External Audits and Reviews
Independent External Audits: If the AVO can afford the cost, having an annual audit performed by a CPA is the best protection with regard to the occurrence of unfortunate errors or purposeful misrepresentations/financial abuses. The knowledge that a CPA will be auditing the AVO is a strong deterrent to those who might be tempted to misuse the assets of the AVO. An annual audit by a CPA therefore is a powerful preventative control. However, in the event that errors or financial abuse do occur the audit also serves as a detection control that can minimize losses.
The audit by a CPA is very expensive, and rightfully so, as the CPA must perform a lot of work and tests to meet generally accepted auditing standards and if he or she misses something (Everything is done on a sample basis and as stringent as auditing standards are there is still a chance that a problem will still go undiscovered.) the cost of the possibility of mounting a legal defense must be built into the audit fee. If an AVO cannot afford an annual audit (and most will not be able to bear the cost), as suggested in the Basic Internal Controls that every All Volunteer Organization (AVO) Should Have section of this resource, the AVO should consider whether it can pay a CPA for an audit every few years and have internal audits performed for the years where there is not an external audit by the CPA.
Independent External Review: Another approach that many AVOs (and larger nonprofits and small businesses take, for that matter) may consider if the cost of an external audit is not possible, is to have a review of the financial statements performed by a CPA. A review is not an audit. There is less work involved for the CPA and therefore the cost is lower. The tradeoff is that while an audit provides what is called "reasonable assurance" that the financial statements are fair, a review provides only "limited assurance." Sometimes those who are familiar with how audits work, assume that if the work is done by a CPA, it is in fact an audit. AVOs should be careful to determine exactly what level of assurance the CPA is providing. Unfortunately, there is sometimes similar confusion regarding the performance of a "compilation" by a CPA. A "comp," as it is often called in business circles, provides no assurance and even if done by a CPA does not represent a preventative or detective control at all. If there is any question on what level of assurance is being provided by a CPA, just ask him or her. He or she will be glad to explain exactly what they are doing and what it means, or doesn't mean, to the AVO. The CPA never wants any misunderstanding.
Of course, many AVOs cannot afford an external audit or review by a CPA at all, in any year. So, the alternative that should be implemented is an internal audit discussed on the next page.
Next: Internal Audits