Nonprofit Internal Controls in NYC: 7 Essential Policies Every Organization Needs
For NYC nonprofits, internal controls are not optional, they are a legal and regulatory expectation. The New York State Attorney General’s Charities Bureau publishes specific guidance titled “Internal Controls and Financial Accountability for Not-for-Profit Boards” and expects every registered nonprofit to have documented financial controls in place. Nonprofits with gross receipts over $250,000 that solicit charitable contributions in New York must file an annual audited financial statement with the Charities Bureau, and weak nonprofit internal controls in NYC organizations fail to maintain are the most common reason those audits produce findings. Beyond regulatory compliance, strong internal controls protect your organization from fraud, protect your staff from false accusations, and give your board the confidence to govern effectively. This guide covers the seven internal control policies every NYC nonprofit needs, and why the stakes in New York are higher than in most states.
What Are Nonprofit Internal Controls in NYC and Why Does the Attorney General Require Them?
Internal controls are the documented policies, procedures, and systems that protect an organization’s assets, ensure accurate financial reporting, and support compliance with applicable regulations. In plain language, they are the rules that prevent one person from having unchecked control over your organization’s money.
In New York State, these are not optional best practices. The New York State Attorney General’s Charities Bureau specifically publishes guidance on nonprofit internal controls in NYC and expects organizations to have these systems formally documented and operational. The AG’s publication Internal Controls and Financial Accountability for Not-for-Profit Boards covers written job descriptions, segregation of duties, approval protocols, bank reconciliation procedures, procurement policies, and document retention, all of which ASNY incorporates into the control frameworks we build for NYC nonprofits and charter schools.
Nonprofits with gross receipts over $250,000 that solicit charitable contributions in New York must register with the AG’s Charities Bureau and file an annual CHAR500 form with an audited financial statement. Weak nonprofit internal controls in NYC are the most common audit finding, and the most common reason organizations face AG scrutiny. Understanding what the AG requires is the first step toward building controls that actually protect your organization.
7 Essential Nonprofit Internal Controls in NYC Every Organization Needs
These are the seven policies the NY Attorney General’s guidance addresses and that every NYC nonprofit must have formally documented and operational, not aspirationally, but in practice every single month.
1. Segregation of duties.
This is the single most important of all nonprofit internal controls in NYC your organization can implement. No one person should control all aspects of a financial transaction, authorization, recordkeeping, and custody of assets must be handled by different people. The person who approves an expense should never be the same person who processes the payment. The person who receives funds should never be the same person who records the deposit. For small NYC nonprofits with limited staff where full segregation is not structurally possible, compensating controls apply, enhanced management review, board treasurer oversight, and secondary approval requirements substitute for full segregation and satisfy auditor expectations when documented correctly.
2. Written approval protocols for all expenditures.
Every expense your organization incurs must follow a documented approval process with clear spending limits by role. An executive director should not be able to authorize and process their own expenses, this creates both a fraud risk and an audit finding. Your written approval policy must specify who can approve expenditures at each dollar threshold, what documentation is required at each level, and what happens when the standard approver is unavailable. This policy must be in writing, signed off by the board, and applied consistently, verbal approval protocols are not sufficient for audit purposes.
3. Monthly bank reconciliations.
All bank and credit card accounts must be reconciled monthly, and the person performing the reconciliation must not be the same person who processes payments or has custody of funds. Reconciliations must be reviewed and signed off by a supervisor or board treasurer within a defined timeframe. Unreconciled accounts are among the most common findings in NYC nonprofit audits and the most common environment in which small frauds go undetected for extended periods. Monthly reconciliation is not a bookkeeping nicety, it is a fundamental financial control that your auditor will test every year.
4. ACH and electronic payment controls.
ACH fraud has grown significantly in recent years, according to the 2025 AFP Payments Fraud and Control Survey, 79% of organizations were victims of payment fraud attacks or attempts in 2024. For NYC nonprofits in 2026, electronic payment fraud is now one of the most urgent internal control risks in the sector. New NACHA fraud monitoring rules require all organizations sending ACH payments to have documented, risk-based processes and procedures in place to identify potential fraudulent transactions, with Phase 2 compliance required by June 19, 2026. At minimum your organization must ensure the person who initiates electronic payments is never the same person who approves them, multi-factor authentication is enabled on all banking portals, and any request to change vendor payment details follows a verified, documented approval process before funds move.
