesses, then with the person implicated, who has the right to respond.
4. Report based on facts, with an explicit standard of proof (in disciplinary matters, generally the balance of probabilities).
5. Decisions: disciplinary sanctions, recovery of losses, reporting to the authorities if the law requires it or if appropriate, and above all fixing the control weaknesses.

Serious mistake: entrusting the investigation to the suspected person's direct manager, or starting interviews before securing the evidence. The first compromises independence; the second makes documents disappear.

4Donor audits and ineligible costs

A project audit checks that the expenditure declared is real, eligible (provided for in the budget, incurred during the period, compliant with the rules), justified by supporting evidence, recorded in the accounts and compliant with procurement and visibility rules. Any expenditure that does not meet these conditions becomes an ineligible cost that the organisation must repay from its own funds.

The most frequent causes of ineligible costs: procurement procedure not followed (number of quotations, advertising, thresholds), missing or non-original documents, expenditure outside the period, unjustified allocation keys, wrongly calculated exchange differences, and assets that cannot be found in the inventory.

Preparing for an audit in six points: a file per contract with all the documents in the order of the procedure; reconciliation between the financial report and the general ledger; a list of staff charged with contracts, timesheets and payslips; an inventory of tagged assets; a register of exchange differences; a note explaining the allocation keys.

Worked example. An auditor tests a sample of USD 120,000 of expenditure out of a total declared of USD 1,000,000 and finds USD 9,000 of errors (7.5%). Depending on the agreed method, some auditors extrapolate this rate to the whole population: USD 75,000 of potentially ineligible costs. A systematic error, such as an allocation key, therefore costs far more than its amount in the sample.

5Sanctions, counter-terrorism and partner vetting

NGOs working in areas controlled by designated groups must comply with sanctions regimes (UN Security Council, European Union, United States, United Kingdom) and with the counter-terrorism clauses in their contracts. These clauses prohibit making funds or resources available to listed persons or entities, directly or indirectly.

Security Council resolution 2664 (2022) introduced a cross-cutting humanitarian exemption to UN asset-freeze regimes for humanitarian assistance and activities that support basic human needs, and several jurisdictions have adopted comparable exemptions. But these exemptions do not remove the need for due diligence or the donors' contractual clauses.

Due diligence includes: screening partners, suppliers and key staff against sanctions lists before contracting and periodically, a diversion risk analysis, controls on payments (no cash payments to unvetted intermediaries), and a written policy for managing the contacts with armed groups that are necessary for access.

Ethical point of attention: according to most donors and sector positions, screening does not apply to beneficiaries, because aid is based on need. Screening beneficiaries against lists would violate the principle of impartiality; in case of contractual doubt, the question must be settled in writing with the donor.