Charity internal financial controls checklist

The rule: section 130, CC8 and who is responsible

Charity trustees in England and Wales have a legal duty to keep accounting records, and the Charity Commission’s guidance CC8 sets out the internal financial controls that make those records reliable. The duty is in section 130 of the Charities Act 2011: “The charity trustees of a charity must ensure that accounting records are kept in respect of the charity which are sufficient to show and explain all the charity's transactions, and which are such as to – (a) disclose at any time, with reasonable accuracy, the financial position of the charity at that time”. A charitable company keeps its records under the Companies Act 2006 instead: section 135 says sections 130 to 134 do not apply to it.

The Commission’s Internal financial controls for charities (CC8), last updated on 27 November 2024, describes controls as “essential checks and procedures to help you: protect your charity’s assets, including its money and property; make informed decisions about your charity’s financial position; meet your legal duties”, and says “All charities need financial controls, regardless of size.” It is clear about who answers for them: “You may choose to delegate the detailed work on financial controls to one or more trustees or to members of staff. But all trustees remain responsible for their charity’s financial management and for implementing and monitoring their charity’s internal financial controls.” A treasurer or finance committee does the work; the whole board owns the result.

The governing document comes first. CC8 says “Your controls must follow any requirements in your charity’s governing document”, and the Commission’s How to write your charity’s governing document (CC22b) expects the financial clauses to cover “who controls the bank account, who can sign cheques and if two signatures are needed, other internal financial controls”. A clause requiring two signatures is a rule, not a recommendation.

The CC8 checklist, section by section

The Checklist for reviewing your charity’s internal financial controls is a yes-or-no self-assessment attached to CC8. It tells trustees to “Answer the checklist based on your knowledge of what actually happens in your charity, not what you expect to happen”, to use only the sections relevant to their activities, and that “You must always comply with legal requirements identified in the checklist which are relevant to your charity.” Condensed, with the checklist’s own legal requirements marked:

• General principles. Regular financial information for every trustee; terms of reference for any finance sub-committee; approved budgets; training; an annual review; split duties; an incident procedure. Legal requirements: accounting records of all transactions, accounts that comply with the law, an annual report, an independent examiner or auditor where income requires one, and filing the annual report and accounts (income over £25,000, or any CIO) and the annual return (income over £10,000, or any CIO) on time.
• Operational risks. Trustees and staff know typical fraud risks; policies on bribery, hospitality and donations, and a register of interests; data held lawfully; equipment and online systems protected.
• Banking. Accounts in the charity’s name, listed, reconciled and properly authorised, with no unused accounts and no third-party use; “The bank mandate requires at least two signatories”; “Your online banking system requires authorisation of transactions by two individuals”; secure devices and an audit trail.
• Income. Legal requirements: public collections under the Commission’s fundraising guidance (CC20), Part II of the Charities Act 1992 where professional fundraisers are engaged, and the records HMRC requires for Gift Aid. Good practice: numbered, sealed collection boxes, “Two people are involved in counting and recording the income”, post opened in front of two people, and controls on card readers, trading income and legacies.
• Expenditure. A policy on authorising spending; invoices checked against orders; card statements sent to someone other than the card holder; dual authorisation for bank transfers and BACS; no blank cheques; minimal cash payments; a grant-making policy; expense claims that “are dual-authorised and do not involve the person making the claim”. Legal requirements on payroll: statutory deductions, PAYE records, the minimum wage, authorised deductions only, year-end returns and pension duties.
• Related parties. Any payment to a trustee, or to a person or organisation connected to one, is authorised and follows the governing document.
• Assets and loans. A fixed asset register; restricted funds spent only on their purposes and the law on permanent endowment followed; loans usually authorised at trustee level. Legal requirement: conflicts of interest managed on any loan to a related party.
• Hospitality and internal audit. A hospitality policy and a record of hospitality given, received or refused; an external audit where required, and an internal audit committee if so.

One figure in the checklist is now out of date. It still says an examiner or auditor is a legal requirement for gross income “over £25,000”; for financial years ending on or after 30 September 2026 the figure is £40,000, under the Charities Acts 1992 and 2011 (Substitution of Sums) Order 2026, as the Commission’s Threshold changes at a glance confirms. Its separate £25,000 figure for sending the report and accounts to the Commission is unchanged.