5. Grant fund tracking and restricted fund controls.
Every restricted grant must be tracked separately with its own expenditure code, budget line, and reporting calendar. Spending restricted funds on general operations, even temporarily, even with the intention to reimburse, creates a repayment obligation and a compliance finding. This is the most common grant compliance for nonprofits failure ASNY sees across NYC, and it is entirely preventable with proper fund accounting controls from day one. Given current federal funding uncertainty in 2026, funders and auditors are scrutinising restricted fund management more closely than at any point in recent memory, making this control more critical than ever for NYC nonprofits managing multiple grant sources.
6. Document retention policy.
The IRS requires nonprofits to retain financial records for a minimum of three years. Federal grant records must be kept for three years after submission of the final expenditure report for that award and grants involving real property or equipment carry longer retention requirements. New York State has additional document retention obligations that apply to Charities Bureau registrants. Your written document retention policy must specify which records are kept, in what format, for how long, and who is responsible for maintaining them. An outsourced CFO or controller typically builds and maintains this policy as part of a broader internal control engagement, ensuring it is updated when regulatory requirements change rather than remaining static for years.
7. Annual internal control review.
Internal controls must be reviewed and formally updated annually, not only when an audit is approaching. The board’s finance or audit committee should conduct this review and formally sign off on the results each year. The review should assess whether existing controls are operating as documented, whether any control gaps have emerged from staff changes or system upgrades, and whether regulatory changes require policy updates. For organizations without an active finance committee, an outsourced CFO or controller can conduct this review as part of their annual engagement and present findings directly to the board, giving smaller NYC nonprofits access to the same governance infrastructure as larger organizations.

Nonprofit Internal Controls in NYC for Small Organizations- What to Do When You’re Understaffed
The most common objection ASNY hears from small nonprofit leaders when nonprofit internal controls in NYC are discussed: “We only have two people in finance, how do we segregate duties?” It is a fair question and a genuine operational constraint. The answer is not to abandon segregation, it is to implement compensating controls that achieve the same protective effect with limited staff.
Board treasurer review. Board members can serve as a second set of eyes on bank statements, reconciliations, and expenditure reports without being operationally involved in day-to-day finances. A board treasurer who reviews and signs off on monthly reconciliations provides meaningful oversight that compensates for limited internal staffing, and satisfies the AG’s Charities Bureau expectations for small organizations.
Technology controls. Modern accounting software, QuickBooks Online, Sage Intacct, Xero, includes audit trails, user permission levels, and automated approval workflows that enforce control requirements without requiring additional headcount. Setting up your software so that only authorized users can approve payments, access certain accounts, or modify posted transactions is itself a documented internal control.
Outsourced accounting. Many small NYC nonprofits use outsourced bookkeepers or CFO services specifically because it creates automatic segregation of duties between internal staff and external accountants. When ASNY manages your books, the person inside your organization who handles cash never has unsupervised access to the accounting records, a structural control that satisfies auditor requirements and protects your staff from unwarranted suspicion. Building strong nonprofit internal controls in NYC does not require a large internal team, it requires the right structure, documented correctly from the start.
What Happens When NYC Nonprofits Have Weak Internal Controls?
Three real consequences, not abstract risks:
Audit findings. Weak internal controls are the most common finding in nonprofit audits across New York. A finding does not just look bad on paper, it triggers funder scrutiny, requires a corrective action plan submitted to your authoriser or the AG’s Charities Bureau, and in repeated cases jeopardises grant eligibility entirely. Strong nonprofit audit preparation starts with internal controls in place, not with the weeks immediately before fieldwork begins when it is already too late to fix structural gaps.
NY Attorney General scrutiny. NYC nonprofits registered with the AG’s Charities Bureau that receive complaints or show audit irregularities can face AG investigations. The AG has the authority to compel document production, interview board members and staff, require corrective governance actions, and in serious cases pursue legal action against individual board members for breach of fiduciary duty. Board members of NYC nonprofits carry personal liability for financial governance failures, a reality most board members do not fully appreciate until it becomes directly relevant to them.
Fraud exposure. According to the 2024 ACFE Report, 10% of all occupational fraud cases occur within nonprofits, with a median loss of $76,000. For religious, charitable, and social service organizations the median loss rises to $85,000. For a nonprofit operating on a $1M budget, an $85,000 fraud event is not an inconvenience, it is an existential threat to the organization and the community it serves. The same research confirms that organizations without proper internal controls experience fraud losses two to three times higher than those with controls in place. Strong nonprofit internal controls in NYC are not bureaucracy, they are the primary financial defence between your mission and the events that end organizations permanently.

