Every article on internal controls opens with the same diagram: one person receives the money, a different person records it, and a third person reconciles the bank statement. It is good advice, and it is advice most churches under a couple hundred people cannot follow, because there is no third person. There may not be a second. The treasurer, the counter, and the one who reconciles the account are sometimes the same tired volunteer who also unlocks the building on Sunday morning.
This is not a confession to make quietly and hope no one asks about. It is the actual condition of most small churches, and it has an actual answer. When you cannot separate duties by adding people, you separate them by adding structure: a handful of habits that do not require a bigger staff, only a bit more discipline from the people already there. That is what the rest of this is about.
Why the textbook version assumes a staff you don't have
Separation of duties, as it is taught in every nonprofit accounting course, rests on a simple idea: no single person should be able to both commit a mistake or a theft and hide it. That requires enough hands that each stage of a transaction — collecting, recording, approving, reviewing — belongs to someone who did not do the stage before it. A denomination with a regional office, or a church large enough for a paid finance director and a volunteer audit committee, can staff that out.
A church of eighty people running on two or three willing volunteers cannot. The treasurer answers to the pastor, who also approves the treasurer's own reimbursement checks. The person who counts the offering on a slow Sunday is sometimes the only person who showed up early enough to help. None of this makes anyone dishonest. It makes the system honest-dependent, which is a different thing, and a fragile one — not because your treasurer is untrustworthy, but because an honest person under stress, or a replacement treasurer three years from now who is not as careful, is exactly the failure mode these controls exist to catch early.
Name the risk instead of denying it
The worst version of this problem is the church that pretends it does not exist. Naming it plainly, in a finance committee meeting or even in your bylaws, does two things: it removes the awkwardness of asking a beloved long-serving treasurer to accept a second set of eyes, and it puts the decision about compensating controls on the record rather than in one person's head.
A short paragraph is enough. Something like: our church does not currently have enough volunteers to fully separate financial duties; the following controls exist to reduce that risk until we do. Then list the three or four things below. This single act of writing it down is, on its own, a meaningful control — it means the gap was a decision, not an oversight, and the next treasurer inherits a plan instead of a vacuum.
The one control worth doing even if you do nothing else
If your church can commit to exactly one thing, make it this: every month, someone who does not touch deposits or write checks looks at the actual bank statement, transaction by transaction, against whatever giving and expense records exist. This is not the treasurer reviewing their own work. It is a second person — a board member, another volunteer, a spouse with no financial role at the church — spending fifteen minutes with the statement.
What they are looking for is not sophisticated: a check they don't recognize, a transfer that doesn't match anything in the records, a round-number withdrawal with no explanation. Most churches that discover a problem discover it exactly this way, months or years after it started, because nobody was doing this fifteen-minute review in real time. Doing it monthly instead of annually is the difference between catching an error the week it happens and catching it after two years of it compounding.
Rotate the pairs, even when the pool is small
Two people counting the offering together is a control only if the same two people are not always paired. If your treasurer is one of only two willing counters, rotate who the second counter is week to week rather than defaulting to the same partner every time — a third or fourth volunteer who counts once a month is enough to break up a standing pair. The goal is not to accuse anyone of collusion. It is that a genuine mistake, made by one counter, gets caught by someone with fresh eyes rather than a partner used to their patterns.
The same logic applies to who deposits the count and who records it in your system. If the treasurer must do both because nobody else is available, at minimum have the count sheet signed by both counters before it leaves the room, and file it somewhere the treasurer does not also control. A paper trail that exists independent of the treasurer's own records is worth more than it sounds like it should be.
Make the records themselves hard to quietly change
One reason small churches are exposed is not usually intent — it is that spreadsheets and paper ledgers leave no trace of what changed. A number gets edited in a cell, a row gets deleted, and six months later nobody can say what the original entry was, or when it changed, or who touched it. That absence of a trail is itself a risk, independent of anyone's honesty, because it means an honest error looks identical to something worse and neither one can be sorted out after the fact.
SundayBridge keeps a record of when giving entries were created and edited, so a change made after the fact is something a reviewer can see rather than something silently overwritten. It does not replace a second person looking at the numbers — nothing does — but it means that fifteen-minute monthly review from the section above actually has something solid to check against, instead of a spreadsheet where last month's version is already gone.
Give the reviewer something to check, on a schedule
A compensating control only works if it happens on a schedule nobody has to remember to start. Folding it into your weekly admin rhythm means the count gets reconciled the same week it happens, not whenever someone gets around to it. And treat year-end giving statements as a second, larger checkpoint — reconciling twelve months of entries against deposits before you send a single statement will surface almost anything that slipped past the monthly review.
It also helps to look at giving trends with the reviewer's eye rather than only the treasurer's. A sudden dip that lines up with nothing — no holiday, no announced absence, no change in attendance — is worth a question, even a friendly one. Most of the time the answer is mundane. The value is in asking regularly enough that it stays mundane.
Revisit the plan once a year, on purpose
Volunteers move, treasurers retire, a church grows from eighty to a hundred and fifty and suddenly has three willing hands instead of one. Set a fixed point — your annual meeting, or the same week every January — to ask whether your compensating controls still match your actual staffing. A church that outgrows its workaround but keeps running it out of habit is carrying risk it no longer needs to.
The honest goal here is not to eliminate risk. A church of this size cannot fully separate duties, and pretending otherwise wastes effort better spent on the controls that are actually available. The goal is a short, written, regularly-followed plan that a stranger — a new pastor, an insurer, an auditor — could read and understand exactly what protects the money and who is responsible for each part. That plan, kept current, is worth more than an org chart you don't have the people to fill.
If you write down only one sentence from this article, make it the monthly bank review by someone other than the treasurer. It is the cheapest control here and it catches the most.