Charity Financial Controls (CC8): Practical Implementation Guide for UK Charities

What CC8 actually says

CC8 is the Charity Commission’s guidance on internal financial controls for charities. It’s not a regulation — it’s the statement of what good financial controls look like, what trustees are expected to put in place, and what to test annually.

The document covers six control areas:

1. Income controls — banking, recording, segregation
2. Expenditure controls — authorisation, payment, segregation
3. Cash and petty cash
4. Banking and financial records
5. Risk management
6. Trustee and staff controls — conflicts, expenses, allowances

The Commission expects trustees to assess controls annually. Auditors and independent examiners check controls as part of their work. Funders sometimes ask about controls in due diligence.

---

The six control areas — what to implement

1. Income controls

Goal: every pound that comes in is recorded, banked, and accounted for.

Practical controls:
– Two-person handling of cash (count + sign + bank)
– Online donation platform (Stripe, GoCardless, JustGiving) for digital — recorded automatically
– Receipt book or numbered receipts for cash donations
– Income recorded in the day it’s received, not later
– Bank statements reconciled monthly to income records

For a charity with multiple income streams (fundraising events, grants, individual donations), keep separate records by income type.

2. Expenditure controls

Goal: every pound out is authorised, supported by evidence, and reasonable.

Practical controls:
– Authorisation matrix: who can approve up to what amount
– Up to £100: any staff member
– £100-£1,000: senior staff
– £1,000-£5,000: CEO + treasurer
– £5,000+: full board approval
– Two signatures on payments above a threshold
– Invoices kept for every payment over £25 (HMRC standard)
– Monthly reconciliation against authorised budget

For small charities with one staff member, the authorisation matrix often involves a trustee — check the chair or treasurer authorises payments above a low threshold.

3. Cash and petty cash

Goal: minimise cash; control what cash exists.

Practical controls:
– Petty cash float kept low (£100 maximum for most small charities)
– Logged in/out (date, amount, purpose, recipient)
– Reconciled monthly
– Cash collections counted by two people, banked promptly
– Cash never used as an alternative to proper payment (e.g., paying staff)

For fundraising events with cash, count immediately at event close, two people present, deposit slip prepared. Never carry significant cash overnight.

4. Banking and financial records

Goal: clean records that support the trustees’ annual report and accounts.

Practical controls:
– Bank reconciliation monthly
– Multi-signatory bank account (at least two unrelated signatories)
– Payments by bank transfer where possible (audit trail vs cheque)
– Accounting software (Xero, QuickBooks, Sage) — even for small charities
– Backup of records (cloud-stored, off-site)

For an annual review: check that the financial records can be reconstructed if the main staff member is unavailable. If not, document the process.

5. Risk management

Goal: identify and mitigate the financial risks specific to your charity.

Practical controls:
– Risk register including financial risks
– Annual review by trustees
– Specific consideration of: funder concentration, fraud, cyber, sector-wide events
– Insurance proportionate to risk

Risk register doesn’t need to be sophisticated. A 1-page list of top 10 risks with mitigation actions works for most small charities.

6. Trustee and staff controls

Goal: prevent conflicts of interest, ensure expenses are reasonable, manage authority.

Practical controls:
– Conflicts of interest register, declared annually
– Conflicts handling at board meetings (conflicted person leaves the discussion)
– Expense reimbursement policy (what’s allowed, what evidence needed, who approves)
– Trustee payments only with proper authority (most don’t apply)
– Whistleblowing route published

---

Free implementation checklist

[CHARITY NAME] — Financial Controls Audit
Date: [date] · Conducted by: [name] · Reviewed by: [trustee chair/treasurer]

INCOME CONTROLS
[ ] Cash income counted by two people
[ ] Numbered receipt book in use
[ ] Bank statements reconciled monthly
[ ] Income recorded by category (donations, grants, trading)
[ ] Online donations integrated with accounting

EXPENDITURE CONTROLS
[ ] Written authorisation matrix
[ ] Two signatures on payments above £[threshold]
[ ] Invoices retained for all payments over £25
[ ] Monthly reconciliation against budget
[ ] No retrospective approvals

CASH AND PETTY CASH
[ ] Petty cash float kept under £[amount]
[ ] Petty cash log maintained
[ ] Reconciled monthly
[ ] Event cash counted by two, deposited promptly

BANKING AND RECORDS
[ ] Bank reconciliation monthly
[ ] Multi-signatory account
[ ] Accounting software in use
[ ] Records backed up
[ ] Records would be reconstructable if key staff unavailable

RISK MANAGEMENT
[ ] Risk register reviewed annually
[ ] Funder concentration considered
[ ] Cyber risks considered (see [CC8 + Cyber Security guide](/blog/cyber-security-charities-uk-2026/))
[ ] Insurance reviewed annually

TRUSTEE AND STAFF CONTROLS
[ ] Conflicts of interest register
[ ] Conflicts declared at board meetings
[ ] Expense reimbursement policy
[ ] Whistleblowing route published
[ ] Trustee payment policy aligned to governing document

ACTION POINTS
[List any gaps with owner and target date]

NEXT REVIEW: [date — typically 12 months]

Most charities can complete this audit in 1-2 hours. Schedule annually as part of trustee year-end review.

---

From CharityIQ. CharityIQ supports your financial controls — authorisation matrix configured, reconciliation tracking, conflicts register, audit trail. See compliance →

---

Common control failures

1. One-person finance function. A bookkeeper who handles income, expenditure, banking, and reconciliation alone. Single point of failure and fraud risk.

2. Verbal authorisations. “I told them it was OK” leaves no audit trail. Use email or written approvals.

3. Trustees signing blind. Approving payments without seeing the underlying invoices.

4. No annual review. Controls drift. Annual audit catches it before auditors or funders do.

5. Cyber-financial cross-cutting risk. Phishing-led fraud is the most common UK charity financial loss in 2026. See our cyber security post.

6. Petty cash creep. Small amounts that aren’t reconciled add up. Keep the float low and log everything.

---

When you might need more sophisticated controls

For most £25k-£500k charities, the controls above suffice. Step up if:

• You receive substantial restricted funder grants requiring detailed reporting
• You have employees beyond one or two staff members
• You operate trading subsidiaries
• You hold significant reserves (£100k+) requiring investment management
• You handle cash regularly (e.g., charity shop or community café)

Larger charities need: separation of duties more rigorously enforced, internal audit function (or external internal audit), audit committee at board level, segregated banking for restricted funds.

---

What to do this quarter

If your charity has no documented financial controls:
1. Schedule a 90-minute trustee session to work through CC8 areas
2. Adopt the checklist above as your starting framework
3. Identify 2-3 gaps to fix in the next 90 days (typically: authorisation matrix, conflicts register, risk review)
4. Set annual review date in trustees’ calendar

Financial controls, automated. Start a free 14-day CharityIQ trial. Start free trial →