Spotting Embezzlement Early: Anomaly Detection in Nonprofit Books

The Schemes That Actually Turn Up in a Small Shop

Knowing the mechanics matters, because each scheme leaves a distinct fingerprint in the data, and you cannot look for a pattern you have never heard described. The dominant category in small organizations is asset misappropriation, which is to say ordinary theft rather than elaborate financial statement manipulation. Within that category, a handful of schemes account for most of what a nonprofit will encounter.

Fictitious vendors are the classic. The bookkeeper sets up a vendor with a plausible name, often something generic like a consulting or maintenance company, and pays it. The vendor is a shell, sometimes a real bank account in a relative's name, sometimes simply a payee on a check deposited into a personal account. The data fingerprint is distinctive: a vendor with no W-9 on file, an address matching an employee address or a mailbox service, invoices with no purchase order or supporting detail, round-number amounts, and a payment history that begins abruptly at a meaningful dollar value rather than ramping up the way a genuine supplier relationship does.

Check tampering and altered payees remain surprisingly current in a sector that still writes checks. A check is recorded in the ledger as payable to a legitimate vendor, but the physical check is made out to someone else, or a signed blank check is completed later, or a voided check is quietly cashed. The tell is a mismatch between what the books say and what the bank image shows, which is why reviewing cleared check images against the register is one of the highest-yield reviews a board member can perform. No amount of ledger analysis finds this on its own, because the ledger is the side that was falsified.

Ghost employees and payroll manipulation show up as a person on payroll who does not work there, a terminated employee who keeps receiving deposits, inflated hours on a timesheet nobody countersigns, or unauthorized bonuses and rate changes applied by the person who administers payroll. Direct deposit accounts shared across multiple employee records are a strong signal, as are payroll records with no corresponding personnel file. Organizations that have tightened their payroll processes usually find that the fix is procedural, requiring a second person outside finance to approve every new hire, rate change, and bank detail change.

Expense reimbursement padding is the most common and the least dramatic. Personal meals coded as program expenses, mileage claimed for trips not taken, the same receipt submitted twice across two months, conference costs claimed after a registration was comped. Individually these are small, which is exactly why they survive, and cumulatively over several years they add up to real money. This is a category where AI review of submitted receipts genuinely helps, and it overlaps with the ground covered in our piece on expense reports and receipts.

Skimming is the theft of money before it ever enters the accounting system, and it is the hardest to detect because there is nothing to detect. Cash from a donation box, a portion of event ticket sales, proceeds from a raffle, currency in a thrift shop till. The only analytical handle is comparison: ratios of cash to card receipts that drift downward over time, event revenue per attendee that falls year over year without explanation, or collections that dip when one particular person counts them. Those comparisons are weak evidence on their own and strong prompts to improve the physical controls.

Credit card personal use, unauthorized transfers, and lapping round out the list. Organizational cards used for personal purchases and coded to vague accounts like miscellaneous or program supplies are common, particularly where nobody outside finance reviews the statement line by line. Unauthorized bank transfers move money to a personal account and are then concealed in the reconciliation, which the same person performs. Lapping is subtler and applies where receivables exist: a payment from Donor A is taken, and Donor B's later payment is applied to A's balance to hide the gap, with the shortfall rolling forward indefinitely. Persistent unexplained timing differences between when money arrives and when it is recorded are the signature.

Running This With QuickBooks, a Spreadsheet, and a Model

The practical question is how a finance director with no analytics background actually does this on a Tuesday afternoon. The answer is more mundane than people expect. You export a handful of reports, you clean them into flat tables, and you work through the test set with an AI assistant that writes the formulas and queries you would otherwise have to know. The model is not finding fraud. It is doing the data manipulation that has historically been the barrier, and it is explaining its reasoning so a non-specialist can check it.

Start with the exports. From QuickBooks Online, the Transaction Detail by Account report under the accountant section gives you the general ledger detail, and it exports to Excel. Pull the vendor list with addresses and contact details, the check register, a transaction list by vendor, the payroll register, and the audit log, which records who created or changed each transaction and when and is available as a CSV covering a rolling two year window. The native report exports arrive with merged cells, subtotal rows, and blank lines that break every pivot table you try to build, so the first genuine task is flattening them into one clean row per transaction line. This is exactly the kind of tedious reshaping an AI assistant handles well, and the same skills covered in our guide to AI in spreadsheets apply directly.

