Internal controls, fraud and audit

1Internal controls

• Segregation of duties: the person who requests, the one who approves, the one who pays and the one who records are different people.
• Written delegations of authority: who can approve what and up to what amount.
• Physical controls: safe, keys, access to software with personal passwords.
• Independent checks: surprise cash counts, reviews by headquarters, verification visits.
• Asset management: an asset register (computers, vehicles, generators) with tags, an annual inventory, and transfer rules at the end of the project.

2Preventing and dealing with fraud

Common forms: false invoices, overbilling, ghost employees, double funding of the same expense by two donors, aid diversion, collusion with suppliers, abuse of advances.

• Red flags: invoices without numbers or from suppliers who cannot be traced, abnormally high prices, repeated round figures, refusal to take leave, “lost” documents.
• Zero tolerance: any suspicion is reported through the designated channels (focal point, whistleblowing line), without investigating alone or alerting the person suspected.
• Most donors require prompt notification of suspected fraud involving their funds; the contract specifies the deadline.
• Screening of partners, suppliers and employees against sanctions lists (UN, European Union and national lists, depending on donor requirements).

3Audit and capacity assessment

• Project audit: an external auditor checks that the expenditure reported is real, eligible and justified, and that procedures have been followed.
• Prepare from day one: documents filed by budget line and by month, reconciliations done, complete procurement files, timesheets for staff charged to the project.
• Disallowed costs (ineligible) must be refunded to the donor from the organisation's own funds: a real risk for a national NGO.
• Donor and pooled fund capacity assessments (due diligence) (for example the HACT approach for certain UN agencies): statutes, governance, audited financial statements, procedures manual, policies (fraud, PSEA, safeguarding); their outcome often determines the risk level and the funding modalities.
• After the audit: an action plan for each recommendation, with an owner and a deadline.

4Designing a proportionate internal control system

Internal control is not a collection of signatures. It is a coherent set of rules, roles and checks that provides reasonable assurance that resources are used for their intended purpose, that financial information is reliable and that rules are complied with. The most widely used framework, that of COSO (Committee of Sponsoring Organizations of the Treadway Commission), distinguishes five components that can be translated simply for an NGO.

A control that exists on paper but is not applied is worse than no control at all: it gives false assurance to management and the donor. The auditor does not test whether the manual exists; they test whether procedures are applied, on a sample of transactions.

Key controls by cycle

Segregating duties in a small team

In a six-person base, ideal segregation is impossible. The answer is not to give up, but to compensate with independent controls. Example of a fictional base (base manager, administration and finance assistant, logistician, two drivers, one guard):

The principle to remember: no single person should be able to commit an expenditure, take possession of the goods or money, and erase the trace of the transaction in the accounts.

5Mapping fraud and diversion risks

An effective anti-fraud policy starts with a risk map specific to each mission. The fraud triangle (pressure, opportunity, rationalisation) explains why honest people can tip over: late salary payments, high inflation, family or community pressure, a sense of injustice. The organisation acts mainly on opportunity, but it must also monitor pressures (for example after a loss of purchasing power linked to exchange rates).

Typology of fraud and diversion in humanitarian action

• Procurement: bid rigging (cover bids, rotation of winners), supplier owned by a staff member, inflated invoices, partial deliveries invoiced in full, quality substitution (broken rice invoiced as premium-grade rice).
• Staff: ghost employees, non-existent daily workers in cash-for-work activities, unjustified per diems, false medical certificates, "commissions" taken on recruitment.
• Beneficiaries: inclusion of relatives or ineligible people, fictitious names, payment of a "tax" to a leader or committee to be registered, resale of cards or withdrawal codes.
• Aid diversion by armed actors or authorities: skimming a share of distributions, levies at checkpoints, demands to recruit certain people, control of lists.
• Sexual exploitation and abuse linked to aid: trading sex for registration or a ration is both fraud and a serious violation; it falls under the protection from sexual exploitation and abuse (PSEA) policy and follows its own reporting and response channel.
• Accounting and treasury: cash misappropriation concealed by false supporting documents, old cheques reused, unjustified correcting entries, double charging between donors.

The fraud risk register: method

1. Bring together finance, logistics, programmes, human resources and a base manager for half a day.
2. For each cycle, list concrete scenarios ("the storekeeper takes bags out without a release note and sells them").
3. Score likelihood and impact from 1 to 5, before controls (inherent risk).
4. List existing controls and check that they work; score the residual risk.
5. For high residual risks, define actions, an owner and a deadline.
6. Review the register at least every six months and after any incident.

Red flags that can be analysed in the data

• Purchases just below thresholds, repeatedly, from the same supplier.
• Competing quotations written in the same font, with the same spelling mistakes or the same layout; suppliers sharing a phone number or an address.
• Stable unit prices while the market is falling, or regular deviations of more than 15 to 20% from price monitoring.
• Fuel consumption per vehicle markedly higher than the fleet average for the same type of journey.
• Identical phone numbers or mobile money accounts for several beneficiaries.
• An employee who refuses to take leave, keeps certain documents to themselves, or resists any rotation.
• A sudden increase in correcting entries at month end.

