Nonprofit Resources
Should Your Church Consider an Internal Audit?
There are several reasons why a church may perform an internal audit. For some churches, it is required by their constituents or denomination. Others may opt for an internal audit because they don’t have the resources or need for an external audit.
Whether or not your church is required to perform an internal audit, it’s worth considering the potential benefits. Below we explain who and what an internal audit should involve, when to perform one, and how to report the results. These guidelines will help make the process efficient and effective for your church.
Objectives and Scope of an Internal Audit
An internal audit can benefit your church regardless of whether you have an external financial statement audit.
There are many reasons why a church may undergo an external audit, such as to meet the requirements of its loan covenants, Evangelical Council for Financial Accountability (ECFA) accreditation, or denomination or board oversight. Independent external auditors focus on the major areas of revenues and expenses in their risk assessment of the church and test these areas extensively during the financial statement audit. These areas include:
- Contributions
- Program service revenues (registration or event revenue)
- Payroll
- Non-payroll cash disbursements
Risk identification and assessment are key governing board duties. While an external audit fulfills some of these fiduciary responsibilities, it does not accomplish all of them.
An effective internal audit function will provide insight into your church’s ongoing risk assessment process and the internal control framework over transaction classes. An internal audit does not need to be time-consuming or expensive.
Determining Who Should Perform Your Internal Audit
It may be tempting to go with the first person who volunteers to perform your internal audit, but this may not always be the best choice. Although you may be able to obtain internal audit checklists and tools from the American Institute of Certified Public Accountants (AICPA), your denomination, or your external auditor, the person performing your internal audit must understand the financial data and process well enough to spot any potential issues and ask the right questions.
You should choose someone who:
- Is impartial – The individual selected should not be involved in the church’s finances. They also should not be related to anyone on the church’s management or accounting team. This will help avoid any perception of bias.
- Understands accounting – An understanding of accounting, particularly nonprofit accounting, will help the individual comprehend and perform each step of the internal audit correctly. An independent auditor with this insight will also be more adept at recognizing and understanding any problems or issues encountered.
- Has the time – It’s important to choose someone who has the availability to start and finish the audit in a timely manner. Be upfront and make sure the person selected understands that the project requires a time commitment.
The internal auditor’s role is to:
- Understand the design and implementation of controls
- Help the church’s board and management understand the risks of transaction classes
- Provide monitoring throughout the fiscal year
- Report directly to the finance committee or board
This individual should be collaborative and have a working relationship with the areas monitored. In addition to working with the board to provide an independent risk assessment, an internal auditor should offer insight and identify areas for improvement. The goal is for the internal auditor to help improve the church, not play “gotcha.”
Board Oversight
The board’s role is to enhance and support the internal audit function, which serves as the board’s “eyes and ears” on the church’s ability to meet its financial and compliance responsibilities.
The board should also ensure that the church adjusts its internal controls and practices as necessary. This is often done through a board sub-committee, such as a finance committee, that oversees the internal audit function and reports back to the entire board.
This sub-committee should:
- Work with management to develop the annual internal audit plan
- Review the annual internal audit plan with management before acceptance by the sub-committee
- Make requests for reviews or special investigations that are not part of the approved annual internal audit part
- Ensure external auditors are consulted if the internal audit findings warrant their involvement
Planning and Performing Your Internal Audit
To create an effective internal audit plan for your church, combine an assessment of department-level risks across the church with a projection of available audit resources to determine the most effective schedule of internal audit activities for the year.
Your internal audit plan should:
- Outline the objectives for the internal audit
- Determine the areas and amount of department-level risk
- Forecast the number of hours needed to accomplish the objectives
- Incorporate and apply the Internal Control-Integrated Framework from the Committee of Sponsoring Organizations of the Treadway Commission (COSO)
- Specify that results will be reported to the board or finance committee, or both, and the date or frequency of those reports
The following outlines the procedures that should be performed during the church’s internal audit:
1. Acquire general information by:
- Examining board meeting minutes for financial implications such as purchases of significant fixed assets or loan approvals
- Reviewing loan documents and other contracts the church has entered
- Obtaining a trial balance
2. Conduct summarized account testing, which should include, but is not limited to, the following areas and steps:
- Cash – Review bank statements and reconciliations.
- Receivables – Ensure that any detailed ledgers are reconciled to the general ledger and that any amounts owed to your church exist and ultimately are collected.
- Fixed assets – Verify that capitalizable amounts have been recorded correctly and depreciated as necessary.
- Payables – Verify that amounts owed to employees, banks, and vendors are current and recorded in your financial records.
- Net assets – Determine whether any donor-restricted amounts have been recorded and restrictions released correctly.
- Income and expenses – Compare amounts for the current year with prior-year amounts and review any significant fluctuations. It is often helpful to also compare current-year amounts with budgeted amounts.
Internal Control Assessment
It is also important for your internal audit to assess the effectiveness of your church’s internal controls. Internal controls are like “brakes” for a church. The brakes on a vehicle enable it to stop when necessary, even when traveling at high speeds. Without them, drivers would need to creep along slowly to avoid accidents. Likewise, effective internal controls can allow your church to operate quickly and effectively while ensuring you stop and address potential issues when necessary.
And just as the brakes on a vehicle should be checked and maintained by an experienced mechanic, an internal auditor should periodically review and “tune-up” your church’s controls to make sure they are operating as intended.
Frequency of Testing
The frequency of departmental internal audit testing should be based on the related risk assessment as follows:
| Risk Area | Frequency of Testing |
|---|---|
| Low | Discretionary |
| Moderate | Higher frequency |
| High | Highest frequency (no more than X years) |
| Areas with known issues | Immediate |
Reporting the Results
The key benefit of an internal audit is the information it yields. A report should be prepared at the end of the audit cycle. If you have several different audiences, it may be beneficial to prepare multiple reports, each with a level of detail appropriate for the intended audience.
Examples include:
- A report to the congregation on whether the church’s financial information is correct and whether any significant issues or concerns were discovered
- A detailed report to the governing board with specific data, information on any discrepancies, and any suggestions from the internal auditor
- A report for management that is less formal than the board report, but provides the specific and detailed information the management team needs to help the board assess and apply any suggestions
Determining Whether You Need Outside Help
Simple requirements and reports may be sufficient for many churches. If your church is engaged in accounts and activities such as pension liabilities, trusts and annuities, for-profit activities, or other unique activities or investments, however, an internal audit is likely to be too complex for a volunteer and you should consider engaging an accountant.
Next Steps
It’s crucial to follow up on prior internal and external audit findings. This is another way to provide future coverage without investing significant resources. It also allows your internal audit function to monitor and uphold a presence in areas that may not make it into the current audit plan and evaluate current-year changes that have been implemented.
The internal audit can assess a department’s response to the internal audit findings through brief conversations and check-ins with the department’s management. Does management resolve issues promptly and with practical long-term solutions, or are they repeatedly making the same mistakes and applying temporary fixes? Evaluating this can also provide insight into other potential risks within the department.
With the right planning and support, ongoing internal audits can help your church identify and address risks, safeguard resources, and uphold financial integrity. These audits can provide critical insights and strategic recommendations that help your church enhance operational effectiveness, prevent issues, and improve overall governance while remaining accountable and transparent to the church’s attendees, employees, and donors.
In short, not every church needs an external audit, but every church would benefit from an internal audit process.
Please contact us with any questions.
Authors: Nathan B. Davis, Partner and Mark R. Yoder, Partner