Many NPOs Are Vulnerable to Payment Fraud

Wednesday, 27 June, 2018 – 15:31

In this financial risk alert, CMDS shares some insights that may help you to reduce the risk of such fraud happening in your organisation

Who releases your internet banking payments (EFT’s)?

We still find that many nonprofit organisations (NPOs) have only one person releasing Electronic Funds Transfer (EFT) payments through their Internet banking system and yet they still require two signatories on their cheques. Making payment by EFT is no different to making payment by cheque and so requires the same level of control. Even though the releaser (authoriser) of an EFT may be highly trusted, a single releaser has the opportunity to clear out the contents of the organisation’s bank account with the click of a mouse, either in error or intentionally.

Also, a single releaser could be vulnerable to accusations of theft in an environment in which the accounting system lacks a full trail of supporting documentary evidence and/or in which even an error could be interpreted as an attempt to defraud the organisation. On the other hand, the control environment (particularly the separation of duties) should reduce or eliminate the opportunity for the accounting records to be manipulated to hide misappropriation of funds.

Organisations that have only one releaser often state confidently “but our paperwork (payment requisitions and/or invoices) is approved by two people.” Unless the paperwork is a cheque, the amount that is actually paid could be a totally different amount, to a totally different party, than is stated on the ‘supporting documentation’.

Payments are one of the greatest risk areas in every NPO. However, a significant reduction in risk is achieved by having two EFT internet releasers (the same level of control as two signatories for a cheque payment). Both should independently check and release each payment against properly authorised supporting documents. Most importantly, the person primarily responsible for the financial recordkeeping should not also manage/authorise payments.

There is a cost to this important control. 

Electronic banking that leaves control in the hands of one individual is relatively inexpensive; however, in order to implement the control of having two separate releasers for all EFT’s,  NPOs will need  electronic banking for businesses, which is more expensive, pushing up the cost of operations, so please don’t forget to budget for this cost. 
 

  • This article was submitted and first published in the CMDS website.

Photo Courtesy:

NGO Services

NGO Services