The best fraud detector in programmes remains the community complaints and feedback mechanism. A significant share of aid diversion cases are revealed by beneficiaries, provided the channel is accessible, confidential and independent of the people managing distributions.

6Vetting third parties: sanctions, conflicts of interest and due diligence

Donors increasingly require the organisation to demonstrate that no funds benefit sanctioned individuals or entities, and that its partners, suppliers and staff have undergone due diligence proportionate to the risk. This is a contractual and often legal obligation, which must be reconciled with the humanitarian principles.

What to check, and against which lists

UN Security Council Resolution 2664 (2022) introduced a cross-cutting humanitarian exemption (humanitarian carve-out) in UN sanctions regimes, subsequently incorporated into the regimes of the European Union and several States. It protects good-faith humanitarian assistance, but does not override donors' contractual obligations, which may be stricter. The finance manager must be familiar with both levels.

The screening procedure step by step

1. Enter names with their transliteration variants, date of birth or registration number.
2. Query the required lists using a tool (free or paid) that keeps a dated record of the search.
3. In the event of a potential match, compare identifying details; the vast majority of hits are namesakes (false positives).
4. Any match that is not ruled out is referred to the compliance focal point, without informing the third party, and the relationship is suspended pending a decision.
5. Keep the evidence (screenshot or report) in the supplier's or partner's file.

Conflicts of interest

A conflict of interest is not misconduct in itself; failing to declare it is. Every employee signs an annual declaration, and every member of a bid evaluation committee signs a specific declaration before the bids are opened. A member with a conflict recuses themselves from the decision, and this recusal is recorded in the minutes. The most frequent situations: supplier owned by a relative, office or vehicle rented from someone close, recruitment of a family member, partner whose director is linked to a local authority.

Proportionate due diligence

Due diligence must be proportionate to the risk and the amount. Requiring a neighbourhood association receiving 8,000 dollars to provide the same file as a national NGO receiving 800,000 is both ineffective and contrary to localisation commitments. A two- or three-tier system, with mitigating measures (tranches, verifications) for small partners, is the right answer.

The commitments of the 2016 Grand Bargain (A Shared Commitment to Better Serve People in Need) also provide for reducing duplication of partner assessments and harmonising requirements. Using shared assessments, such as HACT micro-assessments recognised across UN agencies, or assessments recognised by several donors, reduces the burden on national partners.

7Worked example: capacity assessment of a national partner

Fictional context: an international NGO wishes to entrust a 260,000-dollar, 12-month protection and cash transfer component to the association "Femmes Debout de Koro" (FDK), founded eight years ago, with 14 employees and a previous annual budget of 180,000 dollars from two donors. The assessment, modelled on the HACT micro-assessment, is carried out over three days by a finance manager and a partnership manager, through document review and on site.

Step 1: preparation

• A document list is sent two weeks in advance: statutes, registration certificate, composition and minutes of the board, latest financial statements and audit report, procedures manual, policies (anti-fraud, protection from sexual exploitation and abuse, child safeguarding, conflicts of interest, whistleblowing), organisation chart, bank statements for the last three months, reconciliations, asset register.
• The approach is explained to FDK's management: the aim is to define appropriate funding modalities and a capacity-strengthening plan, not to "grade" the association.

Step 2: findings and rating

Overall rating: significant risk. The reasoning: the fundamentals are in place (registration, up-to-date accounts, external audit), but three areas concentrate the weaknesses (segregation of duties, treasury, procurement), with an indication of irregularity in one procurement file that must be examined before any decision.

Step 3: handling the indication of irregularity

The suspicious competing quotation is not discussed with FDK staff during the assessment. It is documented (copy, observations) and referred to the international NGO's anti-fraud focal point, who decides on the next steps. After review, it turns out to be a 1,400-dollar purchase under a past project funded by another donor: the decision is to inform FDK's management factually, request a written explanation and make the strengthening of the procurement procedure a precondition.

Step 4: funding modalities and capacity-strengthening plan

A useful capacity assessment leads to three outcomes: a reasoned risk rating, proportionate funding modalities and a funded capacity-strengthening plan. If the assessment funds no strengthening, the partner will remain at the same risk level for the next project.

Step 5: debriefing

The findings are presented orally and then in writing to FDK's management and the chair of the board, with a right of reply. Sensitive points (the family link between the director and the treasurer, the suspicious quotation) are presented as governance risks to be addressed, with solutions (conflict of interest declaration, appointment of another signatory), and not as accusations.

8Preparing for, supporting and closing a project audit

An audit is not an end-of-project event; it is the culmination of twelve or twenty-four months of bookkeeping. But even a well-run mission can have a difficult audit if it does not understand the type of engagement given to the auditor, its timetable and its expectations.

