Some organizations run on volunteers only, but many need employees to perform certain tasks. Since having employees is costly, it’s no surprise that payroll is usually the biggest expense in the financial statements. Running payroll can be difficult, and while many organizations contract out outside payroll services, some prefer to process it in-house. Some key risks and controls with payroll are:
Risk: Time sheets could contain wrong information.
In many organizations receiving government funds, everyone files time sheets—even the president—to support charging grants “real” salaries rather than estimated/budgeted ones. Fortunately, many organizations use computerized timekeeping devices and time sheets that once implemented, reduce errors and confusion significantly.
A traditional internal control is for nonprofits to require supervisory approvals on time sheets (manual or electronic) to make sure hours and overtime are authorized. Auditors typically verify if the time charged to a grant was allocated and authorized properly. If the auditor finds errors or no time sheets, or time sheets with no approvals, the scope of the audit is likely to increase, becoming more expensive.
Risk: Employees may be fictitious.
Each employee should file the proper paperwork with human resources and should visit the HR department personally. I know of a case where a program supervisor “hired” a relative part-time who was a “ghost employee.” The nonprofit paid the “employee” for six months, while the supervisor cashed the paychecks.
It was only after a problem with the time sheet of this person (all fake) that the human resources manager got involved, and the fraud was discovered. So, it’s crucial for HR to see and meet with all employees, including part-timers to be sure they’re real and are actually working for the organization.
Risk: Unauthorized payroll changes or increases happen.
To make sure payroll records are correct, department managers should review and sign off payroll registers regarding their department at least once a quarter. Many department managers get the dollar amount of their department’s payroll expenses through regular internal financial reporting, but not the details.
So, having managers verify payroll numbers, overtime, sick days, vacations, etc. is very helpful in keeping it all correct. If they see someone claiming overtime that the manager didn’t approve, he or she can follow up on it.
Controllers or accounting managers should review payroll registers and change reports to make sure the persons running payroll aren’t paying themselves unauthorized overtime or salary increases—a fraud I witnessed that could have been prevented had the controller taken a look at payroll reports regularly.
Risk: Paying terminated employees by mistake.
One issue I often see with payroll relates to nonprofits paying terminated employees because payroll staff didn’t know about the terminations. Once paid, it’s tough to get the money back. So, it’s important for human resources and managers to notify the payroll department when people quit or are let go. Staff may need to process final checks and update the payroll system.
Nonprofits may implement policies and procedures, including a checklist to follow when employees leave. Many details are involved, such as COBRA requirements that need to be handled correctly or the organization could be liable for fines.
Risk: Payroll information may leak.
Confidentiality is essential with payroll records. Nonprofits must keep all payroll-related documents, including time sheets, in safe, locked filing cabinets where only a few selected authorized personnel are allowed in. Similar security measures must be considered with access to the computerized payroll systems that should be very limited.
Nonprofits should hire people who are discreet and don’t discuss confidential matters with others in the organization. They should avoid using email when mentioning any sensitive payroll information because the system may not be secure enough.
Excerpt from book Nonprofit Finance – A Practical Guide Second Edition — https://goo.gl/M563u9