Charity Fraud Awareness Week: a 20-minute controls check
Charity Fraud Awareness Week runs from 2 to 6 November 2026. The campaign encourages charities to bring trustees, staff and volunteers together to strengthen fraud awareness.1
The Charity Commission says fraud can affect any charity. Trustees should identify the risks, take action and check that their controls are working.2 A short practical test can reveal more than a policy that nobody has used recently.
Set aside 20 minutes with two people who understand how money moves through your charity. Work through these four checks.
1. Follow one payment from request to review
Choose a recent supplier payment or expense and trace each stage. Who requested it? Who checked the amount and recipient? Who approved it? Who later matched it to the bank statement and accounting records?
The Charity Commission advises charities to split duties so that one person cannot control funds from start to finish. It also recommends dual authorisation for online banking and a second-person review of monthly bank reconciliations.3
If one person currently completes every stage, record one proportionate improvement. A small charity could require a second trustee to approve new payees and review the monthly reconciliation.
2. Test an unexpected change
Use a fictional example: a regular supplier sends new bank details and asks for urgent payment today. Ask the team to explain exactly what they would do next.
Your process should require people to pause, check that the recipient is known and trustworthy, and follow the charity's approval rules. Security details must stay private.3 Make sure urgency never removes the agreed checks.
Write the process in one place people can find quickly. Include who can approve a new payee, how the change is verified and who records the decision.
3. Compare donation records with money received
Pick a recent week or month and compare the donation records with your bank and accounting records. Investigate missing, duplicated or unexpected entries while the details are still easy to trace.
Charities already listed on Wonderful.org can download full donation and Gift Aid information as a CSV file from the Donation data section of their account. A date range can be selected before download.4 Use that export as one source for your reconciliation, alongside the charity's bank statements and accounting records.
Give the review a named owner and a regular date. Keep evidence of what was checked, any difference found and the action taken.
4. Confirm the response route
Ask everyone involved in payments or donation records where they would report a concern. They should know who to contact inside the charity and what information to preserve.
The Charity Commission advises charities to act quickly, keep a record of what happened and report fraud or attempted fraud to Report Fraud. A serious incident report to the Commission may also be required.2 There is no single minimum loss figure that decides whether an incident is serious, so trustees need to assess the harm and risk in their charity's circumstances.5
Record the internal contact, the backup contact and the location of your response plan. Check that volunteers and part-time staff can find them too.
Complete one test today
Choose one recent payment and write down the requester, checker, approver and reviewer. If one name appears at every stage, agree the extra check before the next payment is made.
This article provides general information, not legal, financial or accounting advice. Trustees should use current regulatory guidance and seek professional advice where their charity's circumstances require it.
Footnotes
- Prevent Charity Fraud, Charity Fraud Awareness Week 2026. Read the campaign information.
- Charity Commission, guidance on protecting a charity from fraud. Read the fraud guidance.
- Charity Commission, Internal financial controls for charities (CC8). Read the financial controls guidance.
- Wonderful support, exporting donation data. Read the donation data guide.
- Charity Commission, guidance on reporting a serious incident. Read the serious incident guidance.