Blogging Beyond the Numbers

Internal Controls – COVID style
Posted by: Hannah Lanser 12 months ago

Auditors love internal controls so it should come as no surprise that despite our current COVID environment, internal controls are still top of mind. Risk has always been a part of developing a strong internal control structure, but risk is becoming an even bigger player during this season. Unfortunately, we’ve already seen headlines of checks being stolen out of mailboxes as one example. Now, more than ever, you need to protect your finances. Focus on high risk areas based on dollar amount, reputation, and crisis management.


Many of you may have heard the phrase “dual-control over receipts.” What this is referring to is having at least two people with the cash or checks from the time of receipt to the time they are deposited into the bank. Even though there is social distancing and people working from home these days, you still need two people overseeing this process. Consider the following:

  • Using FaceTime or Zoom to have another staff member watch the mail being sorted, processed, and deposited by the employee who actually handles the receipts. Have the second person send an email to leadership afterward to confirm dual-control and keep a copy of this email.
  • Having the post office hold your mail for pickup rather than delivery to avoid mail theft.
  • Encouraging your congregants to give electronically as much as possible. If you haven’t already set up an online giving platform, now is the time. Vanco, Pushpay, and Text to Give programs are commonly used giving platforms. Choose a company that is reputable, widely used, and well known to ensure a better fit.


For a majority of churches, there are still paper processes in place to approve and pay bills. Now is the time to look into electronic ways of processing bills. Consider the following:

  • Scanning and emailing invoices for approval and using electronic bill pay through your bank to pay the bill. Keep a record of the approval email and store the invoices on your network electronically. You can also use Google Drive as a place to store invoices.
  • Implementing, an online bill paying software. You upload the invoice to the system, the authorized approver receives a notification for approval, it is approved by a click of a button from anywhere, and pays the vendor. The paper process is no longer needed, it has automatic internal controls built in, and it integrates with QuickBooks and Intacct directly.
  • Using a credit card to pay for more items during this time rather than writing checks. It is important to have someone else review the charges for proper spending.
  • Outsourcing payroll processing to a payroll company that use electronic systems rather than collecting timesheets and needing to go to the office to ensure employees are paid.

As with all disbursements, the key is documented review and approval. This can be done through email and does not require paper. It is also important to make sure the accountant or finance function does not have the ability to write checks or wire funds.


Internal controls can be preventive or detective. If you can’t approve expenditures prior to payment, then you can still have detective systems in place to look at them after the fact. Consider the following:

  • Reviewing the bank statement and bank reconciliation. This is the most important detective control by far. All banks have online banking and can provide electronic statements. It is important to be reviewing the authentic document from the bank itself. Someone other than the accountant should review the bank statement for the activity and compare it to the bank reconciliation. Look at the checks that cleared the bank that month. Were the right people signing the checks? Are the vendors appropriate? And remember, document this review as evidence of its occurrence.
  • Having someone other than the accountant go online and review the credit card activity to make sure the spending is legitimate and prudent.
  • Reviewing monthly financial statements, if not more frequent financial statements. Now is the time to keep your eyes on the cash flow trends and the cash flow projections.

During this uncertain and ever-evolving time, keep your internal control structure in mind. If you’ve had personnel changes, are the internal controls still being performed? Are your employees safe from potential accusation or suspicion? Find creative ways to stay safe and keep your funds safe at the same time. It’s good stewardship and it’s the right thing to do.


Leave a Reply

Your email address will not be published. Required fields are marked *

  1. Lamar Janes :

    I looked into electronic bill pay through our credit union. I like that the bank statement shows who was paid vs Intuit’s direct deposit vendor pay function which does not.

    To check internal control security I made an electronic bill pay to a legit vendor’s bank account, but used a fictitious name for the vendor. It went through. So I could transfer money to my personal account and have it appear on the bank statement as going to a legit vendor.

    | Reply
    • Hannah Lanser :

      Hi Lamar, good job testing the system out! To secure the process, I recommend three things: 1) have a list of electronic online bill pay vendors and the dollar amount if it is a recurring bill, 2) requiring documented authorization for any new vendors to be set up or any vendors to be removed and 3) have someone outside the accounting process review the bank statement each month and document this. They should compare the vendors to the approved vendor list and any invoices that month for nonrecurring charges.

      | Reply