Audit and Assurance · Not-for-profit organisations

Audit Risks and Engagement Issues in NFP Organisations

Updated 11 October 2026 · Fact-checked

Audit risks in a not-for-profit organisation come from how it earns and spends money. Key risks are incomplete donation income, misuse of restricted funds, going concern doubts, breach of regulations and weak controls run by volunteers. Identify the risk, say why it matters, then give a specific audit response.

Understand Audit Risks and Engagement Issues in NFP Organisations

A not-for-profit (NFP) organisation, such as a charity, exists to deliver a purpose, not to make profit for owners. Its users care about whether money was raised, held and spent as donors intended. The audit risks follow from that.

Completeness of income is the classic risk. Cash donations, collection tins, street fundraising and gifts from the public are not backed by invoices or contracts. Nobody is obliged to pay, so there is no record to check against. Income could be understated, or stolen before it is recorded. Auditors cannot rely on receivables or sales listings as they would in a trading company.

Restricted funds are donations that the donor says must be used for a specific purpose. The risks are that spending is charged to the wrong fund, restricted money is used for general costs, or the financial statements do not disclose the restrictions properly. Misuse can breach the law or the donor's terms, and can damage the charity's reputation and future giving.

Going concern is a risk because many NFPs rely on a few grants, donations or government contracts. If a major funder withdraws, there are few reserves to fall back on. Also, there is a risk of regulatory non-compliance: charity law, tax-exemption conditions, fundraising rules and grant conditions. Breaches can lead to penalties or loss of status.

Finally, controls are often weak. Small NFPs rely on volunteers who may be untrained, may be few in number (so segregation of duties is poor) and may change often. Trustees may lack financial expertise. This raises the risk of fraud, error and management override. Engagement issues also arise: the audit may be unpaid or low-fee, resources may be limited, and the auditor must communicate with trustees as those charged with governance.

Key rules to remember

Risk answer structure: Risk → Why it is a risk in this NFP → Audit response; Use this chain for every point. A bare list of risks earns little.
Audit risk model: Audit risk = Inherent risk × Control risk × Detection risk; Weak volunteer controls raise control risk. The auditor then lowers detection risk with more substantive work.
Main NFP risk areas: Income completeness | Restricted funds | Going concern | Regulatory compliance | Weak controls and fraud; Use this as a checklist when a scenario describes a charity.

How to solve Audit Risks and Engagement Issues in NFP Organisations questions

Use this method for any NFP audit risk or engagement question in Section C or an objective test case.

1Read the scenario and underline facts: type of income, any restricted gifts, funders, volunteers, regulators, recent events.
2Match each fact to a risk area from the checklist: completeness, restricted funds, going concern, compliance or controls.
3For each risk, state it in one sentence, using the scenario figure or detail.
4Explain why it matters: what could be misstated or breached, and the effect on the financial statements.
5Give a specific audit procedure or response for each risk, such as testing cash handling controls or agreeing grants to funder letters.
6Add engagement points if asked: communication with trustees, staffing the team, unpaid or low fees, or ethical issues.
7Check the mark allocation. Aim for roughly one well-developed point per mark, and avoid repeating the same risk.

Quickest way: Fact–Risk–Response in three lines

When to use it: Use when time is short, such as a 10 to 15 mark question or an objective test case on charity risks.

Write the scenario fact in a few words, for example: cash collection tins.
Write the risk it causes, for example: income incomplete or stolen.
Write the response, for example: attend tin openings and check counts to records.
Repeat for each fact until you have enough points for the marks.

Common mistakes in Audit Risks and Engagement Issues in NFP Organisations

Listing generic risks that apply to any company, such as inventory or receivables.
Students apply the standard company checklist without reading the scenario.
Fix: Anchor each risk to an NFP feature in the scenario: donations, restricted funds, volunteers, grants.
Saying donation income is overstated.
Students link income risk to revenue overstatement in a trading company.
Fix: For donations the main risk is understatement through incompleteness or theft, because there is no external record.
Giving a risk with no audit response, or a response with no risk.
Students treat the question as a list rather than a link between risk and procedure.
Fix: Always complete the chain: risk, reason, response.
Ignoring the restriction when discussing funds.
Students treat all funds as one pool of money.
Fix: Mention misallocation between restricted and unrestricted funds, and check spending against donor terms.
Saying the auditor must prevent or fix the volunteers' control weaknesses.
Students confuse the auditor's role with management's role.
Fix: Management and trustees are responsible for controls. The auditor assesses the weakness, adjusts the audit approach and reports significant deficiencies.
Vague procedures such as 'check the donations'.
Students run out of time or do not think about what evidence exists.
Fix: Name the evidence: bank statements, collection records, grant agreements, trustee minutes, regulator correspondence.

