Internal Audit Process For Churches: Step-By-Step Checklist

What Is An Internal Audit For Churches?

An internal audit for a church is a systematic review of the congregation’s controls, records, policies, and procedures to make sure resources are used as intended, risks are managed, and ministry operations run smoothly. It checks financial accuracy, compliance with bylaws and regulations, safeguarding practices, and whether ministry programs are delivering the expected outcomes. An audit is not about blame, it’s about stewardship, accountability, and continuous improvement.

Purpose And Key Outcomes

The audit’s purpose is to protect the church’s people, assets, and reputation while improving transparency for leaders and congregants. Typical outcomes include:

• A clear findings report showing strengths, gaps, and priority risks.
• Specific, actionable recommendations and assigned owners.
• A risk register or prioritized action plan for follow up.
• Improved controls around giving, payroll, facilities, and child safety.
• Greater confidence among the leadership team and donors.

Keep outcomes measurable. For example, reduce unreconciled deposits to zero within 60 days, or close three high-risk findings by the next quarter.

Internal Audit Versus External Review

Internal audits are performed by church staff, trained volunteers, or an internal audit team. They are ongoing, flexible, and focused on operational improvement and stewardship. External reviews are done by independent accountants or auditors. They bring objectivity, professional assurance, and credibility for donors, lenders, or diocesan authorities.

Use internal audits for routine checks, process improvements, and preparing for external scrutiny. Bring in an external reviewer when independence is critical, when complex regulations apply, or when the church undergoes a major campaign or merger.

Setting Clear Audit Objectives And Scope

Good audits start with crisp objectives and realistic scope. Without them you get long reports that don’t drive change. Define what success looks like, what will be examined, and why it matters to the congregation.

Defining Goals For Stewardship And Risk

Translate stewardship and risk into measurable audit goals. Examples:

• Verify that restricted gifts are used per donor intent.
• Confirm monthly reconciliations are completed within 10 days of month end.
• Test child check-in and volunteer screening for compliance with the church’s safeguarding policy.

Each goal should link to a risk or mission outcome, like protecting children or ensuring trust in the giving process.

Scoping By Programs, Funds, And Departments

Scope audits by priority areas, not by habit. Consider:

• High-dollar funds and restricted accounts.
• Programs with the most volunteer turnover, like youth or outreach.
• Departments handling cash, payroll, or third-party payments.

Rotate scope so every area is reviewed over a cycle. Use reporting from your church management app to identify unusual trends, unposted gifts, or large refunds that deserve early attention.

Determining Frequency And Reporting Lines

Match frequency to risk. High-risk areas may need monthly or quarterly checks. Low-risk items might be on an annual rotation. Define who receives audit results, typically the finance committee, senior pastor, and board or elder team. Include a follow-up schedule and require owners to report progress. Keep final reports concise and actionable, and protect sensitive details to the appropriate level.

Identifying Church-Specific Risks

Churches face a mix of financial, operational, and reputational risks that look different from a business. Calling them out helps prioritize controls where they matter most.

Financial Risks Related To Giving

Giving-related risks include unrecorded cash, misapplied restricted gifts, weak deposit controls, and reconciliation gaps between online giving and the general ledger. Recurring donation errors and refund abuse also show up. Mitigate with dual-counting or second-signature for deposits, timely reconciliations, clear restricted fund policies, and automated receipts for donors. Reconcile the online giving platform to bank deposits every week.

Operational Risks For Events And Facilities

Events and facilities create risks around safety, liability, and logistics. Examples: inadequate volunteer screening for children’s programs, unlocked access to sensitive areas, insufficient insurance for rentals, and poor emergency planning. Manage these with written event policies, mandatory background checks, site-specific risk assessments, clear volunteer roles, and routine facility maintenance logs.

Reputation And Compliance Risks

A church’s reputation hinges on trust. Risks include mishandling allegations, privacy breaches of member data, noncompliance with payroll taxes or charitable registration, and public miscommunication during crises. Controls include robust safeguarding policies, secure data access, periodic privacy audits, clear reporting pathways for misconduct, and transparent communication protocols for leadership.

