How to prepare for a nonprofit audit: what audit-ready teams do all year

Some finance teams spend three weeks before an audit assembling evidence. Others export it. What actually separates them?

In most cases, it's not size nor effort. The teams that find audits straightforward are usually not working harder than the teams that dread them.

They are working at a different point in the process.

A team that reconstructs its evidence afterwards does the same work twice: once when the money moved, and again months later, from memory and email, under time pressure. A team that captures the evidence as the money moves does it once and never revisits it.

That is the whole difference, and everything below is a version of it.

Why audit preparation usually goes wrong

Most organizations treat audit preparation as a season. Work builds up, someone blocks out a fortnight, and the finance function goes quiet on everything else until it is done.

The strongest teams have no such season, because there is nothing to prepare. The evidence an auditor asks for is a byproduct of how they approved money months earlier.

This changes what a checklist is for. You are not hunting for things to fix before the audit. You are looking for points in your process where evidence gets created later than it needs to be, which is where nonprofit internal controls either hold or fail.

Six of those points come up more than any others.

Record the reason at the point of approval

Weaker processes record what happened: an amount, a date, a supplier, a code. That satisfies the bookkeeping and none of the audit.

The questions asked in an audit are different. Why was this allowed. Who decided it was allowed. What did they see when they decided.

Audit-ready teams capture the reason at the moment of the decision, when it costs almost nothing because the person deciding already knows the answer. Six months later that same reason costs an email thread, two follow-ups and somebody's best recollection.

In practice this is small. An approver who can see the budget line and the fund conditions in front of them, and whose approval is recorded with their name against it, has answered the audit question without being asked it. This is what approval workflows are for.

Code restricted funds at approval, not at month end

This is the habit that separates competent nonprofit finance from the rest, and it is worth being blunt about why.

If a cost is allocated to a restricted fund weeks after it was paid, the record shows money leaving and then being assigned a purpose. From the outside, that is indistinguishable from having spent restricted money incorrectly and then adjusted the books to fit.

You will know the difference. Your auditor cannot see it.

The stronger habit makes the fund a required part of the approval rather than a coding task afterwards. Whoever approves the spend confirms which fund carries it and, ideally, can see what is left in that fund before saying yes.

Where a cost genuinely splits across funds, record the basis for the split at the same moment. The basis is the part nobody remembers later, and the part that gets questioned.

Simplify approval thresholds, and close the informal routes

There is a pattern in nonprofit finance policies where the level of detail rises every time something goes wrong. After a few years you have an approval matrix with many bands, several exceptions and a set of special cases for grant-funded spend.

Nobody follows it. Not out of laziness, but because it cannot be held in anyone's head, so people fall back on asking whoever is nearest.

Consistently audit-ready teams tend to have strikingly simple rules. One threshold everybody knows, with a named approver above it and a named deputy for when that person is away.

What makes it work is not the simplicity on its own. It is that there is no informal route around it. If your process has an override for urgent payments, and that override gets used most weeks, then the override is your actual process and the policy is decoration.

Keep an override, by all means. Log every use of it and review the log, and it stays an exception. The same principle applies across accounts payable controls generally.

Give your board something to approve

Board and committee oversight is the control most often satisfied on paper. A pack goes out, the pack is noted, the minutes record that it was noted.

An auditor reads that as reporting rather than oversight, and they are right to.

Organizations that get real value from their board treat a treasurer or committee member as an active approver above a threshold. It is a small ask, usually a few decisions a month, and it does two jobs at once. Your board is genuinely overseeing spend, and your separation of duties no longer depends on how many people happen to work in finance.

It also produces evidence that is hard to argue with: a named board member's approval sitting on the transaction itself, rather than a minute saying the numbers were reviewed.

Test your audit trail before your auditor does

Every finance team believes it has an audit trail. The useful question is whether it can be produced without a search.

Try this. Pick a handful of payments at random from nine or ten months ago, and give yourself five minutes on each to produce the request, the approval, the approver's name, the date and the supporting document.

Most teams fail on at least one, and usually for the same reason: the approval lives in an email belonging to someone who has since changed jobs.

Doing this twice a year, on purpose, is the cheapest nonprofit audit preparation available. It finds the gap while you still have time to close it and while the people involved are still around to explain.

Make the record survive staff turnover

The most common point at which a control stops working is a change of staff. Not because anyone did anything wrong, but because the control lived in how one person did their job.

Turnover is where an informal process reveals itself. If the new person cannot find how spend was approved, neither can an auditor.

The test here is uncomfortable but quick. If your most experienced finance person left next month, how much of your approval history would leave with them?

Strong teams keep approvals somewhere institutional rather than personal, so the answer is none of it. That is less about technology than about a decision that email is not a filing system, backed by an audit trail that belongs to the organization rather than to an individual.

Where ApprovalMax fits

Reading back through those six, most are not policy problems. The rule usually exists. What is missing is something that makes the rule fire on the transaction in front of you, and that records the decision as it happens.

That is the job ApprovalMax does. Bills and expenses route to the right approver by amount, by fund or by program. Nothing reaches payment without the authorization your policy requires, and every decision is captured against a named person at the time they make it.

For a small team, the part that matters most is that separation of duties stops depending on who is available this week. Your treasurer can approve from their phone, and the trail exists whether or not anyone remembers to build it.

Where to start

You do not need to change six things at once, and most teams find that two of the six are already fine.

The quickest way to find out which is to work through the audit-readiness checklist. It covers separation of duties, approval thresholds, restricted-fund checks, audit-trail completeness and board oversight, with the version of each that works on a team of two or three.

New to this? Start with internal controls for nonprofits, which covers why the risk sits higher in this sector than almost any other. If you advise nonprofits rather than work in one, why compliance-focused accountants win nonprofit clients is the companion piece.

Frequently asked questions

What does audit-ready actually mean?

That the evidence an auditor asks for already exists, in a form you can produce without reconstructing it. It describes your normal working practice rather than a state you enter before an audit.

How do you prepare for a nonprofit audit?

The short answer is that you prepare during the year rather than before the audit. Make sure every payment has a recorded approver, that restricted funds are coded when the spend is approved, and that the approval record sits somewhere other than an individual's email.

How long does nonprofit audit preparation take?

For organizations that capture approvals as they happen, days rather than weeks, because the work is retrieval rather than reconstruction. Teams assembling evidence afterwards commonly lose two to three weeks of finance capacity.

How often should we review our internal controls?

At least once a year, and always after a change in staff, systems or funding. Staff turnover is the most common point at which a control stops working without anyone noticing.

Is this realistic for a very small finance team?

Yes, and in some respects it is easier. Fewer people means fewer places for the trail to fragment, provided you decide on one place and use it consistently. The threshold approach in particular is built for small teams.

What is the single most valuable change?

Recording the approval at the moment it happens, against a named person, somewhere that is not an individual's inbox. Almost everything else gets easier once that is true.

Should our board really be approving individual transactions?

Above a threshold, yes. It gives your board genuine oversight rather than a pack to note, and it solves separation of duties on a small team at the same time.