Expert: Don Sadler - 4/29/2009

Question
I work for a non-profit organization in New York. What is the auditing practice as it relates to separation of functions/duties. Our finance office wants to have access to our donor database which houses all donation data. My understanding is that there has to be a clearcut separation to allow for checks and balances between the departments.

My second question - how does CFO oversight work in this case if their primary function is to manage the finance department? If they have access to the donor database, should it be a read only or reports only access?

Thanks.

Answer
The concept of separation of duties is that of an internal control designed to ensure that no single person has full control of a transaction.  For example, if a donor sends in a check, there should not be a single person that receives the mail, opens the mail, receives the check, records the check, deposits the check, and updates the financial system.  Obviously, this is to prevent someone from stealing any money… not to imply that anyone would but many people cannot resist the temptation if they know there is no oversight or visibility of their actions.

In your case, merely having access to the database of donors and the amount donated might actually be a good thing in that there is visibility to the donations entered which might prevent someone from ‘not entering’ that nice cash donation of $500 that came in an envelope from an anonymous source (because knowing there is visibility… they know it could be a test by a board member or the auditor).

Of course, without knowing the business process you use in receiving, recording, and depositing donations, it is hard to give an opinion.  

The only downside I would see is that the donor database would be considered proprietary information and the more people that have access to it; the more difficult it is to keep it from leaking.  However, that said, any access granted other than to those who actually update the database should be read/report only.

Having read access allows for strategic analysis of donations that could be used to plan a new campaign of fundraising efforts.

I would ask your external auditor for guidance as there may be other considerations,