Which NGO policies donors check first: key internal control points
Donors and auditors first check the NGO policies that determine whether the figures in a report can be trusted: the accounting policy, the procurement policy, the conflict of interest policy, segregation of duties and signing rights, payroll procedures with timesheets, asset management and document retention. If these documents exist and actually work, expenditure verification goes more smoothly; if they do not, the auditor extends the sample.
We described how a donor assesses an organisation’s capacity before signing a grant in NGO capacity assessment by donors. Here we look from the other side: which control points the auditor tests during the project and what shows that a policy is not only written down but followed.
What the requirements are based on
In Ukrainian law, the duty to have internal control is set out in Article 8 of the Law “On Accounting and Financial Reporting in Ukraine” (zakon.rada.gov.ua). The organisation determines its own accounting policy, develops a system and forms of internal management accounting, reporting and control, defines employees’ rights to sign accounting documents and approves document flow rules. The head of the organisation must create the conditions for proper accounting and ensure that all units comply with the accountant’s lawful requirements on primary documents.
In EU grants, Regulation (EU, Euratom) 2024/2509 (EUR-Lex) adds further rules: Article 61 requires measures to prevent conflicts of interests; Article 208 allows procurement under the beneficiary’s usual practices provided best value for money is achieved and conflicts of interests are avoided; Article 189(3) requires costs to be recorded in line with the beneficiary’s usual cost accounting practices; Article 129 requires access to be granted for checks. In other words, the donor relies on your internal rules, which is why it checks them first.
Who this applies to
- civil society organisations and foundations preparing for their first large grant or audit;
- organisations that grew out of a volunteer initiative and still work without written procedures;
- directors who are responsible for organising accounting under Article 8 of the law;
- accountants who need something to rely on when asking managers for proper documents.
What to do
- List the policies in force and check that each is approved by an order or a decision of the governing body, with a date and signature.
- Compare the policies with your grant agreements. If an agreement requires stricter rules than your policy, add them or approve an annex for that project.
- For each policy, decide who is responsible for applying it and which document proves it: minutes, a declaration, a timesheet, an inventory record.
- Run an internal walk-through on a few transactions: take a purchase, a salary payment and an expense report and follow each from request to payment.
- Have staff sign that they have read the policies, and repeat this for new people.
- Review the policies every year and after each audit, taking the auditor’s findings into account.
In a small organisation with only a few staff, full segregation of duties may be impossible. In that case, compensate with other controls: a second signature by a board member on large payments, a monthly review of the bank statement by the director, reconciliation with an outsourced accountant. The donor wants to see that the risk has been identified and that there is a response to it.
Internal control points tested first
| Policy or procedure | What the auditor checks | Evidence that it works |
|---|---|---|
| Accounting policy | Whether there are methods for recognising grants and allocating shared costs, applied consistently | Order, allocation calculations, consistent entries across periods |
| Procurement policy | Whether suppliers are chosen under a procedure and with reasons | Procurement files with offers and minutes |
| Conflict of interest | Whether links are declared and people step out of decisions when there is a conflict | Signed declarations, notes in the minutes |
| Segregation of duties and signing rights | Whether one person initiates, approves, pays and records a transaction | Order on signing rights, limits, two signatures at the bank |
| Payroll and timesheets | Whether time worked on the project is supported and matches payroll | Signed timesheets, orders, payroll sheets |
| Advances and travel | Whether expense reports are submitted on time and costs are supported | Expense reports with documents, deadline tracking |
| Asset management | Whether equipment bought with grants exists and is used as intended | Asset cards, inventory records, labelling |
| Document flow and archive | Whether a document can be found for any transaction | Document flow rules, archive list, backups |
Common weak spots
- A policy copied from a template. The procurement policy refers to thresholds and a committee the organisation has never had. The auditor sees a gap between text and practice, which is worse than a simpler procedure that is actually followed.
- One person does everything. The director chooses the supplier and signs the contract, the act and the payment order. Without segregation of duties nobody will notice an error or abuse.
- Conflict of interest declarations signed once a year “just in case”. A declaration should relate to a specific decision, otherwise it proves nothing.
- Policies exist, but staff do not know them. The auditor asks a manager how contractors are chosen, and the answer does not match the policy.
- Nothing changes after the audit. The same findings in the management letter year after year are seen by the donor as a sign of weak management.
Start with the three documents without which a grant audit almost always expands: the accounting policy, the procurement policy with a conflict of interest policy, and an order on segregation of duties and signing rights.
FAQ
Which policies must an NGO have for a grant?
The Accounting Law requires an accounting policy, an internal control system, signing rights for documents and document flow rules. The rest is set by the donor in the grant agreement, most often procurement, conflict of interest, payroll and asset management.
What is internal control in an NGO, in simple terms?
It is the set of rules and checks that prevent one person from carrying out a transaction alone from start to finish and ensure that every cost is approved, documented and correctly recorded in the books.
Can we use a donor’s policy template?
Yes, as a starting point, but adapt it to the organisation’s real structure and processes. The auditor checks not whether a document exists, but whether what is written is followed.
How we help
We help NGOs develop or review their accounting policy and internal procedures to meet donor requirements, and during an audit we test control points on real transactions. See NGO audit, NGO audit preparation and NGO accounting. For directors and accountants we run free webinars for NGOs. Write to us via contacts.
Prepared by the MK Audit team