Bank accounts, the bank mandate and signatories

CC8 says the charity’s accounts should be in its own name, matching the governing document, and that opening or closing them should be “authorised by the whole trustee body” or delegated to a group who report to the trustees. Keep a list of every account and close those no longer used. CC8 still says deposits “may be protected by the Financial Services Compensation Scheme up to £85,000”; the Prudential Regulation Authority raised the limit to “up to £120,000 of a depositor’s money” from 1 December 2025, as the Bank of England’s 18 November 2025 release on the FSCS deposit limit announced.

The bank mandate names who can operate the account, and CC8 is specific: “You should: keep a clear record of who is named on your charity’s bank mandate; regularly review whether the bank mandate is appropriate for your charity; tell your bank of trustee changes; require dual authorisation to set up or change any bank mandate. The second person authorising any changes to the bank mandate should be a trustee”. It adds a control most small charities miss: the bank must get authorisation from named people for any change to the account details, and “The named people should not be involved in reconciling bank statements or collecting income.”

How many signatories? No statute sets a number for a charity in England and Wales. The CC8 checklist treats “at least two signatories” as good practice, and CC8 says “Check whether your charity’s governing document requires two signatories on cheques”; where it does, that is binding. Three or four signatories, any two to sign, survives a holiday or a resignation.

Who can be a signatory? Whoever the trustees name on the mandate within the governing document’s rules: usually trustees, and CC8 notes that “In larger charities, signatories may be senior employees.” CC8 does not say signatories must be unrelated, but two who are married or in business together are not much of a second check; treat that as a conflict of interest to manage.

Online banking. CC8 says “You should use a dual-authorisation system for your bank or building society accounts”, which “allows one person to create a payment request and another to authorise it.” CC8 also suggests only allowing payments into previously authorised accounts.

When a trustee leaves. Update the mandate, remove online banking access and cancel any card. OSCR’s steps to take when a charity trustee leaves puts it plainly for Scottish charities, and the advice holds everywhere: “Update any banking access to ensure that former charity trustees no longer have access to the charity’s bank account.” Our trustee resignation guide covers the other steps.

Splitting duties in a small charity, and who signs off what

The principle behind most of the checklist is CC8 section 2.7: “Make sure that more than one person is involved in all financial transactions. This means having a different person authorising a transaction to the person who made it.” CC8 also says “Make sure financial controls cannot be overridden by anyone.” Where there are not enough people, it offers a fallback: “If you cannot fully split duties due to a lack of people or money, you can manage the risk by: all trustees reviewing transaction reports; checking that internal controls are followed and sharing the results with all trustees”.

A board of five trustees with no staff can still make sure no one person controls money from start to finish:

• The treasurer keeps the books, sets up payments in online banking and prepares the monthly reconciliation.
• A second trustee authorises each payment in the bank, after seeing the invoice or claim behind it.
• A third trustee reviews the reconciliation and receives card statements, since CC8 says “card statements are sent to a different person than the card holder.”
• Two named contacts authorise changes to account details, and neither reconciles the account or collects income.
• The whole board agrees the budget before the year starts and sees the financial position at every meeting, which CC8 says should be “a standing agenda item at trustee meetings” and “sent to each trustee before the meeting”.

The payment controls are short. CC8 asks for “clear, written authority limits for placing orders and approving payments”, with invoices checked against orders and delivery. Only a limited number of people should set up transfers and BACS payments, and “You should make sure that the payment files cannot be edited between being created and uploaded onto the online banking system.” Cash payments should be small; payroll should not let anyone set their own pay; and CC8’s expenses policy includes “that an individual cannot approve their own claim”, which our volunteer expenses guide covers. Income needs the same second pair of eyes: for cash collections CC8 says “at least two people handle and record the cash”, and its donations policy should say “when and how donor checks are carried out”.

Payments to trustees are a category of their own. CC8 section 7 says that where the payee is a trustee, or an organisation connected to one, “you must have specific authority to make the payment”, and the conflict of interest has to be managed; our conflict of interest guide covers how.

The annual review, the record and when to escalate

CC8 section 2.6 sets the timetable: “Regularly review your charity’s financial controls to make sure they are still suitable. Do this at least once a year and always: after a significant financial loss or narrowly avoided significant financial issue; before or after a significant change in how your charity operates, for example, a new structure or increased funding”. This is Commission guidance rather than a statutory duty; the record below is what shows the review happened.

