What financial controls does a small charity actually need?

England and Wales: This page sets out the position in full. Scotland: the same position, with no difference in principle — OSCR’s own inquiry findings identify exactly the same failure pattern described below. Northern Ireland: the same position, with no difference in principle identified.

Charity financial controls: good practice, not a statutory list

Nothing in charity law sets out what a small charity’s financial controls must contain, in England and Wales, Scotland or Northern Ireland. The rest of this page draws on what regulators, such as the Charity Commission and OSCR, have found in their inquiries and monitoring. It describes patterns of failure, not a statute. No checklist is implied where none exists.

That said, CC3 sets out 6 duties for charity trustees. One of them is to “manage your charity’s resources responsibly”. CC3 also says plainly that good practice can, in effect, become close to mandatory. In its words:

“In some cases you will be unable to comply with your legal duties if you do not follow the good practice.”

Financial controls are one of the three examples CC3 itself gives of this.

The controls below are not, one by one, legal requirements. But ignoring all of them is how the underlying duty gets breached in practice. That is why regulators keep finding the same pattern in their inquiries.

This page assumes the books are open and the board has settled what it delegates. If not, first open your books and set up your decision and delegation framework.

The single most common failure: one person, start to finish

The pattern regulators report most often, by a wide margin, is one person running the whole financial cycle. Sometimes that person has one ally. That person raises the payment, approves it, and reconciles the record of it. No one else can see what is happening.

OSCR’s own findings describe charities where

“finances were being handled by an individual or small group and there was a reluctance to share information with fellow charity trustees.”

The Commission’s expectation, in its own words, is that trustees make sure

“no single individual [is] able to access charity funds or assets without appropriate checks, balances and oversight.”

The fix is dual authorisation and separation of duties. Dual authorisation means that the person who raises a payment is not the same person who releases it. A third person — someone not involved in either step — checks the bank statement against the cash book on a regular cycle.

None of the three roles needs to be a different professional. In a small charity they are usually three trustees, or a trustee and the treasurer and a second trustee. The test is that no one role can complete the cycle alone.

What do charity financial controls cover?

Financial controls cover four things. They are written down and adopted, not left as an informal understanding:

• Who can commit the charity to spending — placing an order, signing a contract, agreeing a grant condition — before any payment exists to authorise.
• Who can release a payment, and the authorisation limits that apply. The schedule of limits is the next step: establish authorisation limits and update the bank mandate.
• Who checks — reconciling the bank statement to the cash book on a fixed cycle, by someone not involved in raising or releasing payments.
• How income is counted and banked, especially cash. That means two people present when cash is counted, and cash banked promptly. It also means a record made at the time of counting, not pieced together later.

Why test the controls policy, not just write it?

A controls policy only protects the charity if practice follows it. Whether it must be written down at all is answered in adopt a financial controls policy. An examiner is directed to check that accounting records are kept to the required standard, not that a policy document exists.

Take a controls policy that sits in a folder while practice goes against it. The treasurer still both raises and releases payments because “it’s quicker”.

That is worse than having no written policy at all. It leaves a paper trail that suggests the charity thought it was protected when it was not. Adopt the policy, then run the quarterly check it describes.

With the four controls written down, set the limits that go with them next. After that, the same controls govern how you set up expenses and reimbursement.

Common mistake: one person handling the money and the records

In a small charity there is often only one person willing to do finance. Insisting on a second person feels like distrust of a volunteer who is already doing more than their share. But this is the single most common thread in regulators’ inquiry findings. The charity ends up unable to show — to itself, let alone to an examiner — that funds were not misapplied, whatever happened to them.

Common mistake: adopting a controls policy and never testing it

The document meets the immediate need: a funder wants to see one, or a trustee raises it at a meeting. Then it sits in a folder. An examiner is directed to check that the accounting records meet the required standard. A policy that practice goes against is worse than no policy. It looks like cover, not control.

Worked example

Tollgate Youth CIO has one part-time administrator and five trustees. The administrator raises payments. Two named trustees authorise them.

A third trustee, who is not involved in either step, reviews the bank statement against the cash book every quarter. No single person can both create and release a payment. If that ever changed without the policy being updated, the quarterly review would catch it within three months.