When money goes missing: responding to suspected theft or fraud

This guide is for the treasurer, chair or director who has just noticed something wrong: a bank balance lower than it should be, checks nobody remembers writing, a cash box that's always short, a volunteer who won't hand over the books. It's a sick feeling, especially in a small charity where everyone knows each other. After reading, you'll know what to do in the first days, who to tell and in what order, how to work with your insurer and the police, what the IRS asks if you file the full Form 990, and how to close the gaps afterward.

This guide is about responding. To prevent theft in the first place, read our financial controls guide.

The first day: protect, don't confront

1. Write down what you found, when and how. Keep it factual: dates, amounts, documents.
2. Don't confront the person you suspect, and don't tell them what you've found. A confrontation can lead to records being destroyed or money being moved.
3. Secure the records. Make copies of bank statements, the accounting file, receipts and emails. Download online statements. Don't let anyone delete or "tidy up" files.
4. Protect the accounts. Quietly ask the bank what can be done to stop further losses, such as changing signers, removing online access or cancelling cards. Change passwords to shared accounts, using a second trusted person.
5. Tell the chair (or, if the chair is involved, another officer). This shouldn't be one person's secret.

Who to tell, and when

Keep the circle small at first, but don't keep it secret from the people responsible.

• The board, or a small group of directors who aren't involved. The board is responsible for the charity's assets. The New York Attorney General's guidance on internal controls says a charity should have procedures for employees, contractors and volunteers to report "allegations of fraud or financial improprieties" to the audit committee or board.
• Your insurer, promptly (see below).
• A lawyer and an accountant, if you can get one, even for an hour. Many will help a small charity at low or no cost. Our legal basics guide explains where to look.
• The police, if the board decides there's evidence of a crime. The California Attorney General's Guide for Charities says a charity that learns of embezzlement should take reasonable steps to recover the funds and refer the matter to the local police or district attorney.
• Funders, if restricted or grant money may be affected. Read your grant agreements: many require you to tell the funder about a loss.
• Your state charity regulator, if your lawyer advises it or your state requires it. Rules differ by state. In California, for example, the Attorney General's guide says the loss must be reported on the charity's annual Form RRF-1, with an explanation of what it has done to recover the loss and prevent it happening again. Our directory lists every state's charity regulator.

If you have a whistleblower policy, follow it. It protects the person who raised the concern from retaliation.

Call your insurer early

The California Attorney General's guide says a charity should consult its insurance carrier to find out whether the loss is covered, and that "some insurance policies include coverage of employee theft and dishonesty."

• Read the policy now. Look for coverage with names like "crime," "employee dishonesty" or "fidelity," and ask your agent what your policies do and don't cover.
• Check the notice rules. Each policy sets its own requirements for telling the insurer about a loss and proving it. Find them and meet them.
• Keep everything. Keep the records you secured on day one; your insurer may ask for them.

Our insurance basics guide explains the main kinds of cover. If you don't have crime coverage, ask your agent about it once this is over.

Find out what happened

Before the board decides anything about a person, it needs to know the facts.

• Work out the size and the period. Compare bank statements with your records month by month, going back as far as you can. An outside accountant can do this faster and more credibly than a volunteer.
• Look for the method. Was it cash, checks, a card, payments to a fake vendor, payroll? The method tells you which controls failed.
• Hear the person's side, once you've secured the records, ideally with a lawyer's advice and a second board member present.
• Write it up for the board: what happened, how much, how it was found and what you've done. Keep this record confidential.

The board's decisions

The board should decide, in a meeting with minutes:

• What happens to the person: removal from office or from handling money, ending employment or a volunteer role, and whether to report to the police or seek repayment.
• Whether to pursue recovery, through the insurer, repayment, a civil claim or a court order in a criminal case.
• What to tell others, and who speaks for the charity.

Anyone with a personal connection to the person involved shouldn't take part in these decisions. Our conflict of interest policy template explains how.

What the IRS asks

If your charity files the full Form 990 (the longer annual return), Part VI, line 5 asks whether the organization "became aware during the organization's tax year of a significant diversion of its assets," whether or not the diversion happened that year. The instructions say:

• A diversion includes "any unauthorized conversion or use of the organization's assets other than for the organization's authorized purposes, including but not limited to embezzlement or theft," by anyone: officers, directors, staff, volunteers, contractors or outsiders.
• It's significant if the gross value of all diversions discovered during the year, before any insurance or repayment, is more than the lesser of 5% of the organization's gross receipts, 5% of its total assets, or $250,000.
• If you answer "Yes," you explain on Schedule O the nature of the diversion, the amounts, the corrective actions and the circumstances, but the people who diverted the assets "shouldn't be identified by name."

Smaller organizations that file Form 990-EZ or the 990-N e-Postcard don't answer this question, but they should still keep a full record. Our guide to filing your first 990 explains which return you file.

Telling donors and the public

You may not need to announce anything. But if word is out, or the loss affects programs or donors, say something short and honest, once the board agrees what to say:

• what happened, in general terms, without naming anyone;
• what you've done to protect the charity's money;
• what you're changing so it doesn't happen again.

Our crisis communications guide explains how to prepare a statement and who should speak.

Fix the gaps

Most thefts in small charities happen because one person controlled the money alone. The New York Attorney General's guidance says procedures should ensure "that no single individual is responsible for receiving, recording and depositing funds, and writing and signing checks." After a loss:

• Split the duties, so the person who records money isn't the one who deposits or spends it.
• Require two approvals for payments, and check that the bank and your online banking actually enforce them.
• Reconcile the bank account every month, with a second person reviewing it.
• Give a board member view-only access to the bank account.
• Review who can sign and who has cards and passwords, and update the bank.

Our financial controls guide explains each of these in plain steps.

Your response checklist

• We wrote down what we found, factually, with dates and amounts
• We secured copies of bank statements, accounting files and receipts
• We protected the accounts: signers, cards, online access and passwords
• The chair and a small group of uninvolved directors know
• We notified our insurer promptly and kept every record they asked for
• We got legal and accounting advice
• The board decided next steps in a meeting with minutes
• We checked our grant agreements and told affected funders
• If we file the full Form 990, we checked whether the loss is a "significant diversion"
• We changed our controls so no one person handles money alone