Internal Controls That Save a Two-Person Program

Internal controls aren't extra paperwork

They're the habits that keep a bad week from becoming an audit finding.

You know the feeling.

A reimbursement is due. A member file is half-updated. Someone's waiting on your answer. You're also the one who approves invoices, reviews timesheets, trains staff, and remembers where the signed forms live.

That doesn't mean you're careless.

It means you're carrying too much in too few hands.

That's why internal controls matter.

Under the Uniform Guidance, non-federal entities must establish and maintain effective internal control over the federal award that provides reasonable assurance they are managing the award in compliance with federal statutes, regulations, and the terms and conditions of the award. That's in 2 CFR § 200.303.

Reasonable assurance.

Not perfection.

That matters, because shame shows up fast in compliance work.

When something's missing, people hide. They postpone the folder review. They tell themselves they'll fix it next week. They avoid asking a basic question because they think they should already know the answer.

You don't need more shame.

You need a control set small enough to survive real life.

The AmeriCorps Office of Inspector General Anti-Fraud Advisories page includes an advisory titled Vol. 8: Why Do You Need Internal Controls? If you want the OIG's framing, check the current advisory text there. And before you update your procedures, verify the current regulatory text in the eCFR.

What internal control means in a two-person office

In a larger organization, people talk about segregation of duties as if it's a switch you can flip.

One person initiates.

Another approves.

A third reconciles.

A fourth monitors.

That's lovely when you have four people.

A lot of AmeriCorps programs don't.

If there are only two of you, or one and a part-time finance lead somewhere else in the building, the question isn't whether you can create perfect separation.

You probably can't.

The question is whether you can create a second look that's real.

Enough friction that errors get noticed.

Enough friction that fraud is harder to pull off.

Enough documentation that an auditor or monitor can see who did what, when, and on what basis.

For a small office, that's a practical way to support the reasonable-assurance standard in 2 CFR § 200.303.

So if one person has to prepare something, build a second step that's visible when you can.

Visible is the word that matters.

A review that leaves evidence is far easier to demonstrate and sustain than one that exists only in memory.

The smallest control set worth having

If your office is stretched thin, start here.

Not with a twenty-page manual.

With five habits.

1. Separate preparation from review whenever you can

If one person prepares a transaction, report, draw request, journal entry, or member-related record, another person should review it before it's final whenever staffing allows.

In a two-person office, that often means one person prepares and the other person reviews.

If your structure makes that impossible for a specific task, move the review up a level or outward. That could be an executive director, fiscal officer, grants manager, or board treasurer, depending on your organization's structure, internal approval authorities, and grant terms.

Practice varies here, so check your own terms and conditions.

The key is this: the reviewer needs enough information to verify the item, not merely bless it.

That means the preparer attaches or points to the support.

Not "looks right."

Support.

2. Leave evidence that review happened

A documented control will help you much more later.

For every recurring compliance task, decide what review evidence will look like.

Then use the same evidence every time.

For example, your review evidence might be:

• initials and date on a printed checklist,
• an approval email saved with the record,
• tracked changes or comments on a draft,
• a sign-off line on a reconciliation,
• a dated note on a cover sheet,
• a routing log that shows preparation and approval.

Pick one method per process if you can.

Consistency saves time.

It also keeps you from arguing with your future self about whether review really happened.

3. Match records to source support

Amounts charged to a federal award must be adequately documented under 2 CFR § 200.403(g). Federal award records also have to be retained and available as required by 2 CFR § 200.334.

That doesn't mean "attach everything."

It means you should know what supports the charge, report, or file entry, and keep that support where a reviewer can find it.

A source document.

A supporting schedule.

An approved form.

A roster.

An invoice.

A payroll record.

A certification, if one is required by the program or the award.

The exact support will differ by process, and your grant terms may add requirements beyond the baseline federal rule.

The control isn't the folder.

The control is the match.

4. Reconcile on a schedule

Some mistakes don't look like mistakes until you compare two records that should agree.

That's what reconciliation is for.

A monthly cadence is often a practical management choice for grant and accounting processes, but required timing depends on the award, applicable rules, and your organization's policies.

On the scheduled date, compare the report to the ledger.

Compare the roster to the files.

Compare the payments to the approvals.

Compare the checklist to the actual documents.

Then document who reconciled, what period was covered, what differences were found, and how they were resolved.

If nothing was off, write that down too.

No one remembers a clean review six months later.

5. Use a checklist for recurring high-risk tasks

Checklists don't make work bureaucratic.

They make work repeatable.

That's different.

For every process you do more than once, create a one-page checklist in the exact order the task should happen.

Short.

Specific.

Complete enough that a tired person can still use it.

A good checklist includes:

Element	What to include
Task name	The process being reviewed
Trigger date	When the review happens
Preparer	Who completes the first step
Reviewer	Who checks it
Source documents	What records must be present
Review steps	The exact checks, in order
Sign-off	Name, date, and outcome
Follow-up	Where corrections are noted

That one page does a lot of work.

It trains.

It standardizes.

It proves review.

It lowers the odds that stress will erase a step.

What to do when segregation of duties isn't fully possible

Say it plainly in your procedures.

Don't pretend your staffing chart is something it isn't.

If the same person must handle more than one part of a process, the compensating control should also be plain.

For example:

• If the same person prepares and submits a report, another person reviews the supporting documentation after submission or on a set schedule and signs a dated review log.
• If the same person collects documentation and maintains files, a supervisor performs a periodic spot check against a file checklist and notes exceptions.
• If the same person enters financial information, someone outside the process reviews the reconciliation to source support on a set schedule.

Those are practical examples.

They aren't universal federal scripts.

The point isn't to imitate a big organization's org chart.

The point is to design a second look that's real.

And documented.

Small offices don't need perfect separation. They need visible review they can show later.