Think about what you are uploading before you upload it. A general ledger contains vendor names, employee names, donor names attached to restricted gifts, and sometimes client identifiers in program expense descriptions. Use a business-tier AI account with a contractual commitment that your inputs are not used for model training, keep personal data out of the file where the test does not need it, and consider replacing donor and client names with codes before analysis since almost none of these tests require a real name. Where the test genuinely needs identifying data, such as matching vendor addresses to employee addresses, run that comparison locally in the spreadsheet rather than pasting both lists into a chat window.

Then work test by test rather than asking one sweeping question. A prompt like "find the fraud in this file" produces confident nonsense. A prompt like "here are the columns in my general ledger export. Write an Excel formula that flags any transaction where the same vendor and the same amount appear within a fourteen day window, and explain what the formula does line by line" produces something you can verify and reuse. Ask for the logic in plain language alongside the formula, run it yourself, and spot-check a handful of results against the source records by hand. If the model cannot explain why a row was flagged in terms you can trace back to the data, do not act on that row.

Useful prompts follow that pattern across the test set. Ask it to summarize the distribution of transaction amounts and identify clustering immediately below stated thresholds. Ask it to compare two lists and report exact and fuzzy matches on address fields, with the fuzzy matches labeled as such. Ask it to list vendors that first appear in the ledger within the period and their first payment amount and date. Ask it to identify all manual journal entries in the final five days of each month, sorted by amount, with their memo text. Ask it to flag expense descriptions that are vague or generic across a threshold of dollar value. Each of these returns a list, and every list is a starting point for human review.

Two accuracy warnings matter here. Language models are unreliable at arithmetic performed in their heads, so any test that involves summing, counting, or comparing numbers should be executed as a formula or a query rather than trusted as a directly stated answer. And models will happily produce a plausible-sounding explanation for a pattern that is actually a data artifact, such as a duplicate row created by your export rather than a duplicate payment. Reconcile your flattened file back to the trial balance totals before you analyze it, which is the same discipline that makes month-end close work reliable, and treat a clean tie-out as the precondition for the whole exercise.

The Human Controls No Analysis Can Replace

Analytical review is detective. It finds things after they have happened, which is valuable, and it is strictly second best to the preventive controls that stop the scheme from starting. Every test in this article looks at data that the person under review may have created, and a determined insider who controls both the transaction and the record can make the data tell whatever story they choose. This is the fundamental ceiling on ledger analysis, and it is why the controls below are not optional extras.

Segregation of duties is the foundation, and the standard objection is that a three-person organization cannot segregate anything. The National Council of Nonprofits addresses this directly in its guidance on internal controls for nonprofits, and the answer is that separating authorization, execution, and review does not require three finance employees. It requires three people, and a board member or a program director can hold the review role. The single most important separation is that whoever reconciles the bank account must not also be able to create and sign payments.

Independent review of the bank statement is the control with the best return on effort in the entire list. A board member receives the statement unopened, or is given read-only online access, and reviews the actual cleared check images and the electronic transfers before anyone in finance touches it. This catches altered payees, unauthorized transfers, and unfamiliar vendors in a way no ledger analysis can, because it looks at the bank's record rather than the organization's. The Oregon Department of Justice includes this among its financial control recommendations for small nonprofits, and it costs an hour a month.

Mandatory vacation and cross-training work on a simple principle: most ongoing schemes require continuous maintenance to stay concealed, and the person maintaining them cannot be away. Requiring finance staff to take consecutive time off, with someone else genuinely covering their duties rather than letting the work pile up, is why banks have imposed this on tellers and officers for generations. The employee who has not taken a full week off in four years and who insists on handling the reconciliation from home while on leave is exhibiting a pattern worth noticing, though it is worth saying plainly that most such employees are simply conscientious and overworked.

Surprise reviews add the deterrent element that scheduled procedures lack. A scheduled annual review can be prepared for. An unannounced examination of how cash moves through an event, or a spot check of three months of credit card statements against receipts, or an unexpected request to see supporting documentation for ten payments cannot. Blue Avocado's rundown of five internal controls for the very small nonprofit makes the case that even tiny organizations can do this, and the deterrent value comes from the possibility rather than the frequency.

The reporting channel deserves particular attention given how fraud actually surfaces. Tips accounted for forty-three percent of the cases in the ACFE study, roughly three times the next most common detection method, and over half of those tips came from employees. That means your most effective detection mechanism is a colleague who notices something and has a way to say so without career risk. A named third party who receives concerns, a board chair contact published in the handbook, or a low-cost hotline service all work. What does not work is a policy that routes concerns through the executive director when the concern may be about the executive director. Boards that take financial oversight seriously own this channel directly.