Building Your Audit Team And Schedule

A practical team and schedule make audits doable for churches with limited staff and volunteer capacity. Balance skill, independence, and cost.

Staff, Volunteers, Or Independent Reviewers

Choose the right mix. Staff know daily operations and are cost effective. Volunteers can bring financial skills if trained and supervised. Independent reviewers bring objectivity and are essential for sensitive issues or when donors require external assurance. Avoid using people who control the processes they will audit.

Roles, Responsibilities, And Conflict Checks

Define roles up front: lead auditor, field reviewers, finance liaison, and a board or committee recipient of reports. Document responsibilities and timelines. Require written conflict disclosures so auditors do not review their own work or that of close relatives. Check for related party transactions before tests begin.

Creating A Practical Audit Timeline

Build a timeline that fits the church calendar. Key tips:

• Schedule planning before major seasons like Christmas or Easter.
• Time fieldwork during slower ministry weeks when records are accessible.
• Allow 1 to 3 weeks for fieldwork depending on scope.
• Deliver a draft report within two weeks, and a final report after management responses.
• Schedule a 60 or 90 day follow-up to confirm remediation.

Keep timelines realistic, assign clear owners, and track progress publicly to the board. Small, consistent audits make stewardship habitual and sustainable.

Auditing Financial Records

A financial records audit looks for accuracy, control gaps, and patterns that threaten stewardship. Focus on the highest risk areas first, test samples, and look for breakdowns in segregation of duties. Below are core areas to test and practical checks to run.

Auditing Church Cash Handling And Offerings

Cash is still common in churches, and it is a frequent source of error or loss. Confirm there is a written policy for counting, endorsing, and depositing offerings. Test a sample of weekend collections from count sheets to deposit slips and the bank deposit. Look for dual control during counts, locked storage between services, pre-numbered offering envelopes, and a chain of custody for cash until it reaches the bank. Surprise count observations are effective, but balance them with volunteer relations. Video or documented sign-offs add evidence without creating extra burden.

Reviewing Bank Reconciliations And Statements

Timely, independent bank reconciliations catch errors and fraud. Review reconciliations for recent months, compare cleared items to bank statements, and investigate long-outstanding items. Verify that the person who signs checks does not prepare reconciliations. Check for unusual wire transfers, frequent returned items, or unexplained service charges. Confirm inter-account transfers are authorized and properly recorded. If your ledger is kept in separate tools or spreadsheets, note reconciliation gaps and recommend moving toward an integrated solution to reduce manual errors.

Examining Payroll And Staff Benefits

Payroll is a high-impact area, both financially and legally. Confirm hires are authorized, new hire paperwork is complete, pay rates match approved schedules, and changes have documented approvals. Test a sample of pay runs from timesheets or timekeeping to net pay and tax filings. Verify deductions for benefits are correctly applied and remitted, and classify workers correctly as employees or contractors. Check access to payroll systems and make sure direct deposit changes require dual verification. Finally, review year-end reporting and confirm the church is meeting payroll tax obligations.

Testing Expense Reports And Vendor Payments

Expense controls protect funds and encourage fair vendor selection. Require receipts and approvals before reimbursement, and test a sample of expense reports for documentation, business purpose, and supervisor sign-off. Review the vendor master file for duplicates, inactive vendors, and related parties. Test for duplicate or split invoices used to bypass approval thresholds. Trace selected payments from invoice to check or electronic transfer, and verify that goods or services were received. Recommend purchase order thresholds for larger purchases if none exist.

Verifying Restricted Funds And Grants

Restricted gifts must be tracked and used according to donor intent. Confirm there is a clear chart of accounts or subledger for restricted funds, and test samples of restricted gifts to ensure expenditures match the stated purpose. Review pledge agreements and grant contracts for reporting requirements, allowable costs, and expiration dates. Check for commingling by reconciling restricted fund balances to donor reports and bank accounts. When funds are transferred or reclassified, look for documented approvals and donor notice where required.