CC8 says “You should keep records of your reviews and how you have responded to any issues you have found.” A useful record is short:

1. the date, and who carried out the review (ideally not only the treasurer);
2. the completed checklist, answered for what actually happens;
3. each “no” answer, with the reason it is acceptable or an action, an owner and a date;
4. any loss or near miss since the last review, and what changed as a result;
5. the board minute that received the review and approved the actions.

Between reviews, the monthly bank reconciliation catches most problems: CC8 says the charity “prepares monthly reconciliations for all accounts. A second person in your charity should review these reconciliations to identify any discrepancies”. Larger charities may need an internal audit function or audit committee, which CC8 distinguishes from a statutory audit; a small charity without one should “regularly review whether an internal audit is needed”, and “If your charity is required to have an external audit, you should have an internal audit committee.”

When something goes wrong, CC8 section 2.8 says to record the incident and report it, and notes that “Auditors and independent examiners must report any matters of material significance to the Charity Commission.” Our charity fraud policy guide covers where each kind of incident is reported, the response plan and the incident register.

The approval that happened in a message

Every control in CC8 assumes that requests and approvals arrive through the bank or the finance system. In a small charity they usually arrive by message. The project lead sends the treasurer a photo of an invoice: “Can you pay this before Friday? They’re chasing.” A supplier’s email says their bank details have changed, and the treasurer forwards it to the chair with “OK to update?” The chair replies with a thumbs-up from a train. The second authorisation then happens in the bank, correctly, but the evidence of who asked for the payment, who checked the invoice and who agreed to the new account details sits on two personal phones.

A request to change a payee’s bank details is the moment CC8’s advice to check “that the recipient is known and trustworthy” exists for. If the change later proves fraudulent, the charity will want to show what it was told and what it checked, and when a trustee stands down the messages leave with their phone.

ComplyChat gives a board and its staff channels the charity owns, with everyone told the conversation is on the record from the first message. On paid plans, once the charity’s Microsoft 365 tenant is connected, the lasting record files there under the charity’s own retention rules. It is not a banking, payments or accounting system: it does not hold bank details, approve payments or replace dual authorisation, which still happens in the bank.

A question for the next board meeting: if the independent examiner asked who requested and who approved last month’s largest payment, and on what evidence, where would the answer be?

Questions people ask

What are some examples of financial controls?

Examples of charity financial controls from the Charity Commission’s CC8 include dual authorisation for online banking, monthly bank reconciliations reviewed by a second person, written authority limits for orders and payments, card statements sent to someone other than the card holder, two people counting cash collections, and a rule that nobody approves their own expense claim.

How often should a charity review its financial controls?

At least once a year: CC8 tells trustees to review their financial controls at least annually, and always after a significant financial loss or near miss and before or after a significant change in how the charity operates. It also says to keep records of each review and how the charity responded to the issues found.

How many signatories should a charity bank account have?

No law sets a number for charities in England and Wales, but the Charity Commission’s CC8 checklist treats a bank mandate requiring at least two signatories as good practice. The governing document may require two signatures on cheques, and where it does that rule is binding.

Who can be a signatory on a charity bank account?

A charity’s signatories are whoever the trustees name on the bank mandate within the governing document’s rules: usually trustees, and in larger charities sometimes senior employees, as CC8 notes. CC8 adds that the people the bank contacts to authorise changes to account details should not reconcile bank statements or collect income.

Do charities’ accounts need to be independently verified?

A charity in England and Wales must have its accounts independently examined or audited once its gross income exceeds £40,000, for financial years ending on or after 30 September 2026; the figure was £25,000 for earlier years. Above £1.5 million, or £500,000 with assets over £5 million, an audit is required, as the Commission’s Threshold changes at a glance sets out.

Official guidance and your next step

The primary source is the Charity Commission’s Internal financial controls for charities (CC8) and its checklist, read with section 130 of the Charities Act 2011 and the Commission’s current accounts thresholds. Quotations are from those pages as published on 8 October 2026.

This guide is a summary for charities in England and Wales, not legal or financial advice. Scottish charities should read OSCR’s guidance and Northern Irish charities the Charity Commission for Northern Ireland’s; your independent examiner or auditor can advise on controls for your charity’s size.

Then do one thing: before the next board meeting, ask the bank for the current mandate and compare it with the list of serving trustees. Anyone named who has left, and anyone serving who should be named and is not, is the first action in this year’s review.