Nonprofit organizations occupy a unique position in American society. They are entrusted with public trust, donor dollars, and the responsibility to serve vulnerable populations. Yet this very position of trust creates vulnerabilities. Nonprofits face elevated fraud risk due to limited resources, mission-driven priorities, and gaps in financial oversight . The Association of Certified Fraud Examiners has consistently found that organizations with poor internal controls suffer disproportionately high fraud losses. For nonprofits across Virginia and Washington DC, understanding fraud risk is not about assuming the worst of people. It is about recognizing that good intentions alone do not protect assets, donor trust, or organizational reputation. This guide examines the unique fraud risks facing nonprofits, the role of audits in detection and deterrence, and practical steps for building a culture of accountability. Why Nonprofits Are Vulnerable to Fraud The nonprofit sector employs millions of Americans and manages billions in charitable assets. Yet the structure of many nonprofits creates inherent vulnerabilities : Limited Resources and StaffingMany nonprofits operate with lean administrative teams, often relying on volunteers who may have limited financial training. When one person handles multiple financial functions—receiving donations, recording them, and making deposits—the risk of undetected misappropriation increases significantly. Mission-Driven FocusDirectors and executives naturally focus their efforts on achieving the mission. This passion for the cause can lead to neglect of administrative and financial oversight functions. As one analysis noted, “fraud can easily take place in non-profits because directors tend to focus their efforts on achieving the mission and often neglect other areas of the organization” . High Reliance on VolunteersVolunteers are the lifeblood of many nonprofits, but they may lack the training or familiarity with financial controls that paid staff would have. They may also be less likely to question unusual transactions or raise concerns. Trust-Based CultureNonprofits often operate in a culture of trust. Board members and staff may hesitate to question the actions of long-serving colleagues or respected community leaders. This trust can become a barrier to implementing the skepticism and verification procedures that prevent fraud. Common Fraud Schemes in Nonprofits Understanding how fraud occurs is the first step toward preventing it. Common schemes targeting nonprofits include : Misappropriation of DonationsThis includes skimming cash donations before they are recorded, stealing from donation jars, or diverting online donations to personal accounts. Smaller, frequent donations are particularly vulnerable because they may not be individually tracked. Manipulation of Financial ReportingThis involves falsifying financial statements to hide losses, inflate program accomplishments, or misrepresent the use of restricted funds. It can also include overstating revenue to meet budget targets or understating expenses to show program efficiency. Fraudulent Vendor ActivityThis includes creating fake vendors, submitting false invoices, or colluding with real vendors to overcharge for goods or services. Kickback schemes are a common variant, where an employee receives personal benefit in exchange for approving inflated invoices. Expense Reimbursement FraudEmployees or volunteers may submit false expense reports, duplicate receipts, or claim reimbursements for personal expenses. Without proper review and documentation requirements, this scheme can go undetected for long periods. Payroll FraudThis includes ghost employees (fictitious workers on the payroll), falsified timesheets, or unauthorized pay rate increases. In nonprofits with volunteer coordinators or stipend programs, distinguishing between legitimate compensation and fraud can be challenging. The Role of Audits in Fraud Detection and Deterrence Independent audits play a critical role in nonprofit financial oversight, but it is important to understand both their capabilities and limitations. What Audits Are Designed to Do Financial statement audits are designed to provide reasonable assurance that financial statements are free from material misstatement, whether due to error or fraud . Auditors are required to maintain professional skepticism throughout the engagement and to consider the potential for fraud in planning and performing audit procedures. The audit process includes: Understanding the organization’s internal controls Assessing risks of material misstatement due to fraud Performing procedures to detect material misstatements Communicating findings to management and the board What Audits Are Not Designed to Do While audits can deter fraud and may detect it, they are not specifically designed to detect intentional misconduct . Audits provide reasonable assurance, not absolute assurance. A clean audit opinion does not guarantee that no fraud occurred; it means the auditor did not identify material misstatements during the audit. This distinction is critical for boards and executives. They cannot rely solely on the annual audit to protect organizational assets. Strong internal controls and a culture of accountability are essential complements to the