When a Question Becomes a Credible Concern

There is a moment when an item stops being an anomaly and becomes something you cannot explain away: a vendor that does not exist at the address on file, a cleared check image with a payee nobody recognizes, a reconciliation that only balances because of a recurring adjusting entry with no support. What you do in the next few days shapes whether the organization recovers its money, keeps its insurance coverage, and survives the governance consequences. The instinct of almost every leader in this position is exactly wrong, so it is worth being explicit about the sequence. This is general guidance drawn from published legal commentary, not legal advice, and step four is where the real advice starts.

Do not confront the person. This is the instinct, and it is the most damaging available action. A confrontation gives notice, and notice gives an opportunity to delete records, alter entries, empty an account, or construct an explanation. It also risks an unlawful accusation against someone who may be innocent, and it can compromise a later investigation by tainting the sequence of events. Say nothing to the person, and say nothing to colleagues.

Preserve everything immediately. Take a complete backup of the accounting file, export the audit log before the two year window rolls, secure bank statements and cleared check images, and issue a litigation hold instructing that no records, emails, or files be deleted or altered. Venable's guidance on investigating and responding to allegations of fraud and embezzlement emphasizes preserving emails, notes, calendar entries, and financial documents, and doing so before anyone is aware an inquiry is underway. Preservation costs nothing and its absence is unrecoverable.

Tell exactly one or two people. Normally the board chair and the audit or finance committee chair. If the concern involves the executive director, go directly to the board chair and do not route it through the executive. If it involves the board chair, go to the vice chair or the audit committee. Keep the circle as small as it can be until counsel advises otherwise, because every additional person increases the chance the subject learns of it and the chance that an innocent person's reputation is damaged.

Engage independent counsel, then a forensic accountant if counsel advises. Independent matters. Your regular counsel may have conflicts, and an attorney engaged specifically for this can direct the investigation in a way that supports privilege over the work product. Counsel will advise on whether and when to engage a Certified Fraud Examiner or forensic accountant, whether to place anyone on administrative leave, when and how to suspend system and banking access, and whether and when to involve law enforcement or notify your state charity regulator, which some states require.

Notify your insurer promptly. Employee dishonesty coverage, sometimes still called a fidelity bond, and commercial crime policies typically carry strict notice requirements and discovery windows, and late notice is one of the most common reasons a legitimate claim is denied. Read the policy for the notice deadline and the definition of discovery, and have counsel review the notice before it goes out. This is also where organizations discover the coverage they assumed they had was never purchased, which is a conversation worth having before you need it, alongside the wider review of nonprofit insurance exclusions.

Worth noting that external fraud follows a different playbook. A payment diverted by a spoofed email from someone impersonating a vendor or the executive director is a criminal act by an outsider exploiting your process, and the immediate steps involve the bank's fraud desk and law enforcement rather than an internal investigation. We cover that scenario separately in our piece on phishing and wire fraud, and the two are easy to confuse in the first hours.

Building the Rhythm Into a Normal Quarter

A review that happens once, in a moment of anxiety, is worse than useless, because it will look targeted and it will teach the organization nothing about its own baseline. The value comes from repetition. Put the analytical review on the calendar quarterly, assign it to someone outside the transaction-processing function, and give the output a standing place on the finance committee agenda so that reporting no findings is as routine as reporting findings.

Who runs it matters more than what tools they use. The ideal owner is the finance committee chair or a board member with financial literacy, working from exports that a staff member provides on request. The second best is an executive director reviewing the bookkeeper's data, which is acceptable in a small shop but leaves the executive director unreviewed. The arrangement to avoid is the bookkeeper running the review on their own work, which converts a control into a formality. If your organization has no realistic reviewer on the board, this is a strong argument for adding one, and it is a more useful recruitment criterion than the vague call for financial background that most boards use.

Keep a written record of each quarter's run: which tests were executed, how many items each returned, which were reviewed, what the explanations were, and what was verified independently. This does three things. It demonstrates to your auditor and your board that a detective control exists and operates, which matters for the control environment assessment. It creates the baseline that makes next quarter's numbers interpretable, because a jump from four flagged items to nineteen is itself information. And it protects the reviewer, because a documented routine process is defensible in a way an undocumented inquiry into a colleague is not.

Expect the early quarters to surface housekeeping rather than crime. The first run typically finds duplicate payments made in error and worth recovering, vendors that should have been deactivated years ago, coding inconsistencies that distort program reporting, missing W-9s, and approval thresholds that no longer match the organization's spending. That is a genuinely good outcome and a much more likely one than catching a thief. Cleaning that up improves the quality of everything downstream, from your chart of accounts to the reports your board relies on to make decisions, and it tightens the environment that a would-be scheme would have to survive.