Financial Governance & Sustainability · 29 September 2026
Fraud in a not-for-profit is rarely the dramatic, sudden theft boards imagine when they think about the risk. Global research on occupational fraud consistently shows it hiding in plain sight inside ordinary operations, undetected for well over a year in the typical case, and it thrives specifically in exactly the conditions many smaller associations already operate under: a small team, trust between colleagues, and limited capacity to separate financial duties across multiple people.
What The Global Evidence Actually Shows
The Association of Certified Fraud Examiners conducts the most extensive recurring global study of occupational fraud, drawing on thousands of real investigated cases across many countries. Not-for-profits consistently represent close to ten percent of reported cases, broadly proportionate to the sector's overall economic footprint, so this is not a sector uniquely targeted by fraud. It is a sector where the same loss causes disproportionate damage, against a restricted program budget, a public annual return, and often a much smaller team available to prevent or catch it in the first place. Nearly a third of organisations that experienced fraud, across a recent study cycle, lacked adequate internal controls to prevent it occurring at all, and asset misappropriation, someone simply taking money or assets rather than more complex financial statement manipulation, accounts for the overwhelming majority of cases.
The Control With The Strongest Evidence Behind It
Segregation of duties, ensuring no single person can both create and approve a payment, is the control every guide recommends, and the evidence supports it. But the global research points to a second, specific, less commonly implemented control with strong evidence behind it: job rotation and mandatory leave. Organisations that require staff handling financial duties to rotate responsibilities, or to take real, uninterrupted leave, see a documented reduction of roughly half in both the size and duration of fraud schemes that do occur. The mechanism is straightforward. Many fraud schemes require the person committing them to remain continuously present to keep covering their tracks, and an unwillingness to ever take leave or rotate duties is itself one of the most consistently identified behavioural red flags in the research. A staff member who has not taken a break in years, or who resists any change to how a specific financial process runs, is not necessarily doing anything wrong. But the evidence is specific enough that a board serious about fraud prevention should treat mandatory leave as a real control, not merely a wellbeing nicety.
Why The Whistleblower Discipline From Earlier In This Series Matters Here Specifically
The single most common way fraud is detected is not an audit, and it is not a sophisticated financial control catching an anomaly. It is a tip, most often from an employee who noticed something and said so. This is why the whistleblower protection discipline discussed earlier in this series is not a separate compliance topic sitting apart from fraud prevention. It is one of the most evidence-supported fraud detection mechanisms available, and an organisation with a functioning, trusted reporting channel is meaningfully better positioned to catch fraud early than one relying purely on formal financial controls.
Building Genuine Controls At The Scale Your Association Actually Has
- Require a second, independent person to approve every payment before it leaves the organisation, connecting directly to the delegations of authority discipline discussed earlier in this series, since enforced approval before payment is consistently identified as the single most effective preventative control.
- Build job rotation or mandatory leave into financial roles specifically, even in a small team, since the evidence behind this specific control is unusually strong relative to how rarely smaller organisations actually implement it.
- Treat an ever-present, never-taking-leave financial staff member or volunteer treasurer as worth a quiet, respectful conversation, not automatic suspicion, but a governance blind spot if the pattern is simply left unexamined indefinitely.
- Ensure your whistleblower reporting channel, discussed earlier in this series, is known and trusted by staff, since tips remain the dominant real-world fraud detection method by a wide margin over any formal control.
- Accept honestly that true segregation of duties is difficult on a small team, and where it cannot be fully achieved, compensate with more frequent board-level review of transactions rather than assuming the gap simply does not matter at your organisation's size.
Fraud prevention in a resource-constrained association is not about building the same control environment a large corporation would. It is about being honest about where the gaps are, given real staffing constraints, and putting the specific, evidence-supported controls in place that do the most protective work for the least resourcing cost, rather than assuming good character alone is sufficient protection.
This is one of the practical governance topics built into our Board Director course — alongside the papers, tools and frameworks that turn the principle into your board's actual practice. Explore the course →
— Annie