Why the Controls That Worked Yesterday May Not Work Today: Growth Changes Risk
Growth is exciting. But is your nonprofit's or research organization’s financial infrastructure growing with it?
A nonprofit receives a significant new grant. A research foundation takes on additional sponsored projects. Another program launches. Additional employees are hired. The operating budget increases, and the organization begins serving more people or supporting more research.
By almost every measure, the organization is succeeding.
But behind that success, something important may not be keeping pace.
Its internal controls.
The same financial processes that worked when the organization had five employees, two grants, and a $500,000 budget may still be in place when it has twenty employees, twelve grants, and a $3 million budget.
A research organization may have expanded from supporting a handful of principal investigators to administering dozens of sponsored projects, each with its own budget, award conditions, reporting requirements, and financial deadlines.
Yet the underlying financial oversight procedures may remain largely unchanged.
The organization grows. The controls don't.
Growth changes risk.
And organizations don't always recognize that until something goes wrong.
Growth Doesn't Automatically Mean Stronger Financial Management
Nonprofit and research organization leaders often measure growth through increased funding, expanded programming, additional research awards, new employees, and greater organizational impact.
These are important indicators of organizational success.
But financial infrastructure rarely receives the same attention.
Consider an organization that initially operated with a small administrative team.
The Executive Director approved expenses, the bookkeeper recorded transactions, and the board treasurer reviewed monthly financial statements.
For a small research foundation, one finance employee may have managed grant expenditures, reconciled project budgets, and prepared financial reports for a limited number of principal investigators.
The process was relatively straightforward.
Now imagine that same organization several years later.
The nonprofit manages multiple restricted grants, employs additional program staff, and operates several programs with different reporting requirements.
The research foundation administers additional sponsored projects, processes payroll allocations across multiple awards, monitors project spending, and manages increasingly complex reimbursement and reporting requirements.
Yet the financial approval process remains largely unchanged.
The Executive Director may still approve nearly everything. Accounting staff may be responsible for more transactions than they can reasonably review. Financial reports are produced, but unusual balances, grant variances, and project spending concerns may receive limited attention.
The organization has become more complex, but its controls haven't.
That disconnect creates risk.
The Hidden Financial Risks of Organizational Growth
Growth introduces financial risks that may not be immediately visible.
1. More Funding Means More Compliance Requirements
Managing one unrestricted funding source is very different from managing multiple government grants, foundation awards, and restricted contributions.
Each funding source may have different requirements involving:
Allowable expenses and spending restrictions
Financial reporting and reimbursement deadlines
Supporting documentation
Personnel cost allocations and payroll distribution
Procurement procedures
Award budgets and project spending
Grant closeout requirements
For research organizations, these risks can become particularly significant when employees work across multiple sponsored projects or when principal investigators depend on timely, accurate financial information to manage their awards.
Without appropriate financial oversight, organizations can unintentionally charge expenses to the wrong grant, overlook reporting requirements, or fail to maintain adequate documentation.
The financial statements may appear reasonable while underlying compliance problems continue to develop.
2. More Employees Change the Control Environment
When an organization is small, management may be directly involved in nearly every financial transaction.
As the organization grows, responsibilities are delegated.
That is necessary.
But delegation without clearly defined controls can create weaknesses.
For research organizations, these risks can become particularly significant when employees work across multiple sponsored projects or when principal investigators depend on timely, accurate financial information to manage their awards.
Without appropriate financial oversight, organizations can unintentionally charge expenses to the wrong grant, overlook reporting requirements, or fail to maintain adequate documentation.
The financial statements may appear reasonable while underlying compliance problems continue to develop.
2. More Employees Change the Control Environment
When an organization is small, management may be directly involved in nearly every financial transaction.
As the organization grows, responsibilities are delegated.
That is necessary.
But delegation without clearly defined controls can create weaknesses.
Who can approve purchases?
Who can add or modify vendors?
Who can change payroll information?
Who reviews employee reimbursements?
Who authorizes expenditures charged to sponsored research awards?
Who reviews personnel allocations across projects?
Who has access to banking, accounting, payroll, and grant management systems?
And perhaps most importantly:
Who independently reviews the work being performed?
A growing organization may have more employees than ever before and still lack appropriate segregation of duties.
Clear process ownership, defined approval authority, and independent review become increasingly important as financial responsibilities expand.
3. More Transactions Increase the Opportunity for Errors
Growth typically means more invoices, reimbursements, payroll transactions, journal entries, and financial activity.
The volume alone creates additional risk.
Consider bank reconciliations.
When an organization processes fifty transactions monthly, reconciling its accounts may be relatively manageable.
When that number grows to five hundred, the same process may require additional procedures, documentation, and supervisory review.
