Ryan Alexander, author of Protect Your Mission and founder of RA Partners, writes
A board member called me in a panic.
Three pages. That’s how long the auditor’s management letter was.
Three pages of financial and internal control failures that had built up over time, while leadership assumed everything was fine. The auditors were direct: address the root of the issues, or they would cease working with the organisation.
This wasn’t a small organisation. The budget was in the mid-seven figures. Programs were running. Funding was coming in. On the surface, nothing looked broken. But the underlying structure wasn’t there.
What the Audit Revealed
The management letter did not introduce new problems. It documented issues that had been building for some time.
A few stood out:
- Bank reconciliations were inconsistent and, in some cases, months behind
- There was no clear separation of duties around cash handling and approvals
- Financial reporting existed, but it did not reflect how the organisation actually operated
- Grant tracking was inconsistent and not integrated with the accounting system
Taken together, these issues pointed to a deeper problem: the underlying structure hadn’t kept pace.
An administrative staff member had been moved into a senior finance role as the organisation grew. She worked hard and was committed, but she was not set up to succeed. There were no systems, no clear processes, and no real support.
By the time the auditor put it in writing, the house was already on fire.
The Decision
At that point, there were three options:
- Treat the audit as a one-time issue and resolve just enough to satisfy the auditor
- Replace the person in the role and hope that solved the problem
- Step back and address the structure that allowed the issues to develop
The first option would have been quicker to implement. The second would have been easier to explain.
The organisation chose the third.
That decision was not easy.
It meant acknowledging the issues were not isolated and that fixing them would require more than a quick response. Leadership committed to addressing underlying causes, not just symptoms. Choosing the third option meant slowing down in the short term to build something that would hold over time.
That shift in thinking was as important as the changes themselves.
Ryan Alexander.What We Did
We didn’t start with the management letter. We started with the basics.
1. Reconstruct the financial picture
Before making any changes, we needed to understand what was actually happening.
- All accounts were reconciled
- Prior period discrepancies were identified and corrected
- Reporting was aligned with how the organisation operated
This was not easy work. It required sustained effort and discipline. But without it, every decision would have been based on incomplete information.
2. Establish clear roles and responsibilities
Many of the audit findings came down to one issue: no one was clearly accountable.
We defined:
- Who was responsible for cash receipts, approvals, and reconciliations
- What transactions required a second level of review
- Where handoffs occurred
Segregation of duties was implemented where possible. Where it was not possible, we added checks to reduce risk.
Without clear ownership, tasks were being completed, but no one was accountable for the outcome. That made it difficult to identify and address issues early. Clarifying roles made it clear where breakdowns were occurring and allowed them to be corrected before they compounded.
3. Build a basic control structure
This was not about creating a complex system. It was about consistency.
We put in place:
- Monthly close procedures
- Approval thresholds tied to roles
- A policies and procedures manual that reflected actual practice
The goal was not perfection. It was repeatability.
4. Bring grant tracking into the system
One of the bigger risks was the disconnect between grant tracking and accounting.
We moved:
- Grant restrictions
- Revenue recognition
- Spending tracking
into the accounting system, so that financial reports reflected reality.
Before this, information lived in separate places and had to be reconciled manually. That created delays and increased the risk of error. Bringing it into the accounting system created a single source of truth and made it possible to see how funding aligned with actual spending.
What Didn’t Work
Not everything went smoothly.
The clean-up work took time, and stakeholders were looking for near-immediate resolution.
At first, there was resistance to the level of structure being introduced. Some viewed it as unnecessary or overly rigid.
Some pushed to resolve the audit findings one by one. Others focused on producing more reporting. Both approaches would have addressed the symptoms, not the cause.
It took time to move from producing information to using it to make decisions.
That mattered more than any individual control.
What Changed
Within several months, the difference was noticeable.
- Financial reports were timely and usable
- Leadership was working from the same information
- Decisions were being made with a clear understanding of constraints
- The next audit process was markedly smoother
The auditors stayed, and the organisation received a clean opinion for its next audit.
More importantly, the organisation was no longer relying on hope and effort to hold things together. Leadership had a clearer understanding of where the risks were and how to address them early.
That visibility changed how the organisation operated. Conversations became more focused, decisions were made earlier, and problems were addressed before they escalated.
What I Took Away
That experience changed how I think about audits.
Audits don’t create problems. They reveal them.
The issues in that organisation were not the result of bad intentions. They were the result of people being asked to operate without the structure to support them.
The path forward was clear, but it required significant effort and discipline to implement:
- Defined ownership
- Consistent processes
- Financial information that reflects reality
An audit is one moment in time. The work that makes it successful happens throughout the year.
When that work is in place, the audit becomes what it’s supposed to be: confirmation that the system is working.
When it’s not, the audit will tell you.
The only question is whether you treat it as a report to respond to or a signal to change how you operate.