Auditing Donations And Online Giving

Giving now spans envelopes, kiosks, and multiple online platforms. Reconcile across systems, confirm donor intent is honored, and make sure payment processing follows security and tax rules. Technology can accelerate these checks if the data flows are clean.

Reconciling eGiving Platforms And Donations

Match reports from online giving platforms to bank deposits and the general ledger on a frequent cadence, ideally weekly. Test recurring gifts, voids, and refunds to ensure they reconcile to deposits and donor records. Verify batch identifiers or deposit references are retained so gifts can be traced end to end. If gifts are imported into a separate accounting tool, confirm mappings are correct and test several gifts from platform to ledger. Where manual uploads are in use, flag the risk and recommend direct integrations or automated imports to cut errors.

Tracking Pledges And Donor Restrictions

Pledges need ongoing monitoring to measure campaign progress and honor restrictions. Verify pledge schedules, recorded receipts, and aging reports. Test a sample of pledges to confirm payments posted against the correct campaign and donor restrictions were observed. Confirm the process to release or reclassify restrictions, including required approvals and donor notifications. Use pledge reports to identify lapsed commitments and establish follow-up procedures that respect confidentiality and donor intent.

PCI, Payment Fees, And Gift Acknowledgements

Card processing brings PCI responsibilities and fees that affect net receipts. Confirm cardholder data is not stored insecurely, and that tokenization or vaulting is used by payment processors. Review merchant statements to reconcile processor fees and chargebacks to gifts. Check that gift acknowledgements meet tax requirements, include required language, and are issued promptly. Automated acknowledgements from your giving platform or church management app reduce workload and strengthen transparency, just make sure they match actual deposit amounts after fees and refunds.

Auditing Operations And Assets

Operational audits protect people and property and ensure assets are recorded and used properly. Look beyond numbers, inspect physical controls, and test processes where volunteers and outside groups interact with assets.

Fixed Asset Inventory And Disposal Controls

Maintain a fixed asset register with descriptions, locations, acquisition dates, cost, and depreciation. Physically tag higher value items and perform periodic inventories. Test additions and disposals, confirming approvals, board authorization for large disposals, and proper accounting entries for gains or losses. Review procedures for loaning or removing equipment to prevent loss. For disposals or sales, verify proceeds are deposited intact and recorded to the correct fund.

Facility Safety, Maintenance, And Leases

Buildings are both ministry space and liability. Inspect maintenance logs, safety inspection reports, and certificates for fire alarms, elevators, and accessibility. Review lease agreements for rental income, insurance requirements, and indemnity clauses. Confirm external vendors and renters provide proof of insurance and that the church enforces keys and access controls. A simple facilities calendar and documented work orders go a long way toward demonstrating stewardship and reducing safety-related risk.

Event Cash Flow And Volunteer Oversight

Events generate donations, sales, and expenses in a compressed timeframe. Confirm event budgets, pre-event approvals, and cash handling plans. Use pre-numbered tickets or digital sales when possible, and require two-person cash counts at start and end. Ensure volunteers handling money receive basic training and that a staff or paid leader signs off on reconciliations. For recurring events, spot-check budgets and inventories to identify leakage or repeated mistakes.

Ensuring Compliance And Safeguarding

Audits must confirm the church complies with laws, denominational rules, and its own policies, especially where vulnerable people are involved. Practical checks here protect people and the church’s reputation.

Background Checks And Child Protection Practices

Confirm background checks are current and documented for staff and volunteers who work with children or vulnerable adults. Test a sample of personnel files for completed training, signed child protection policies, and adherence to the two adult rule during programs. Verify there is a clear incident reporting pathway and that records of reported concerns are retained and reviewed by the designated safeguarding lead. Regular refresher training and accessible policy documents reduce risk and set expectations.

