Internal Financial Controls That Complement Fidelity Coverage

Controls and coverage perform different functions

An approval rule may make an unauthorized payment harder to complete, while a reconciliation may help reveal it. Fidelity or crime coverage may address a resulting loss only when the facts satisfy the contract's insuring agreement and all applicable conditions.

Use strong controls alongside coverage, then review the complete policy or bond wording for the protection selected.

Separate incompatible duties

A useful design avoids giving one person unchecked ability to create a payee, initiate and approve a payment, receive the statement, and reconcile the account. Separation can involve board members, staff, a manager, and outside service providers.

Small associations may not have enough people for ideal separation. They can consider compensating reviews such as direct bank-statement delivery to a non-signer, read-only board access, transaction alerts, and periodic external accounting procedures selected with a qualified accountant.

Include digital payment and identity controls

Control inventories should cover ACH, wire, card, peer-to-peer, lockbox, and vendor portals—not just checks. Multi-factor authentication, unique accounts, transaction limits, callback procedures using known contact information, and prompt deprovisioning can address distinct failure points.

A callback is different from replying to the message that requested a change. Independently sourced contact information may help detect an impersonation attempt, but the effectiveness of any procedure depends on consistent execution.

• Prohibit shared banking credentials where feasible.
• Alert more than one authorized person to unusual transfers.
• Verify vendor-bank changes outside the requesting channel.
• Test recovery and access-removal procedures.

Test whether the control actually operated

A written policy is only the design. Periodically sample approvals, reconcile user lists to current roles, inspect evidence of independent review, and follow exceptions to resolution. Scale testing to the association's size, transaction volume, and risk profile.

Retain dated evidence and revise the process after personnel, bank, manager, or technology changes. A qualified accountant, insurance professional, and counsel can help address their respective disciplines without treating one review as a substitute for another.