audit process. Internal Controls: The Foundation of Fraud Prevention Internal controls are the policies and procedures that safeguard assets, ensure accurate financial reporting, and promote compliance with laws and regulations. For nonprofits, internal controls are not optional—they are essential . Segregation of Duties The most fundamental internal control is segregation of duties. No single individual should have control over all aspects of a financial transaction. Ideally, the person who authorizes a transaction should be different from the person who records it and different from the person who reconciles the account . For small nonprofits with limited staff, full segregation may not be possible. In these cases, compensating controls are essential. These may include: Board member review of bank statements Dual signatures on checks above certain thresholds Surprise audits or reconciliations Rotation of financial duties among staff or volunteers Cash Receipts Controls The Virginia Society of CPAs recommends specific controls for cash receipts in nonprofit organizations : Incoming mail should be opened and listed by persons other than those who have access to cash receipts journals and accounts receivable records Pre-numbered receipts should be given for all contributions and gifts Checks should be stamped “For Deposit Only” by the person opening the mail Cash receipts should be entered in journals by persons other than those opening mail and listing receipts Receipts of checks and cash should be deposited each day intact Individuals handling cash should not make entries to the general ledger or subsidiary ledgers Individuals handling cash should be bonded Cash Disbursement Controls Controls over payments and disbursements include: Requiring
For Virginia’s approximately 53,000 registered nonprofit organizations, 2026 has brought a wave of regulatory changes that demand immediate attention. From the IRS’s long-awaited overhaul of group exemption rules to stricter donor disclosure requirements and the expansion of state-level charitable solicitation enforcement, nonprofit leaders must now navigate a more complex compliance environment than ever before. This guide provides a comprehensive overview of the key changes affecting Virginia nonprofits in 2026, with practical steps for maintaining compliance, protecting tax-exempt status, and ensuring audit readiness. The Group Exemption Overhaul: Revenue Procedure 2026-8 A Forty-Year Gap Finally Closed On January 20, 2026, the IRS reopened its group exemption program with the release of Revenue Procedure 2026-8, ending a multi-year suspension on new group exemption applications . The new guidance replaces rules dating back to 1980 and materially changes how group exemptions are obtained, maintained, and monitored . A group exemption allows a tax-exempt central organization to obtain IRS recognition of exempt status for multiple affiliated subordinate organizations under a single group exemption letter, eliminating the need for each subordinate to apply individually . The IRS suspended acceptance of new applications in 2020 while undertaking a broader review of the program, citing concerns that the decades-old rules no longer reflected modern nonprofit operations or provided sufficient guardrails for oversight and accountability . Key Changes Under Revenue Procedure 2026-8 The new guidance imposes significant structural, governance, and reporting requirements on central organizations and their subordinates : Minimum Size RequirementsA central organization must have at least five subordinate organizations to obtain a new group exemption, though the exemption may continue so long as at least one subordinate remains . Single Group Exemption LetterEach central organization may maintain only one group exemption letter, requiring organizations with multiple historical group rulings to evaluate consolidation during the transition period . Uniform Purpose StatementSubordinate organizations sharing the same purpose must adopt a uniform purpose statement, even though complete uniformity of governing documents is not required . Supervision and ControlCentral organizations must demonstrate general supervision or control over subordinates, which may be established through written agreements governing activities or operations . The IRS will apply a facts-and-circumstances analysis and will not permit reliance on intermediate tiers to establish supervision . Annual ReportingCentral organizations must file Supplemental Group Ruling Information (SGRI) annually to report changes in subordinate organizations and to add or remove subordinates . Compliance Deadlines Organizations holding group exemption letters in effect as of January 20, 2026, must complete required updates and filings by January 22, 2027 . Failure to file SGRI or failure to exercise adequate supervision or control may result in termination of the group exemption . If more than half of a group’s subordinates are automatically revoked, the IRS may terminate the group exemption entirely . Practical Steps for Virginia Nonprofits Organizations with existing group exemptions should take immediate action : Inventory all subordinate organizations to confirm the group meets minimum size requirements Confirm consistent Section 501(c) classification across