Insurance Coverage And Legal Requirements

Review insurance policies for adequate limits and appropriate coverage for property, general liability, volunteers, and directors and officers. Check certificates of insurance for vendors and renters. Confirm the church meets local licensing, building code, and occupancy permit requirements. Look at claims history and any uninsured exposures, and recommend gap coverage where necessary. Maintaining a renewal calendar prevents accidental lapses.

Denominational And Tax Reporting Obligations

Understand the church’s obligations under denominational rules and civil law. Even if a congregation is generally tax exempt, there are reporting requirements for payroll taxes, unrelated business income, and charitable registrations in some states. Verify filings are current, review any diocesan reporting requirements, and check gift receipts and donor privacy practices against tax rules. Keep a record retention schedule to satisfy legal and reporting needs, and test a sample of filings for accuracy and timeliness.

Securing IT And Data Systems

IT and data are the foundation of modern ministry. If member records, giving data, or volunteer schedules get breached or lost, ministry work stalls and trust erodes. An internal audit should test whether the church’s technology environment matches the level of risk it holds, from who can view financial reports to how backups are handled. Focus on access controls, device and network hygiene, vendor security, and logging, and treat these as ongoing controls, not one-time fixes.

Church Management Software Permissions

Start with role design. Give people only the access they need to do their job, and remove access when someone leaves or changes roles. Review admin-level accounts, exported-data permissions, and integrations that can push or pull sensitive information. Use the built-in role-based permissions in your church management software, like ChMeetings church management software, to limit exports of donor lists and to separate finance duties from pastoral communications. Require unique logins, enable multi-factor authentication, disable default admin accounts, and run a permissions review at least quarterly. Log and retain audit trails showing who viewed or changed giving records, and keep a record of approved permission changes.

Backup, Recovery, And Data Retention

Backups are only useful if you can restore them, and retention rules must meet legal and donor expectations. Define an RTO and RPO for critical systems, keep encrypted backups offsite or in a separate cloud region, and test restores at least twice a year. Maintain a simple retention schedule for member files, payroll records, and safeguarding reports that aligns with legal and denominational rules. Document who is responsible for restores, where backups are stored, and how long snapshots are kept. During the audit, verify a recent restore was completed and timed, and confirm backups are protected by strong keys and access controls.

Protecting Donor Data And Online Giving

Donor trust depends on security and privacy, not pleasant language. Verify payment processing follows PCI rules, ensure cardholder data is tokenized or vaulted through the processor, and never store full card numbers in local spreadsheets. Limit staff access to donor contact and giving histories, require encryption for sensitive exports, and log any access to top donors or restricted gifts. Inspect processor contracts and SOC or compliance reports when possible, and test the refund workflow so refunds require manager approval and are traced. Finally, confirm public privacy and data retention policies match actual practice, and train staff on acceptable use and phishing risks.

Collecting Evidence And Testing Methods

Good evidence is specific, reproducible, and tied to the audit objective. Think like a skeptic, but stay pastoral in tone when dealing with volunteers. Collect documentation, screenshots, system exports, signed policies, and timestamped emails. Use clear chains of custody for physical documents and timestamped electronic folders for digital evidence. Every test should leave behind a trail an independent reviewer could follow.

Sampling Techniques And Sample Sizes

Sampling keeps audits practical. Choose a method that matches the risk: random sampling for general controls, stratified sampling when amounts vary widely, and judgmental sampling to focus on exceptions or red flags. For small churches, sample sizes can be small but should cover the largest donors, largest disbursements, and recent activity around key seasons. A practical approach: test all items above a threshold (for example, all gifts or payments over a set dollar amount) and a random sample of smaller items. Document your rationale so the sample can be defended later.

Vouching, Tracing, And Confirmation Steps

Use vouching to prove recorded amounts actually occurred, for example from ledger entry back to deposit slip and bank statement. Use tracing to confirm transactions are fully recorded, for example from a deposit slip into the ledger. For third-party confirmations, request verification of bank balances, merchant statements, or grant balances directly from the provider when possible. Keep a checklist for each item tested listing the source documents, who supplied them, and any discrepancies found. Tie every finding to a specific document or system export.

