When school money goes missing, it is almost never a stranger at the door. It is a system that let one person hold every key. Internal controls are the small, ordinary rules that make a school hard to steal from and easy to audit: who can approve, who handles cash, who holds passwords, and who checks the person who checks everything. Most of them cost nothing and take minutes to set up.
Why controls matter more than the numbers
The point of a control is not to catch a thief. It is to make the honest way the easy way, every single time. When a school has no controls, it is not that people are dishonest. It is that the school cannot tell the difference between an honest mistake and a deliberate one, and neither can the auditor.
- Controls protect the people, not just the money. The bursar who is the only person who can move money is one accusation away from career damage. Controls spread the responsibility so nobody carries that alone.
- Controls make the numbers believable. A figure nobody can double-check is a figure nobody should trust. The board, the auditor and the parents all depend on the school's numbers being verifiable.
- Controls are cheap compared with their absence. A lost month of fees, a falsified invoice or a skimmed cash box costs more than every lock and double-check combined.
Think of controls as a ladder: each rung is a small rule, and together they reach the top. None of them is impressive on its own. All of them together are the difference between a school that closes its books cleanly and one that hopes.
Separation of duties: the one that does the most
Separation of duties is the single most valuable control a school can have. It simply means no one person should do all three of these things for the same transaction:
- Authorise the payment. Decide the school owes the money in the first place.
- Process the payment. Raise it in the system, prepare the banking or sign the cheque.
- Reconcile the payment. Check it against the bank statement and the invoice at month end.
In a small school with a two-person finance team, the practical split looks like this: the bookkeeper records and pays, and the bursar reviews and reconciles. The bookkeeper cannot pay a bill and then sign off their own work. The bursar cannot authorise, pay and verify the same amount. It sounds basic, but it removes the single most common way school money is lost - one person controlling the whole life of a transaction.
If the school is too small for two people, the separation happens over time and in stages: the principal or board chair reviews one month's bank statement, the auditor reviews the next, and the patterns get noticed. Partial separation, honestly applied, is far better than none.
Approval limits: who can authorise what
Clear approval limits are the control that keeps spending sane. Decide once, write it down, and apply it without exception:
- Set a threshold that does not need a second opinion for routine, budgeted expenses - say, anything under a set figure that is already in the approved budget.
- Require a second signature or approval above the threshold. Big payments, new suppliers and anything not in budget need the bursar plus the principal or board chair.
- Never let the person who receives the money approve it. A parent refund, a fee adjustment or a write-off should always be approved by someone who is not the person handling the cash.
- Make exceptions visible. If the rules are bypassed for a "quick" payment, the decision should be recorded and flagged for the next review, not just done.
Approval limits work because they force a second pair of eyes at the moments that matter most. They also protect the bursar: a written, followed policy is the answer to the question every board eventually asks about how money decisions were made.
Cash handling: from the tuck shop to petty cash
Cash is where the old-fashioned frauds live, and cash is still everywhere in a school - the tuck shop, sports days, excursions, fundraising. The rules are the same at every cash point:
- Count cash in front of the person handing it over. Every handoff - tuck shop float to relief staff, gate takings to the office - gets counted and signed for, with the amount recorded.
- Petty cash runs on the imprest system. A fixed float, reimbursed only against a petty cash slip and a till slip, counted at each top-up. The float never grows and never shrinks without a paper trail.
- Bank cash promptly and intact. Takings go to the bank with a deposit slip that matches the takings record. Money that sits in a drawer for a week is money that cannot be verified.
- Receipt everything. Every cent of cash received earns a numbered receipt, and every receipt ties to a deposit. Unreceipted cash is how the school stops being able to answer the auditor.
The discipline of numbered receipts and signed handoffs is what lets a school say, with confidence, exactly how much cash passed through its hands and where it went.
Banking: signatories, limits and surprises
The bank account is the heart of school money, and it needs the tightest rules of all. Who can see the balance, who can authorise a payment and who can change an account detail should all be decided and written down. On the practical side:
- At least two signatories on every account, and no transaction moving without the second check where the bank allows it.
- Review account holders and signatories at least once a year. The person who left last term should not still be a signatory.
- Reconcile every account every month. A bank reconciliation done while the month is fresh is a control; one done six months later is a memory test.
- Watch for the quiet changes. A changed banking detail, an added user, a reissued card or a new beneficiary should ring alarm bells, not be a casual admin task.
Banking security deserves its own full treatment - from login discipline to fake invoices - and our banking security guide covers it in detail.
The month-end review as a control
Most controls live in month end, because month end is when the school looks at what actually happened. A month that closes cleanly is a month that was controlled. The essentials, which our month-end checklist turns into a routine:
- Reconcile the bank to the ledger, every month, on time. Unreconciled items become unexplainable items.
- Review unusual movements. Large payments, refunds, adjustments and write-offs get a second look each month, even when they are legitimate.
- Match invoices to payments. Every payment that left the account this month should tie back to an invoice the school actually owes.
- Sign off the month in a known place. A dated review by the bursar and a quick second look by the principal or board member closes the loop.
A school that closes its months properly has, in effect, reviewed its controls twelve times a year without adding a single meeting to the calendar.
Controls for very small schools
Smaller schools feel the tension hardest: the fewer the people, the harder separation becomes. If the school genuinely runs on one finance person, use the controls that work without extra hands:
- The board does the checks. A different board member reviews the bank statement and the reconciliations each month, on rotation. One person does the work; a different person verifies it.
- Use the accountant or auditor as a periodic second pair of eyes on a fixed schedule, not just at year end.
- Say what you cannot separate. Where the school cannot achieve full separation of duties, say so in the financial statements. Auditors would rather see the gap acknowledged and compensated for than hidden.
- Keep a low threshold for surprises. In a small school, every transaction is a material transaction. The approval thresholds should reflect that.
The honest answer for a very small school is that some duties will always be shared. The control is to make the sharing visible, reviewed and deliberate rather than assumed.
What your auditor expects to see
At year end, the auditor is not looking for a perfect school. They are looking for evidence that the school knows where its money went. That evidence is built all year in small, boring ways - and our year-end and audit readiness checklist collects the full list. The controls that matter most to an auditor:
- A written policy that matches practice. If the policy says two signatories and the bank shows one, that is a finding. Make the policy match what is real, or make reality match the policy.
- Signed reconciliations for every month. Not just the months that balanced.
- A trail for every unusual transaction. Write-offs, refunds and adjustments with approval and a reason attached.
- Records of who has access to what. System users, bank signatories and passwords, kept current and reviewable.
Schools with clean controls tend to have clean audits, and the two feed each other. The audit is not a separate ordeal; it is the annual report card on habits the school has been running all year.
Sources & further reading
- SAICA - professional guidance on governance and internal financial controls for organisations, including non-profits.
- ISASA: Financial Management - sound financial control systems and procedures for independent schools.
- How to Protect Your School from Fraud - the red flags and the checks that catch a problem early.
- Banking Security and Payment Approval - keeping the school bank account safe, day to day.
This page is general information, not legal, audit or accounting advice. Control requirements vary with your school's legal structure, size and circumstances. Confirm what applies to your school with your auditors or professional advisors.
