Internal Controls for Booster Clubs: Rules That Prevent Theft

Why Controls Matter

The Association of Certified Fraud Examiners (ACFE) studied 1,921 fraud cases for its 2024 Occupational Fraud: A Report to the Nations. A lack of internal controls was the primary weakness in 32 percent of cases, and an override of existing controls in another 19 percent. The typical fraud ran 12 months before anyone detected it, and 43 percent were uncovered by a tip rather than a review.

Booster club investigations show the same pattern. When the Tennessee Comptroller’s Office reported a 2024 booster club theft, the Comptroller noted that the case “involved one person who was given too much control over all financial duties without others being involved.” See Preventing Embezzlement in Booster Clubs for that case and others.

The Core Controls

Dual Signatures

Every check and every electronic payment, including debit transactions, automated clearing house (ACH) transfers, and online bill pay, requires two authorized signers. Three conditions make the rule work:

1. Signers are elected officers named in the bylaws. The secretary and the financial reviewer are not signers, so they can review independently.
2. Signers are not related by blood or marriage and do not live in the same household.
3. Checks are printed with “Two signatures required” and “Void if not cashed within 90 days.”

Most banks do not enforce a two-signature requirement when they process a check. The rule works only because the reviewer checks every cleared check image each month for two valid signatures. Add these rules to the standing rules:

• Never sign a blank check.
• Never write a check payable to “cash.”
• No signer signs a check payable to themselves or a relative.
• Every check has a payment request and receipt attached before the second signer signs.

Segregation of Duties

Segregation of duties means splitting each money task so that the person who handles the money is not the only person who records it or checks it. A small club with only three or four active officers can still do it:

The rule of thumb: whoever records the money never reviews their own work, and whoever reviews has no access to move money.

No Debit or ATM Cards

A debit card spends money with one person’s decision and leaves no second signature. In the Upperman High School case described on Preventing Embezzlement, the treasurer used the club’s debit card for ATM withdrawals and personal purchases. The safest policy is that the club holds no debit or ATM cards at all; purchases go through payment requests, checks, or reimbursements.

Some clubs keep cards anyway. A club that does should use only bank-issued cards, limit them to officers designated as check signers, require a second signer’s approval of each debit transaction, set a low daily limit with the bank, forbid cash withdrawals, and have the reviewer match every card charge to a receipt each month.

Monthly Review by a Non-Signer

This single control catches most problems. The procedure:

1. The bank statement goes directly to the reviewer, either by mail to the reviewer’s address or through the reviewer’s own view-only online access. The treasurer does not control delivery.
2. The treasurer prepares the reconciliation (bank balance, plus deposits in transit, minus outstanding checks, equals book balance).
3. The reviewer compares the statement with the reconciliationReconciliationMatching the club’s books to the bank statement each month: the bank balance, plus deposits in transit, minus outstanding checks, equals the book balance. Someone other than a check signer reviews it.All terms and the ledger.
4. The reviewer looks at every cleared check image for two valid signatures and a legitimate payee.
5. The reviewer matches deposits to count sheets and payments to approved requests for a sample of items.
6. The reviewer asks about anything unexplained, then signs and dates the statement and the reconciliation.
7. The signed copies go in the permanent file and are available to the financial reviewers.

Electronic Payments

Online bill pay and ACH transfers are legitimate payment methods when they follow the same two-person rule. Set up business online banking so one user initiates and a second user approves each payment, if the bank offers dual approval. If it does not, require a signed payment request approved by a second signer before the payment is released, and have the reviewer confirm each electronic payment monthly. Never share one login among officers.

Adopting the Controls

1. Draft the controls as standing rulesStanding rulesA club’s administrative rules, adopted by an ordinary vote and changed the same way: dues amounts, reimbursement deadlines, meeting times, and other details that shift from year to year.All terms or a financial policy.
2. Have the board adopt them by vote and record the vote in the minutes.
3. Give a copy to every officer and event chair at the start of the year.
4. Have the financial review committee test compliance each year.