# Internal Controls for Booster Clubs: Rules That Prevent Theft

> The internal controls every booster club needs: dual signatures, segregation of duties, no debit cards, two-person cash counts, and a monthly non-signer review.

- URL: https://boosterclub.org/finance/internal-controls/
- Section: Finance
- Updated: 2026-10-08

Internal controls are the written rules a booster club follows so that no single person can receive, spend, or record the club's money without someone else seeing it. The core set is short: two signatures on every payment, no debit cards, two people counting all cash, prompt deposits, and a monthly bank statement review by an officer who cannot sign checks. The board adopts the controls; the treasurer and every event chair follow them.

Controls protect volunteers as much as they protect money. When a question arises, a treasurer who followed written procedures can show exactly what happened. A treasurer who worked alone cannot, even if nothing was taken.

## Why Controls Matter

The Association of Certified Fraud Examiners (ACFE) studied 1,921 fraud cases for its 2024 *Occupational Fraud: A Report to the Nations*. A lack of internal controls was the primary weakness in 32 percent of cases, and an override of existing controls in another 19 percent. The typical fraud ran 12 months before anyone detected it, and 43 percent were uncovered by a tip rather than a review.

Booster club investigations show the same pattern. When the Tennessee Comptroller's Office reported a 2024 booster club theft, the Comptroller noted that the case "involved one person who was given too much control over all financial duties without others being involved." See [Preventing Embezzlement in Booster Clubs](https://boosterclub.org/finance/embezzlement/) for that case and others.

## The Core Controls

| Control | What it means | What it prevents |
|---|---|---|
| Dual signatures | Two authorized, unrelated officers approve every check and electronic payment | One person paying themselves or a relative |
| No debit cards | The club does not hold debit or automated teller machine (ATM) cards | Cash withdrawals and purchases with no second approval |
| Two-person cash counts | Two unrelated people count and sign for all cash | Skimming at gates and concessions |
| Prompt deposits | Cash and checks deposited within one business day, two at most | Money "borrowed" and replaced later, or lost |
| Written payment requests | Every payment has a request, a receipt, and an approval | Payments for unapproved or personal items |
| Monthly non-signer review | An officer who cannot sign checks reviews the statement and reconciliation | Theft hidden by false records |
| Treasurer's report at every meeting | The board sees balances and activity monthly | Problems staying hidden for a year |
| Annual financial review | A committee or accountant tests the year's records | Undetected errors and fraud |
| Signer and password changes at transition | Departing officers lose access immediately | Former officers acting on the account |

## Dual Signatures

Every check and every electronic payment, including debit transactions, automated clearing house (ACH) transfers, and online bill pay, requires two authorized signers. Three conditions make the rule work:

1. **Signers are elected officers named in the bylaws.** The secretary and the financial reviewer are not signers, so they can review independently.
2. **Signers are not related** by blood or marriage and do not live in the same household.
3. **Checks are printed** with "Two signatures required" and "Void if not cashed within 90 days."

Most banks do not enforce a two-signature requirement when they process a check. The rule works only because the reviewer checks every cleared check image each month for two valid signatures. Add these rules to the standing rules:

- Never sign a blank check.
- Never write a check payable to "cash."
- No signer signs a check payable to themselves or a relative.
- Every check has a payment request and receipt attached before the second signer signs.

## Segregation of Duties

Segregation of duties means splitting each money task so that the person who handles the money is not the only person who records it or checks it. A small club with only three or four active officers can still do it:

| Task | Person A | Person B | Person C |
|---|---|---|---|
| Collect and count cash | Event chair | Second counter | |
| Deposit | Treasurer or event chair | | |
| Record in the books | Treasurer | | |
| Approve payment | | President | |
| Sign payment | Treasurer | Vice president | |
| Review statement and reconciliation | | | Secretary |
| Annual review | | | Review committee (non-signers) |

The rule of thumb: whoever records the money never reviews their own work, and whoever reviews has no access to move money.

## No Debit or ATM Cards

A debit card spends money with one person's decision and leaves no second signature. In the Upperman High School case described on [Preventing Embezzlement](https://boosterclub.org/finance/embezzlement/), the treasurer used the club's debit card for ATM withdrawals and personal purchases. The safest policy is that the club holds no debit or ATM cards at all; purchases go through payment requests, checks, or reimbursements.