For research organizations, similar pressures can affect grant reconciliations, project expenditure reviews, payroll allocations, and reimbursement requests.
A process that worked when an organization administered three sponsored awards may no longer be sufficient when it manages thirty.
Without adjustments, unreconciled differences may accumulate.
Expenses may remain charged to incorrect projects.
Errors can remain undetected.
And financial reports may become less reliable.
A process that worked at one level of activity may become inadequate at another.
4. Financial Reporting Needs Become More Sophisticated
As nonprofit and research organizations grow, leadership needs more than basic financial statements.
A growing organization may need:
Budget-to-actual reporting by program, grant, or research project
Cash flow projections
Restricted fund tracking
Grant spending and burn-rate reports
Principal investigator financial dashboards
Financial variance explanations
Monitoring of outstanding receivables and reimbursements
Regular reporting of financial and compliance risks
Yet some organizations continue presenting the same basic reports they used years earlier.
A statement of activities showing a positive operating result does not necessarily mean an organization has sufficient unrestricted cash.
Similarly, a healthy bank balance does not automatically mean those funds are available for general operations.
And a research project may appear to have available funding while outstanding commitments, personnel costs, or approaching award deadlines create financial concerns.
Growth requires better financial information, not simply more financial information.
When Growth Outpaces Oversight
One of the most concerning situations occurs when organizational leadership assumes that because financial reports are being produced, financial controls must be functioning.
Those are two different things.
Financial reporting tells leadership what has been recorded.
Internal controls help establish whether transactions were appropriately authorized, accurately recorded, adequately supported, and properly reviewed.
An organization can produce monthly financial statements and still have significant weaknesses in its underlying processes.
For example:
A grant expense may be recorded correctly in the general ledger but charged to an award that does not permit the expenditure.
A research payroll allocation may be recorded without adequate support for the distribution of personnel costs.
A bank reconciliation may be completed every month but never independently reviewed.
A journal entry may balance perfectly while lacking appropriate supporting documentation.
A vendor payment may be legitimate but processed without the required approval.
Accurate-looking financial statements do not automatically mean effective financial controls.
This is why ongoing financial oversight matters.
For boards, finance committees, and audit committees, effective oversight should be supported by documented information and evidence- not solely management's assurances.
Your Annual Audit Is Not Your Internal Control System
One misconception worth addressing is the belief that an annual financial statement audit provides sufficient ongoing financial oversight.
It doesn't.
An external financial statement audit serves an important purpose, but its primary objective is to provide an opinion on whether the financial statements are fairly presented, in all material respects, under the applicable accounting framework.
It is not designed to identify every operational weakness, compliance problem, or instance of fraud.
Auditors consider internal controls when planning their work, but a typical financial statement audit does not provide an opinion on the effectiveness of those controls.
That distinction matters.
An annual audit should not be the first time an organization discovers that its financial processes are no longer working effectively.
By then, a weakness may have existed for months.
A compliance requirement may have been missed.
An unsupported transaction may have been recorded.
Or a financial reporting problem may have affected management decisions throughout the year.
The goal should be to identify emerging issues before they become larger problems.
So, Have Your Controls Kept Up?
Growth doesn't automatically create financial problems.
But it does change the environment in which your financial controls operate.
More employees, more funding sources, more sponsored research activity, more transactions, more system access, and more complex reporting requirements create risks that may not have existed when current financial processes were designed.
The question isn't simply whether your organization has internal controls.
It's whether those controls are still appropriate for the organization you've become.
Growth changes risk.
And financial oversight has to change with it.
Is Your Financial Infrastructure Keeping Up With Your Growth?
Your nonprofit or research organization may look very different today than it did a few years ago.
Your financial controls should reflect that change.
The Pennies Count Internal Controls Assessment can help identify areas of financial oversight that may deserve a closer look, including approvals, segregation of duties, documentation, and independent review.k.
Take the Complimentary Internal Controls Assessment →
Because growth changes risk. Your financial oversight should grow with it.
Introducing Pennies Count Internal Audit Services
Pennies Count is introducing Outsourced Internal Audit Services for nonprofit and research organizations seeking stronger, ongoing financial oversight.
Our risk-based approach focuses on evaluating financial risks, testing internal controls, documenting findings, and following up on corrective actions.
The service is intended to provide leadership, boards, and oversight committees with information beyond management's assurances—without requiring organizations to establish an in-house internal audit department.
Because sometimes the most important question isn't “Did the auditor find anything?”
It's “Could we have found it first?”
Introductory consultations are available. Engagements are subject to scope, independence, professional readiness, and acceptance requirements.
Next in this series: Has Your Nonprofit Outgrown Its Financial Controls? 5 Signs to Watch
We'll look at five warning signs that may indicate your organization's financial processes and controls haven't kept pace with its growth.