all subordinates Document supervision and control arrangements through written agreements Evaluate consolidation of multiple group exemption letters Prepare for enhanced annual reporting well in advance of the January 2027 deadline Virginia’s many large nonprofit networks and associations—including faith-based denominations and statewide advocacy organizations—should begin this process immediately. Donor Disclosure and Written Acknowledgment Requirements The Importance of Proper Documentation For nonprofit organizations in Virginia and DC, donor disclosure is not just a best practice—it is a legal requirement with significant consequences for noncompliance. The IRS requires organizations to provide written disclosure statements to donors in specific circumstances, and failure to comply can result in penalties . Quid Pro Quo Contributions When a donor receives goods or services in exchange for a contribution, the organization must provide a written disclosure statement . This statement must inform the donor that the deductible amount is limited to the excess of the contribution over the fair market value of the goods or services provided . For example, if a donor contributes $150 and receives a cookbook valued at $25, the disclosure statement must state that the deductible amount is limited to $125 . Penalties for Noncompliance: Organizations may be fined $10 per contribution, up to $5,000 per fundraising event or mailing, for failing to provide a written disclosure statement at the time of solicitation or upon receiving the contribution . Exceptions to the Disclosure Rule Not every contribution requires a disclosure statement : Insubstantial tokens: Goods or services that are so small they do not need to be documented separately (e.g., items bearing the organization’s logo that cost $10.40 or less, adjusted for inflation) Annually recurring membership benefits: Rights or privileges provided as membership benefits do not need documentation if the payment is $75 or less Intangible religious benefits: These do not need to be documented Non-Quid Pro Quo Acknowledgments Even when no goods or services are provided in return for a contribution, donors cannot claim a tax deduction for any contribution of $250 or more without a written acknowledgment from the organization . The acknowledgment must include : The name of the organization and date of the contribution The cash contribution amount A description (but not value) of any noncash contributions A statement that no goods or services were provided in return for the contribution (if applicable) A statement that goods or services consisted entirely of intangible religious benefits (if applicable) Organizations should send acknowledgments to donors no later than January 31 of the year following the donation . Virginia-Specific Requirements Virginia’s charitable solicitation law includes specific disclosure requirements for solicitations. Organizations must include a statement in solicitation materials informing donors that financial information is available from the Virginia Department of Agriculture and Consumer Services (VDACS) . Professional solicitors operating in Virginia must make specific disclosures during oral solicitations, including identifying themselves by their real name, stating affirmatively that they are a “paid solicitor,” and disclosing the name of the charitable organization they represent . Charitable Solicitation Registration: Virginia and DC Requirements Virginia Registration Requirements All charitable organizations that intend to solicit
For nonprofit organizations and government entities across Virginia and Washington DC, receiving federal grant funding represents both opportunity and obligation. With that funding comes the requirement to demonstrate—through an independent Single Audit—that federal dollars were spent properly, documented thoroughly, and used only for their intended purposes. The Single Audit is not a routine financial statement audit. It is a comprehensive examination that combines financial statement review with detailed compliance testing of major federal programs. For organizations expending $1,000,000 or more in federal awards in a fiscal year, the Single Audit is mandatory under the Uniform Guidance. This guide provides a comprehensive overview of the Single Audit process, from pre-audit preparation through final report issuance, and explains what organizations must do to ensure a smooth and successful audit. Understanding the Single Audit Requirement The Single Audit requirement applies to any non-federal entity—including nonprofits, state and local governments, colleges and universities, and healthcare providers—that expends $1,000,000 or more in federal awards during its fiscal year. The threshold was increased from $750,000 to $1,000,000 effective for fiscal years beginning on or after October 1, 2024. The audit is conducted in accordance with the requirements of 2 CFR Part 200, commonly known as the Uniform Guidance. The Single Audit examines two distinct but interrelated areas: Financial Statement Audit: An examination of the organization’s financial statements to determine whether they are presented fairly in accordance with GAAP. Compliance Audit: Testing of the organization’s compliance with the specific requirements of its major federal