Conducting Interviews And Walkthroughs

Interviews and walkthroughs uncover how things actually work, not how policy says they work. Prepare focused questions, ask staff to walk a transaction from start to finish, and watch one or two live or recent transactions when possible. Record responses, note any exceptions, and compare them to documented procedures. Treat interviews as fact-finding, not accusatory, and offer to show auditors where records are kept so gaps can be fixed. Conclude with a brief recap to confirm understanding and agree on follow-up evidence.

Drafting The Audit Report

An audit report should drive action, not confuse readers. Keep it short at the top, complete in the body, and factual in tone. Use plain language, separate findings by severity, and link each finding to evidence and a suggested remediation. Include management responses and an agreed timeline for remediation in the final report.

Structuring Findings And Recommendations

Start with an executive summary that states scope, key risks, and the top three findings. For each finding use a consistent format: title, condition, criteria, cause, effect, supporting evidence, and recommendation. That structure helps leaders see the problem, why it matters, and what to do next. Provide attachments for supporting documents so the main report stays readable. Include a short appendix with the audit scope, sample sizes, and limitations.

Writing Clear Severity Levels And Remediations

Define severity levels up front, for example low, medium, high, and critical, and explain what each means in plain terms, such as financial exposure, regulatory risk, or safeguarding concern. For each remediation, be specific about action, owner, and target date. Don’t write vague fixes like “improve controls.” Instead say “require two-person cash counts for weekend offerings, assigned to finance chair, effective immediately, with a training session by [date].” That level of specificity makes follow-up measurable.

Sample Audit Report PDF And Language

Provide a one-page summary for the board and a fuller PDF with findings and evidence for the finance committee. Use neutral, direct language and avoid technical jargon when addressing the congregation. Include suggested wording for public communications and donor notifications if applicable. If you attach a sample PDF template, make sure it includes the executive summary, findings with severity tags, management responses, and an action register.

Presenting Findings And Building Action Plans

Presentations are an opportunity to build trust, not lay blame. Tailor the level of detail to the audience. The board needs risk and decisions, the finance team needs tasks and resources, and the congregation needs reassurance and transparency where appropriate.

Reporting To The Board And Leadership

Lead with the top risks and proposed board actions. Provide a short packet, including the one-page summary, the most important supporting docs, and the proposed remediation plan. Be ready to answer how much fixes will cost, how long they’ll take, and what governance changes are required. Keep sensitive details out of public packets, and recommend executive sessions for personnel or safeguarding matters.

Prioritizing Fixes And Assigning Owners

Triage findings by risk and effort. Label quick wins that reduce risk fast and low-cost fixes requiring minimal training. Assign each action an owner, due date, and required resources. Track progress in an action register and require status updates at regular board or committee meetings. Use the register to hold people accountable, celebrate closed items, and reassign tasks that stall.

Communicating Results To Congregation And Donors

Be transparent without oversharing. For most findings, a short message to the congregation explaining that an internal audit was completed, improvements are underway, and stewardship remains a priority is sufficient. For issues involving donor funds or breaches, notify affected donors promptly, outline corrective steps, and offer a contact for questions. Use pastoral language, avoid technical detail, and coordinate messaging with legal advice when necessary. Provide a brief FAQ and report back on remediation progress to restore confidence.

Monitoring Remediation And Continuous Improvement

Tracking Status With A Remediation Log

A remediation log turns findings into accountable tasks. At minimum capture: finding ID, title, severity, root cause, recommended action, owner, target date, current status, evidence links, and closure date. Keep the log simple and accessible, update it at every status meeting, and attach screenshots or scanned invoices as proof of work. For small teams a shared spreadsheet works fine. For growing churches use a centralized action register in whatever tools you already use so ownership, dates, and attachments are auditable. Require owners to update progress weekly when items are open and escalate past-due critical items to the board.

