Internal Controls for Private Clubs: 10 Gaps That Lead to Fraud and Errors

Private clubs are vulnerable to fraud and errors for predictable reasons: small accounting teams, long-tenured trusted staff, high volumes of small transactions, seasonal employees, and boards that understandably focus on member experience. Most losses come from a handful of control gaps that are inexpensive to close.

This guide lists the ten gaps we see most often and practical fixes for each. For the general version, see internal controls for small business.

Key takeaways

• Separate vendor setup, invoice entry and payment release.
• Verify every vendor bank change by phone with a known contact.
• Review member account adjustments, voids, comps and payroll changes.
• Small teams can rely on compensating controls such as positive pay and outside review.

The 10 most common club control gaps

1. One person controls vendors, invoices and payments. The same employee can add a vendor, enter an invoice and release payment. Separate these duties, or add a reviewer who approves every payment run against invoices.

2. Vendor bank changes accepted by email. Business email compromise is a leading source of loss. Require a phone call to a known contact before any bank change and a second approval in the system.

3. Member account adjustments without review. Credits, write-offs and minimum waivers posted by one person with no report to anyone else. Require approval above a low threshold and send a monthly adjustments report to the controller and GM.

4. Cash handling without daily reconciliation. Pro shop, bar and snack bar cash should be counted by two people and matched to POS reports daily.

5. Voids and comps not monitored. Review POS void and comp reports weekly by employee.

6. Payroll changes without independent review. New hires, rate changes and terminations should be approved by someone other than the payroll processor, and payroll registers reviewed every cycle.

7. Inventory with no regular counts. F&B, wine and pro shop inventory counted monthly, with one counter independent of purchasing.

8. Club credit cards without receipts or review. Require receipts and monthly approval by a supervisor; the GM's card should be reviewed by the treasurer or CFO.

9. Unreconciled balance sheet accounts. Fraud hides in clearing accounts and unreconciled balances. See club balance sheet reconciliations.

10. System access never removed. Former employees and directors keep logins. Review system access quarterly.

Controls when the accounting team is small

Perfect segregation of duties isn't possible with two or three people. Compensating controls fill the gap:

• The GM or an outside CFO reviews bank statements directly from the bank each month.
• Positive pay or ACH filters at the bank block unauthorized payments.
• Approval limits require two signers above a set amount.
• Monthly reports of vendor master changes, member adjustments and payroll changes go to someone outside the accounting team.
• An outside reviewer performs periodic surprise checks.

Warning signs boards should notice

• The month-end close keeps slipping and reconciliations are "almost done."
• One employee never takes vacation or won't let others cover their work.
• Audit adjustments are large or recurring.
• The same management letter comments appear year after year.
• Member complaints about statement errors increase.
• Cost of sales rises with no change in pricing or menu.

None of these proves wrongdoing, but each deserves a question. Our article on why club audit fieldwork stalls covers related issues.

Putting controls in writing

Controls work when they are written down, assigned and checked. A short policies and procedures manual should cover purchasing and approval limits, cash handling, member account adjustments, payroll changes, vendor setup, credit cards and system access. Review it annually with the finance committee and auditor. A club that documents its controls also protects itself when staff turn over, because the next person inherits the process.

If your club has never had a controls review, start with a focused assessment of payments, member adjustments and payroll. Our club accounting cleanup engagements include a controls review and a written procedures manual.

Common questions

What are the most important internal controls for a private club?

Separating vendor setup, invoice entry and payment release; verifying vendor bank changes by phone; reviewing member account adjustments; reconciling cash daily; reviewing payroll changes; and reconciling balance sheet accounts monthly.

How can a small club accounting team segregate duties?

Use compensating controls: direct bank statement review by the GM or an outside CFO, positive pay at the bank, dual approval above a threshold, and monthly change reports reviewed outside the accounting team.

What are signs of fraud at a club?

Persistent close delays, an employee who never takes vacation, recurring audit adjustments, repeated management letter findings, rising member statement complaints and unexplained increases in cost of sales.

Does the annual audit catch fraud?

Not necessarily. A financial statement audit is designed to give an opinion on the statements as a whole, and it may not detect fraud that is concealed or immaterial. Strong internal controls are the club's primary protection.