Strong internal controls are the foundation of the financial credibility that lets NYC nonprofits attract funding, pass audits, and govern effectively. For organizations that have never formally documented their internal control policies, the process is less overwhelming than it appears, but it does require expert guidance to do correctly the first time. ASNY helps NYC nonprofits and charter schools build, document, and maintain nonprofit internal controls in NYC as part of our outsourced accounting and CFO services, giving your organization the compliance infrastructure it needs without building an internal finance department to maintain it. Book a free financial assessment to find out where your controls stand today.
Frequently asked questions about nonprofit internal controls in NYC
Q1: What are nonprofit internal controls in NYC?
Nonprofit internal controls in NYC are the documented policies, procedures, and systems that protect an organization’s financial assets, ensure accurate reporting, and support compliance with New York State regulations. The NY Attorney General’s Charities Bureau specifically requires nonprofits with gross receipts over $250,000 to maintain documented internal controls and file an annual audited financial statement, making these controls a legal obligation, not just a best practice.
Q2: Does the NY Attorney General require nonprofit internal controls?
Yes. The New York State Attorney General’s Charities Bureau publishes specific guidance titled “Internal Controls and Financial Accountability for Not-for-Profit Boards” and expects all registered nonprofits to have these systems formally documented and operational. Nonprofits with gross receipts over $250,000 that solicit charitable contributions in New York must register with the Charities Bureau and file an annual CHAR500 form with an audited financial statement. Weak internal controls are the most common reason those audits produce findings.
Q3: What is segregation of duties for nonprofits?
Segregation of duties means no single person controls all aspects of a financial transaction. Authorization, recordkeeping, and custody of assets must be handled by different people. For example the person who approves an expense should never be the same person who processes the payment. For small NYC nonprofits with limited staff, compensating controls, board treasurer review, enhanced management oversight, and technology-based approval workflows, substitute for full segregation and satisfy auditor requirements when properly documented.
Q4: What are ACH fraud controls nonprofits need in 2026?
Under new NACHA fraud monitoring rules effective June 19, 2026, all organizations sending ACH payments must have documented, risk-based processes to identify potential fraudulent transactions. For NYC nonprofits this means the person initiating electronic payments must never be the same person approving them, multi-factor authentication must be enabled on all banking portals, and any request to change vendor payment details must follow a verified documented approval process before funds are released. According to the 2025 AFP Payments Fraud and Control Survey, 79% of organizations experienced payment fraud attempts in 2024.
Q5: How long must NYC nonprofits retain financial records?
The IRS requires nonprofits to retain financial records for a minimum of three years. Federal grant records must be retained for three years after submission of the final expenditure report. Grants involving real property or equipment carry longer retention requirements. New York State has additional retention obligations for Charities Bureau registrants. A written document retention policy specifying which records are kept, in what format, for how long, and who is responsible must be formally documented and board-approved.
Q6: What happens if a NYC nonprofit has weak internal controls?
Weak nonprofit internal controls in NYC produce three real consequences. First, audit findings, the most common finding in NYC nonprofit audits, triggering corrective action plans and funder scrutiny. Second, NY Attorney General scrutiny, the AG can compel document production, interview board members, and pursue legal action against individual directors for breach of fiduciary duty. Third, fraud exposure, according to the 2024 ACFE Report, nonprofits with weak controls experience fraud losses two to three times higher than those with controls in place, with a median loss of $85,000.
Q7: How can small NYC nonprofits implement internal controls with limited staff?
Small NYC nonprofits with limited finance staff can implement compensating controls that satisfy auditor requirements without additional headcount. These include board treasurer review of monthly bank reconciliations and expenditure reports, technology controls using accounting software with audit trails and user permission levels, and outsourced accounting which creates automatic segregation of duties between internal staff and external accountants. When ASNY manages a nonprofit’s books, the person handling cash internally never has unsupervised access to the accounting records, a structural control that protects both the organization and its staff.
Q8: How often should NYC nonprofits review their internal controls?
Nonprofit internal controls in NYC should be reviewed and formally updated annually, not only when an audit is approaching. The board’s finance or audit committee should conduct the review and sign off on results each year. The review should assess whether controls are operating as documented, whether staff changes or system upgrades have created gaps, and whether regulatory changes require policy updates. Organizations without an active finance committee can engage an outsourced CFO or controller to conduct this review and present findings directly to the board.