Integrating Audit Work Into Annual Planning

Treat audit remediation as part of the church’s operating plan, not a side project. Feed high-cost fixes into the budget cycle, schedule training and policy rollouts in quieter ministry months, and align major remediation milestones with board review dates. Build a quarterly audit checkpoint into the annual calendar so the finance committee reviews open items, resource needs, and any policy changes. When a finding requires software or vendor changes, include procurement timelines and testing periods in the plan so fixes don’t stall after approval.

Key Metrics To Measure Audit Impact

Measure whether audits are changing behavior, not just producing reports. Useful metrics:

• Number of open findings, and percent closed on time.
• Average days to close a finding.
• Repeat findings by area, showing persistent weakness.
• Reconciliation lag days for giving and bank accounts.
• Number of control exceptions discovered per audit, normalized by scope.
• Incidents affecting safeguarding or donor trust.
  Set baselines and simple targets, review metrics quarterly, and publish a short stewardship dashboard to the board so progress is visible.

Comparing Internal And External Reviews

When To Engage An External Auditor

Bring in an external reviewer when you need independence, specialist expertise, or formal assurance. Typical triggers:

• A capital campaign, merger, or major grant requiring a third party review.
• Suspected fraud or complex payroll, tax, or grant compliance issues.
• Donor, lender, or denominational requirements for independent verification.
• Lack of internal capacity or when the board wants objective confirmation of controls.
  External reviewers add credibility, but they also cost more and take time.

Cost, Scope, And Frequency Considerations

Internal reviews are low cost, frequent, and improvement focused. External reviews are higher cost, deeper, and seen as more objective. Consider a hybrid approach:

• Routine internal audits quarterly or semiannual to catch issues early.
• External review every 2 to 5 years, or when major events occur.
  When budgeting, factor in scoping time, fieldwork days, report turnaround, and potential remediation costs. Be explicit about deliverables, evidence needs, and confidentiality up front to control scope creep.

Scalable Options For Small Churches

Small churches don’t need to choose between doing nothing and hiring a firm. Scalable options include:

• Peer reviews with nearby congregations or denominational auditors.
• A part-time CPA or consultant for an annual spot check.
• Fixed-price limited-scope reviews focused on giving and payroll.
• Using templated checklists and sample workpapers to do an internal review with volunteer accountants.
  Combine low-cost external advice for complex items with regular internal checks to keep costs manageable.

Avoiding Common Audit Pitfalls

Inadequate Documentation And Segregation

Weak documentation and poor segregation of duties create recurring findings. Fixes are straightforward: document processes, require written approvals, and assign dual controls for counting, deposits, and check signings. Use role-based access for finance systems and require evidence of approvals for changes to vendor files or payroll. A short policy library and routine file spot-checks eliminate most of these problems.

Overlooking Online Giving And Software Risks

Online giving and integrated tools increase efficiency, but they also introduce new failure points. Don’t assume integrations are perfect. Reconcile platform reports to bank deposits and ledger entries regularly, review API logs when imports fail, and limit who can export donor or financial data. Confirm payment processors meet PCI expectations and that refunds follow documented approval workflows. Moving away from disconnected spreadsheets to a single, maintained system cuts many of these risks.

Failing To Follow Up On Findings

An unresolved finding is a multiplied risk. Avoid this by assigning owners at report issuance, tracking progress in the remediation log, and making remediation status a standing agenda item for the finance committee or board. Require evidence of completion, then verify with a light re-test. Celebrate closures and hold people accountable for overdue items so follow up becomes part of normal governance.

Audit Templates, Checklists, And Samples

Printable Church Audit Checklist

A one-page checklist keeps fieldwork focused. Include checkpoints for:

• Cash handling and count sheets.
• Bank reconciliations and deposits.
• Restricted fund use and pledge tracking.
• Payroll authorizations and timesheets.
• Background checks and safeguarding evidence.
• Vendor master controls and expense approvals.
  Use the checklist for walk-throughs, then expand items that need deeper testing.