programs, including allowable costs, procurement, cash management, and reporting. The Schedule of Expenditures of Federal Awards (SEFA) A critical component of the Single Audit is the Schedule of Expenditures of Federal Awards (SEFA). The SEFA is a supplementary schedule that lists all federal awards expended during the fiscal year, organized by federal agency and program. The SEFA must include: The name of the federal program The Assistance Listings number (formerly CFDA number) The federal agency providing the award The amount expended during the fiscal year The amount passed through to subrecipients The SEFA serves as the foundation for determining which programs are considered “major programs” subject to detailed compliance testing. Errors or omissions in the SEFA can lead to incorrect major program determination and audit findings. Determining Major Programs: The Risk-Based Approach Not every federal program is tested in a Single Audit. Instead, auditors use a risk-based approach to identify “major programs” that receive focused testing. The process involves: Step 1: Calculate the Type A ThresholdThe Type A threshold is the dollar amount above which a federal program is considered “large.” For entities with total federal expenditures between $1 million and $10 million, the Type A threshold is $750,000. For larger entities, the threshold increases. Step 2: Identify Type A ProgramsAll programs exceeding the Type A threshold are candidates for major program status. Step 3: Assess RiskAuditors assess risk for each Type A program and certain Type B programs (programs below the Type A threshold) based on factors including: Whether the program is considered “high-risk” by the federal agency The results of prior audits The complexity of the program requirements The amount of federal funds expended Step 4: Select Major ProgramsAt minimum, auditors must test major programs that in aggregate expend at least 40% of total federal awards. Programs are selected based on risk assessment and the requirement to cover a percentage of total expenditures. Internal Controls Over Compliance The Single Audit requires auditors to obtain an understanding of and test internal controls over compliance for each major program. The Uniform Guidance identifies several “compliance requirements” that organizations must meet, including: Activities Allowed or Unallowed: Costs must be allowable under the program’s terms. Allowable Costs/Cost Principles: Costs must comply with the Cost Principles in Subpart E of the Uniform Guidance. Cash Management: Drawdowns must be timed to minimize the time between receipt and disbursement. Eligibility: Only eligible participants may receive services. Equipment and Real Property Management: Property must be used for authorized purposes and properly maintained. Matching, Level of Effort, Earmarking: The organization must meet any matching or cost-sharing requirements. Period of Performance: Costs must be incurred within the approved period. Procurement and Suspension and Debarment: Purchases must follow procurement standards, and the organization must verify that vendors are not suspended or debarred. Program Income: Income generated by the program must be treated in accordance with program rules. Reporting: Reports must be accurate and timely. Subrecipient Monitoring: Pass-through entities must monitor subrecipients. Special Tests and Provisions: Program-specific requirements. Common Single Audit Findings Auditors frequently identify several categories of findings in Single Audits. Understanding these common issues helps organizations prepare and avoid them. Documentation and Recordkeeping Deficiencies Missing receipts, incomplete time and effort documentation, and inadequate supporting documentation for expenditures are among the most common findings. Organizations must maintain records that clearly demonstrate how every dollar of federal funding was spent. Procurement Violations Federal procurement standards require that purchases above certain thresholds follow specific procedures, including competition and documented selection. Organizations that fail to follow procurement rules risk questioned costs. Subrecipient Monitoring Failures Organizations that pass federal funds to subrecipients must monitor how those funds are used. Common failures include not conducting risk assessments, not obtaining required audits, and not following up on findings. Time and Effort Reporting Issues Salary and benefit costs charged to federal awards must be supported by time and effort records that accurately reflect the work performed. Improperly documented time and effort is a frequent audit finding. Reporting Errors and Late Submissions Federal grant reporting requirements are strict. Late submissions, inaccurate reports, and failure to submit required reports are common findings. Preparing for a Single Audit Organizations that prepare thoroughly for a Single Audit experience fewer findings, shorter timelines, and lower costs. Key preparation steps include: 1. Maintain Year-Round Audit ReadinessDo not wait until audit season to organize records. Maintain a system that ensures documentation is complete and accessible throughout the year. 2. Review the SEFA CarefullyReconcile the SEFA to your general ledger. Ensure all federal awards are included