The different types of engagement

Possible opinions

• Unqualified opinion: the financial report is presented fairly, in all material respects.
• Qualified opinion: correct overall, except for identified matters (for example unsupported costs of a specific amount).
• Adverse opinion: misstatements are material and pervasive.
• Disclaimer of opinion: the auditor could not obtain sufficient evidence, often because documents cannot be found. This is the most serious outcome for the organisation's credibility.

Preparation timetable

The audit file index

1. Contract, general and special conditions, amendments, written donor approvals.
2. Approved budget and revised budgets, transfer notifications.
3. Interim and final financial reports; reconciliation table with the accounts.
4. Project general ledger and trial balance; exchange rate and cost allocation policies.
5. Bank reconciliations and cash count reports for the whole period.
6. Procurement files sorted by decreasing amount.
7. Payroll: contracts, payrolls, timesheets, social security and tax returns.
8. Asset register, proofs of receipt, disposal or transfer decisions.
9. Partner agreements and reports, verifications carried out.
10. Previous audit reports and status of implementation of recommendations.

Responding to findings

For each finding, the management response states: agreement or reasoned disagreement, any additional supporting documents, corrective action, owner and deadline. Disagreement is only useful if it is substantiated; contesting without evidence weakens the organisation's position on the other points. Conversely, accepting an inaccurate finding out of fatigue can cost thousands of dollars in disallowed costs.

The sentence the auditor does not want to hear: "the documents are at the base, we will go and get them." Every document requested must be producible during the fieldwork. Anything provided after the end of fieldwork is often refused or treated as an exception.

9Common mistakes and adapting to context

Common mistakes

What donors and assessors look at

• The existence and application of an anti-fraud policy, a conflict of interest policy, a protected reporting channel and a PSEA policy.
• The ability to provide a list of fraud incidents over recent years, with how they were handled: an organisation reporting zero incidents over five years in a high-risk context is more worrying than reassuring.
• Follow-up of audit and capacity assessment recommendations.
• Partner management: assessments, adapted modalities, verifications, incident reporting.
• Governance: the board's actual role, separation between management and oversight.

Variations according to context

10Interview questions and key references

Interview questions

1. "You arrive at a base where the same person handles cash, procurement and data entry. What do you do in the first week?"

A strong answer starts by securing things: an immediate cash count with a signed report, reconciliation of accounts, a quick review of recent purchases. It then proposes a realistic redistribution of tasks and compensating controls, without accusing the person in post, and documents the risks for management. The candidate distinguishes a control design problem from any suspicion of fraud, which would follow a separate pathway.

2. "A supplier offers you a gift to thank you for a contract. How do you react, and what do you do next?"

The candidate politely declines, recalls the policy, declares the offer in writing according to the procedure, and checks whether other staff members have received similar offers. They mention that some low-value gifts may be permitted under the policy, but never during an ongoing procurement process.

3. "How do you assess the financial capacity of a small local association without discouraging it?"

The candidate talks about proportionality, simple tools, on-site visits, listening, transparent debriefing, adapted funding modalities and a funded capacity-strengthening plan. They refer to localisation and to recognising existing assessments to avoid duplication.

4. "What do you do if a name in your supplier database matches a person on a sanctions list?"

The candidate explains checking identifying details to rule out namesakes, suspending the relationship in case of doubt, referring the matter to the compliance focal point without alerting the third party, informing the donor as required by the contract, and keeping the evidence. They mention the existence of humanitarian exemptions without using them as an argument to circumvent a contractual obligation.

5. "The auditor disallows 18,000 dollars of salaries for lack of timesheets. What is your response?"

The candidate first checks whether other reliable evidence exists (activity reports, work schedules, correspondence) and presents it in the response to the draft report. If the finding is well-founded, they accept it, plan for repayment or negotiation with the donor, and introduce monthly timesheets for all shared positions. They explain how they would prevent the situation from recurring.

Key references

• Internal Control – Integrated Framework (2013): COSO.
• International Standards on Auditing ISA 800 and ISA 805, and ISRS 4400 (Revised) on agreed-upon procedures engagements: International Auditing and Assurance Standards Board (IAASB).
• Harmonized Approach to Cash Transfers (HACT) framework and micro-assessment guidance: the UN agencies concerned.
• Code of Federal Regulations, Title 2, Part 200, Subpart D (internal controls, procurement) and Subpart F (audit requirements): United States Government.
• ECHO Humanitarian Framework Partnership Agreement and anti-fraud documents; European Anti-Fraud Office (OLAF).
• UN Security Council Resolution 2664 (2022) on the humanitarian exemption in sanctions regimes.
• Guidelines for Investigations and investigation resources: CHS Alliance.
• Core Humanitarian Standard on Quality and Accountability (CHS), Commitments 3, 5 and 9.
• Transparency International publications on preventing corruption in humanitarian operations.