Audit Program Template And Workpapers

A practical audit program lists objectives, scope, sample methods, and procedures for each area. Pair it with workpapers that record samples tested, evidence obtained, tickmarks, and reviewer signoffs. Keep digital folders named by finding number and date. Standardize templates so different volunteers or auditors produce consistent, defensible workpapers.

Sample Audit Report And Finding Statements

A clear finding statement is concise and actionable. Use this format: title, condition, criteria, cause, effect, evidence, and recommendation. Include management response and an owner with a target date. Provide the board a one-page executive summary plus a full appendix of evidence. Offer suggested plain-language messaging for the congregation where appropriate.

Quick Risk Assessment Matrix

Use a simple 3 by 3 matrix, likelihood on one axis and impact on the other, to prioritize findings. Score each risk, color code into low, medium, high, and assign remediation urgency based on score thresholds. Keep the matrix visible in the remediation log so everyone understands why some items get immediate resources and others are scheduled.

FAQs

How Often Should A Church Have An Audit?

There’s no one-size-fits-all answer. Match frequency to risk and activity.

• Ongoing controls: bank reconciliations, giving reconciliations, and key access reviews should be done monthly or weekly for high-volume churches.
• Routine internal reviews: a focused internal audit of one or two high-risk areas, like giving or payroll, every quarter.
• Full internal audit: annually for most churches, timed after busy seasons so records are available.
• External review or audit: every 2 to 5 years, or sooner when a capital campaign, merger, grant requirement, leadership change, or suspected issue occurs.

If you’re small, run lighter checks more often instead of waiting for a big annual event. Small, regular checks catch problems before they grow.

What Does A Church Audit Report Include?

A useful report gives leaders the facts and a clear path to fix things. Typical contents:

• Executive summary with top risks and key recommendations.
• Scope, objectives, dates, and who performed the work.
• Methodology and sample sizes, so readers can judge coverage.
• Findings laid out consistently, for example: condition, criteria, cause, effect, evidence, recommendation.
• Severity rating and prioritized action items with owners and target dates.
• Management responses and agreed remediation steps.
• Remediation log or action register for follow up.
• Appendices and workpapers with supporting documents, sample lists, and limitations.

Provide a one-page board summary and a fuller appendix for the finance committee. Keep public messaging short and pastoral when sharing with the congregation.

How Much Does A Church Audit Cost?

Costs vary widely by scope, complexity, and who does the work.

• Internal audits: mostly staff or volunteer time, often a few hundred to a few thousand dollars in equivalent labor and admin time.
• Limited-scope external review: small churches can expect roughly $1,000 to $5,000 depending on travel and complexity.
• Full external audit or financial statement audit: typically $10,000 and up for larger, multi-site churches or those with complex grants.

Cost drivers to watch: number of transactions, multi-site operations, payroll complexity, grant reporting, IT and integration issues, and how well records are prepared. To control cost, narrow the scope, prepare reconciliations in advance, use templates and checklists, and consider a hybrid approach with volunteer work plus a paid CPA spot check.

Can Small Churches Do Internal Audits Themselves?

Yes. Many small churches run effective internal audits with limited resources if they follow a simple, disciplined approach.

Practical steps:

• Set clear objectives and a tight scope that targets the riskiest areas.
• Use standard checklists, sampling rules, and workpaper templates so volunteers produce defensible work.
• Rotate reviewers so the same person isn’t auditing their own work.
• Leverage your church management app for exports on giving, pledges, attendance, and member records to save time and improve accuracy.
• Document everything, assign owners, and track remediation in a simple log.

Know when to bring in help: suspected fraud, major payroll or tax questions, large grants with audit clauses, safeguarding allegations, or when internal reviewers can’t get independent access to records. Low-cost options include peer reviews with nearby churches, a part-time CPA for spot checks, or a limited-scope external review for the areas you can’t cover internally.