Worked examples

Example 1

You are the audit senior on Hope Trust, a small charity funded by street collections and a grant. The finance function is run by two part-time volunteers. Trustees have asked whether income is complete. Explain the audit risk over completeness of donation income and describe two procedures you would perform. (6 marks)

Show the solution

Fact: income comes from street collections and gifts, with no invoices or contracts.
Risk: income may be incomplete, because there is no external record of what should have been received. Cash can also be stolen before being banked.
Why more serious here: only two volunteers handle finance, so there is little segregation of duties and a higher chance of theft or error.
Procedure 1: attend or review the counting of collection tins. Check that two unconnected people count and sign the count sheet, and agree the totals to the records.
Procedure 2: agree the recorded takings to the bank paying-in slips and bank statements, and compare income by month with prior years and with the number of collections held. Investigate unusual falls.
Link to the audit approach: as control risk is high, rely mainly on substantive procedures and say so.

Answer: The main risk is understatement of donation income, because gifts are voluntary and unrecorded at source. Weak segregation of duties increases the risk. Procedures include attending tin counts, agreeing counts to records and banking, and analytical comparison of income to prior periods and collection activity.

Example 2

Greenfield Foundation is a charity that received ₹40,00,000 from a donor to be spent only on a children's education programme. Its general funds are low and its main government grant ends in six months. During the year, ₹6,00,000 of programme money was used to pay head office rent. Identify the audit risks and the responses. (8 marks)

Show the solution

Restricted fund risk: ₹6,00,000 of restricted money was used for head office rent. This may breach the donor's terms and means restricted expenditure is overstated or the funds are misclassified.
Response: obtain the donor agreement, list the permitted uses, and test a sample of programme expenditure to see whether it fits. Check the ₹6,00,000 is identified and ask whether it will be repaid or the donor's consent was obtained.
Financial statement risk: the fund note and the balances for restricted and unrestricted funds may be misstated. Response: reconcile fund movements and check disclosure of the restrictions.
Going concern risk: general funds are low and the main grant ends in six months, so there may be no funding for continued operations. Response: review budgets and cash flow forecasts, check for confirmed or likely replacement funding, and review trustee minutes and correspondence with funders.
Compliance risk: misuse of restricted funds may breach charity law and may need to be reported to the regulator. Response: discuss with trustees, consider legal advice and the effect on the auditor's report if the matter is not properly dealt with or disclosed.

Answer: Key risks are misuse of restricted funds (₹6,00,000), misstatement of fund balances and disclosures, going concern doubt due to low reserves and a grant ending, and regulatory breach. Responses include reviewing the donor terms, testing expenditure by fund, assessing forecasts and funding, and discussing the matter with trustees.

Exam tips

In Section C, link every risk to the scenario. A mark is usually given for the point, the reason and the procedure, not for naming the risk alone.
For objective questions, remember that donation completeness is about understatement, and that restricted funds must be used for the donor's stated purpose.
Use the mark allocation to decide the number of points. Do not write five lines on one risk if the question has eight marks.
Keep going concern and compliance as separate points, even when they are linked. Examiners often give a mark for each.
Always say whether you will rely on controls. In a volunteer-run NFP, the answer is usually no, so substantive work increases.

Audit Risks and Engagement Issues in NFP Organisations: frequently asked questions

Why is completeness the main risk for charity donations?

Many donations are made in cash or without any contract, so there is no external record of what should have been received. Income can go missing or be left unrecorded without anyone noticing. The auditor must therefore test controls over receipt and use analytical review.

What is a restricted fund and why is it an audit risk?

A restricted fund is money given for a specific purpose set by the donor. The risks are that it is spent on other things, charged to the wrong fund or not disclosed correctly. This can breach donor terms and the law.

How should I answer a not-for-profit audit risk question in the exam?

Pick out the facts in the scenario and turn each into a risk. Explain why it matters, then give a specific audit response. Check the marks available so that you cover enough separate points.

Does the auditor fix weak volunteer controls?

No. Trustees and management are responsible for internal control. The auditor assesses the weakness, changes the audit approach and reports significant deficiencies to those charged with governance.