"Internal controls" sounds like something for corporations with audit committees, not a youth soccer club where the same four parents run everything. So most small organizations skip them — until the year a trusted volunteer leaves abruptly and nobody can fully account for the concession cash, or worse, the year the local paper runs a story about a club treasurer and a missing $12,000.
Here's the uncomfortable truth about small-organization fraud: it's almost never committed by a villain. It's committed by a trusted, overworked volunteer with unsupervised access and a personal crisis — and it's enabled by everyone else's politeness. Controls aren't an accusation. They're the system that makes accusation unnecessary, because no honest question ever has to become a confrontation.
The good news: you don't need an audit department. You need a handful of rules that fit a five-person organization. Here they are.
The core principle: no one person touches money alone, start to finish
Textbook separation of duties splits four roles — authorizing a payment, executing it, recording it, and reconciling the account — among four people. With five volunteers who also have jobs, that's fantasy. The workable small-org version is one sentence:
The person who handles money is never the only person who sees it.
Every control below is just that sentence applied to a different doorway money walks through.
Two-person rules for cash
Cash is where most small-org problems start, because cash has no memory.
- Two people count, together, on site. Concession box, gate cash, raffle envelope — counted by two unrelated people before it leaves the venue, both signing a simple count sheet (date, event, amount, two signatures).
- The counter isn't the depositor's only check. The count sheet goes to the treasurer; the deposit slip must match it. Now a discrepancy is a question with a paper trail, not a mystery.
- "Unrelated" matters. Spouses, siblings, housemates — one household counts as one person for control purposes. Not because you distrust them, but because the control exists to protect them from ever being unprovably suspected.
If two counters is genuinely hard to staff, that's a signal to handle less cash, not to skip the count. Every sale you move to digital payment is a transaction that records itself with no counting, no envelope, and no trust required — one reason clubs shift concessions and gate sales to cashless collection through platforms like HometownLift, where every dollar arrives already logged.
Approval thresholds for spending
Spending controls are about removing solo judgment calls. Adopt three tiers and write them into your policies:
- Under a small threshold (say $100): treasurer or president can approve alone, receipt required.
- Middle tier ($100–$500): two officers approve — a text thread screenshot saved to the shared folder is fine. Perfect documentation you'll actually do beats ideal documentation you won't.
- Above the threshold ($500+): board approval, recorded in minutes, before the money moves.
Two corollaries: no one approves their own reimbursement (the president approves the treasurer's, and vice versa), and no blank checks or shared debit card floating around, ever. Pick numbers that fit your budget — the exact thresholds matter less than the fact that they're written down and apply to everyone, including the founder everyone adores.
The reconciliation must be seen by a second person
This is the control most small organizations miss, and it's the single highest-value one: someone who doesn't handle the money looks at the bank statement every month.
It can be lightweight. The president (or any non-signer board member) gets read-only online banking access, or simply receives the unopened statement, and spends ten minutes scanning for anything odd — unfamiliar payees, round-number transfers, ATM withdrawals. They're not redoing the treasurer's reconciliation; they're being the second set of eyes that makes the books a shared fact rather than one person's word.
Think of it like the buddy system at a pool. The lifeguard isn't there because swimmers are bad people; the lifeguard is there so that one bad moment doesn't go unseen. Read-only access is your lifeguard chair, and it costs nothing.
Controls that survive turnover
A control that lives in one person's habits dies with their term. Make the system institutional:
- Write the rules down — one page: count rules, thresholds, who reviews the statement. Board-approved, kept in the shared folder.
- Two-plus unrelated signers on the bank account, updated the same week officers change.
- Shared records, not personal ones. Ledger, count sheets, and approvals live where the next treasurer can find them, not in someone's inbox.
- A handoff review. When the treasurer changes, an incoming officer plus one other person walk through the last few months of statements together. It's the cheapest "audit" you'll ever do, and it protects the outgoing treasurer most of all.
Picture the scenario this prevents: a treasurer of six years moves away mid-season. With controls, the new volunteer opens a shared folder, finds the policy page, the reconciled statements, and the count sheets, and is functional in a week. Without them, the club spends a semester reconstructing its own finances — and every gap in the record unfairly shadows the person who left.
The bottom line
Five rules give a five-volunteer organization real internal controls: two unrelated people count all cash, written approval thresholds govern spending, no one approves their own reimbursement, a non-signer reviews the bank statement monthly, and all of it is written down and survives turnover. None of this says you distrust your volunteers — it says you value them enough to make their honesty provable.
To shrink the cash problem at its source and have every payment record itself, see how clubs run game-day money through HometownLift.