Audit risks particular to not-for-profits

In this lesson you will

Identify risk factors common to not-for-profit entities
Link Form 990 disclosures to the auditor's risk assessment
Plan responses to restriction, allocation and related party risks
Evaluate threats to tax-exempt status that affect the financial statements

Why NFPs carry their own risk profile

Many NFPs run lean finance teams, rely on volunteers and boards with little financial background, and face constant pressure to show low overhead. Those facts change the risk assessment from the first planning meeting.

Thin segregation of duties

A small NFP may have one bookkeeper who opens mail, deposits checks, records gifts and reconciles the bank. Pair that with cash gifts at events and you have a textbook misappropriation risk. Respond with substantive work: independent bank reconciliation review, tracing gifts from external sources into the books, and analytics by month and source.

Diversion of assets

The Form 990 asks about this directly. Part VI, line 5 asks whether the organization became aware during the year of a significant diversion of its assets. The instructions define a diversion as any unauthorized conversion or use of assets other than for authorized purposes, including embezzlement or theft, by insiders or outsiders. A diversion is significant if the gross value of all diversions found in the year exceeds the lesser of 5% of gross receipts for the year, 5% of total assets at year end, or $250,000. The explanation goes on Schedule O, without naming the person responsible.

A Yes answer is a fraud risk you must address. A No answer when you know of a theft is an inconsistency you raise with those charged with governance.

Restriction compliance

Spending a restricted gift on something else is both a misstatement risk (releases recorded without the purpose being met) and a legal risk with donors and state attorneys general. Test releases against restrictions, and watch for restricted cash used for operations. ASC 958-210-50-2(b) requires disclosure if the NFP has not kept enough cash to comply with donor restrictions.

Functional allocation pressure

Donors, watchdogs and grantors read the program ratio. Management has a motive to move costs from fundraising and management and general into programs. The allocation is an estimate, so apply skepticism: test time records, the basis for shared costs and joint cost criteria.

Related parties

Board members often do business with the NFP: a director's law firm, a trustee's building lease, a major donor's company as a vendor. Form 990, Part VI, line 2 asks about family and business relationships among insiders, Part X lines 5 and 22 capture loans to and from insiders, and Schedule L reports transactions with interested persons. Use those disclosures as a cross-check against your related party procedures.

Tax-exempt status and unrelated business income

Loss of exemption, excess benefit transactions or unreported unrelated business income can create tax liabilities and disclosure needs. Read the Form 990 and 990-T, and check the uncertain tax position footnote the NFP provides on Schedule D, Part X.

Government grants and single audit

Federal awards bring compliance requirements. A nonfederal entity that expends $1,000,000 or more of federal awards in a fiscal year beginning on or after October 1, 2024 needs a single audit under 2 CFR 200.501 ($750,000 for earlier years). Count pass-through awards and noncash assistance when testing the schedule of expenditures of federal awards for completeness, because a missed award can move the client over the threshold. Form 990, Part XII, line 3a asks whether a Uniform Guidance audit was required. Unallowable costs can turn into liabilities. The single audit threshold page has the test.

Going concern and liquidity

Reliance on a few large donors or one government contract, declining reserves and covenant pressure all raise going concern questions. The liquidity disclosure gives you a ready dataset for the evaluation.

Investments

Endowments may hold alternative investments valued at net asset value with little observable pricing. Valuation work needs fund statements, audited fund financials and a rollforward to year end.

Putting it into the plan

Document each risk in the planning memo with the assertion it affects and the planned response. Revisit the list when the Form 990 draft arrives, since a Yes on Part VI, line 5 or a new related party on Schedule L can change the assessment late in the audit. A short list linked to procedures is more useful than a generic list.

Worked example

Diversion threshold at Westfield Community Clinic

Westfield Community Clinic reports for 2026 gross receipts of $3,800,000 and total assets at December 31, 2026 of $6,000,000. In October 2026 the clinic discovered that its front desk supervisor had taken $210,000 in patient copay cash over 18 months. Insurance reimbursed $60,000.

Step 1, the thresholds: 5% of gross receipts = $190,000. 5% of total assets = $300,000. Fixed amount = $250,000. The lesser is $190,000.

Step 2, gross value: the instructions measure the gross value of diversions discovered in the year without reduction for restitution or insurance recoveries. Gross value is $210,000.

Step 3, comparison: $210,000 exceeds $190,000, so the diversion is significant. Part VI, line 5 must be answered Yes, with an explanation on Schedule O that does not name the supervisor.

Audit consequences: you treat the theft as a fraud that management has identified, extend testing of cash receipts at all locations, evaluate the control deficiency for communication to those charged with governance, and check that the loss, the insurance recovery and any receivable from the employee are recorded correctly. You also read the draft Form 990 before release of your report to confirm line 5 is answered consistently.

Self-check

Answer each question before you open the answer.

What three amounts set the significance threshold for Form 990, Part VI, line 5?
Show answer
The lesser of 5% of gross receipts for the year, 5% of total assets at year end, or $250,000.
Should the explanation of a significant diversion name the person responsible?
Show answer
No. The instructions say the person who diverted the assets should not be identified by name.
Why does the program expense ratio create an audit risk?
Show answer
Donors and watchdogs read it, so management has an incentive to move costs into programs. The allocation is a judgment that needs skeptical testing.
Name the Form 990 places that help you test related party completeness.
Show answer
Part VI, line 2 on family and business relationships among insiders, Part X lines 5 and 22 on loans with insiders, and Schedule L on transactions with interested persons.

Sources

Back to the syllabus

Standards are paraphrased from the primary sources listed above; read the source before relying on a requirement. This lesson is training material, not professional advice. Report an error