With Great Technology Comes Great Responsibility
October is Cybersecurity Awareness Month. For nonprofit finance leaders, it’s a good time to ask a sharper question than “Is our accounting software secure?” Ask instead: “Did we set it up securely?”
Most modern, cloud-based ERPs and the systems that connect to them take security seriously. Leading vendors invest heavily in protecting their platforms and back that up with independent audits, such as SOC 1 and SOC 2 reports. They also give you strong tools to protect your organization such as multi-factor authentication, role-based permissions, approval workflows, and detailed audit trails. However, these can only protect you when they’re configured to match how your team works. If one person can enter, approve, and pay a vendor bill while going unnoticed, the system’s security features won’t help much.
Where the gaps usually show up
Nonprofits often run lean finance teams, and that can make some controls harder to put in place. Sage Intacct, for example, recognizes that many nonprofit organizations may lack enough finance staff or resources to fully separate duties through system access controls. When adequate segregation of duties is not feasible, guidance recommends supplementing access controls with detective controls, such as regular reviews, reconciliations, and independent reviews of financial system activity and reports.
Integrations are another blind spot that may arise during systems implementation. Your payroll tool, AP automation platform, and donor CRM can all connect to your general ledger which opens up another security consideration, how do we monitor and implement controls to ensure data that is transferred is accurate and complete. To simplify security for integrations, Sage Intacct users create a unique user ID for every third-party integration. That step is easy to skip during a rushed go-live and hard to untangle later.
Why implementation decisions matter
“The biggest issue we see isn’t whether the software is secure,” says Heather Broberg, Principal, GRF Accounting Technology Services. “It’s whether the system reflects the organization’s actual processes and controls. When approvals, integrations, and user permissions are designed during implementation, organizations can reduce risk from day one. When those decisions are delayed until after go-live, they often become much harder and more expensive to fix.”
In our experience, many control issues originate long before a formal or independent security review takes place. They begin with how systems are connected, how approvals are designed, and how users are granted access. Organizations that build these considerations into implementation often spend less time correcting issues later.
Control gaps rarely come from one bad decision. More often, they build up quietly. For example, a new system goes live, but the old one stays on “just for now” for a report or two, because no one planned when to turn it off. Staff create spreadsheets and manual steps to bridge the two. Before long, those workarounds are how month-end close really happens, and no one has designed controls around them. Each choice made sense at the time. Together, they leave you with two versions of the truth, fragmented data, approvals that happen outside the system, and audit findings that return year after year. A well-planned implementation helps to close those gaps instead of carrying them forward.
The same thing happens with people. When one long-tenured staff member is the only person who knows how a key reconciliation or integration really works, that knowledge is functioning as a control, and it isn’t written down anywhere. Before you configure permissions and workflows, map how work actually gets done, not how the policy manual says it gets done. That gap is usually where the real risk lives.
Must-Haves in your system implementation.
When implementing or upgrading an ERP, don’t treat controls as something you’ll “clean up later.” Build them into the design from day one.
System and Process Design
- Define approval workflows before go-live. Know who can enter, approve, and release transactions.
- Configure role-based access so users have only the permissions they need to do their jobs.
- Evaluate administrator level access across financial systems to reduce the opportunity for one individual to be able to control a transaction throughout the entire lifecycle.
- Separate duties wherever possible. If staffing is limited, identify compensating controls such as documented management review and exception reporting.
- Document key financial processes before configuring the system so the technology supports the way your organization operates.
- Review approval thresholds and escalation paths to ensure they match your policies and delegated authority.
Integrations and Connected Systems
- Create a unique user ID for every third-party integration connecting to your ERP. This makes activity traceable and simplifies troubleshooting. Integration is a common area where shortcuts during implementation can create problems later.
- Inventory all systems that exchange data with your ERP, including payroll, AP automation, CRM, association management, fundraising, and banking platforms. Document the type of integration such as manual entry, Batch Import with Human Review, 1-way data transfer, or bi-directional data transfer.
- Remove unused integrations and dormant service accounts.
- Test integrations regularly to confirm the data being transferred is complete and accurate.
Cybersecurity and Risk Questions to Ask Vendors
- Request vendor security information such as SOC 1 and/or SOC 2 reports, ISO 27001 certification, AI governance frameworks, disaster recovery information, etc..
- Ask how the solution supports identity management, multi-factor authentication, encryption, and incident response.
- Review the vendor’s published security documentation and cybersecurity posture.
- Understand where your data is stored and what backup and recovery processes are in place.
- Ask and understand how AI is utilized within the system, what controls internally can be implemented to review AI outputs, and whether this aligns with internal policies around AI usage and security.
- Ask how access is monitored and what audit logs are available if an issue occurs.
After Go-Live
- Review user access at least annually and remove accounts that no longer need access.
- Periodically test workflows and controls to verify they still align with organizational policies.
- Review audit logs and exception reports for unusual activity.
- Reevaluate controls whenever you add a new integration, application, or business process.
- Set a firm date to retire legacy systems and bring any spreadsheets or manual workarounds that support month-end close into your controls review.
- Identify processes that depend on one person’s knowledge, document them, and cross-train a backup.
Resources worth your time
- New York Just Published Risk Assessment Guidance. Nonprofits Should Read It. New York’s new cyber risk assessment guidance was written for banks and insurers, yet it gives nonprofits one of the clearest free roadmaps for proving the “reasonable” safeguards that the SHIELD Act and federal grant rules may already require of them.
- Lessons learned: the importance of nonprofit internal controls in your accounting system (Sage). This is a practical overview of why controls matter for nonprofits. It also explains how cloud-based accounting can help organizations tighten internal controls, along with a checklist of control features to look for.
- Cybersecurity for Nonprofits (National Council of Nonprofits). This is a step-by-step guide to assessing and reducing data risk at your organization. It walks through taking inventory of the donor, client, and employee data you hold, judging where a breach would hurt most, and choosing protections that fit your budget.