Some clubs keep cards anyway. A club that does should use only bank-issued cards, limit them to officers designated as check signers, require a second signer's approval of each debit transaction, set a low daily limit with the bank, forbid cash withdrawals, and have the reviewer match every card charge to a receipt each month.

## Monthly Review by a Non-Signer

This single control catches most problems. The procedure:

1. The bank statement goes directly to the reviewer, either by mail to the reviewer's address or through the reviewer's own view-only online access. The treasurer does not control delivery.
2. The treasurer prepares the reconciliation (bank balance, plus deposits in transit, minus outstanding checks, equals book balance).
3. The reviewer compares the statement with the reconciliation and the ledger.
4. The reviewer looks at every cleared check image for two valid signatures and a legitimate payee.
5. The reviewer matches deposits to count sheets and payments to approved requests for a sample of items.
6. The reviewer asks about anything unexplained, then signs and dates the statement and the reconciliation.
7. The signed copies go in the permanent file and are available to the financial reviewers.

## Electronic Payments

Online bill pay and ACH transfers are legitimate payment methods when they follow the same two-person rule. Set up business online banking so one user initiates and a second user approves each payment, if the bank offers dual approval. If it does not, require a signed payment request approved by a second signer before the payment is released, and have the reviewer confirm each electronic payment monthly. Never share one login among officers.

## Adopting the Controls

1. Draft the controls as standing rules or a financial policy.
2. Have the board adopt them by vote and record the vote in the minutes.
3. Give a copy to every officer and event chair at the start of the year.
4. Have the financial review committee test compliance each year.

## Common Mistakes

- **Two signers who are married or live together.** The second signature exists to provide an independent check, and a spouse cannot provide one.
- **The treasurer receives the statement and "shares it later."** Theft concealed by a single altered statement can run for years.
- **Pre-signed blank checks for convenience.** A pre-signed check is a one-signature check.
- **Debit cards held by the treasurer alone.** A card lets one person spend with no second approval, and cards appear again and again in booster club theft cases.
- **Controls written but never tested.** Rules that nobody checks drift within a season.

## Checklist

- [ ] Adopt written internal controls as standing rules or a financial policy (board)
- [ ] Confirm that all signers are elected officers, unrelated, and in separate households
- [ ] Order checks printed with "Two signatures required" and "Void if not cashed within 90 days" (treasurer)
- [ ] Cancel all debit and ATM cards, or limit them as described above (treasurer and president)
- [ ] Set up statement delivery or view-only online access for the non-signer reviewer
- [ ] Set up dual approval for electronic payments where the bank offers it
- [ ] Review and sign each month's statement and reconciliation (non-signer)
- [ ] Distribute the controls to every officer and event chair at the start of the year (president)
- [ ] Test compliance during the annual financial review (review committee)

## Related Pages

- [Booster Club Banking](https://boosterclub.org/finance/banking/) for setting up signers and online access
- [Handling Cash at Booster Club Events](https://boosterclub.org/finance/cash-handling/) for the two-person counting procedure
- [Preventing Embezzlement in Booster Clubs](https://boosterclub.org/finance/embezzlement/) for how theft happens and red flags
- [Annual Financial Review or Audit for Booster Clubs](https://boosterclub.org/finance/financial-review/) for testing the controls
- [Policies Every Booster Club Should Adopt](https://boosterclub.org/governance/policies/) for related written policies

---

*This page is general information for volunteer-run booster clubs. It is not legal,
tax, or accounting advice, and BoosterClub.org is not a law firm, accounting firm, or
government agency. Rules change and vary by state and district. Confirm current
requirements with the IRS, the relevant state agency, the school district, and a
qualified professional before acting. If a fact on this page is out of date, we want
to know.*

## Sources

1. Tennessee Comptroller of the Treasury: https://comptroller.tn.gov/news/2018/11/8/franklin-county-woman-indicted-for-theft-from-booster-club.html
2. Tennessee Comptroller of the Treasury: https://comptroller.tn.gov/content/dam/cot/administration/documents/press-releases/2024/UppermanFishingBooster070324.pdf