In practice, how nonprofits respond to audit findings comes down to three steps: sort each item by severity, name one owner for each fix, and agree on the evidence that will show the fix is done. The auditor reports what was found, but rarely decides who does the work.
This matters most when findings touch the financial statements, federal grant money, donor restrictions, or the board's oversight, and when the same item appeared in the prior year. A small finding about a late bank reconciliation can usually be handled by the finance lead within the normal close cycle. A repeat finding about who can approve payments needs a board-level decision, because it changes the controls the organization depends on.
Why the audit report rarely names who should act
An audit report tells you what the auditor found and, in most cases, why it matters. It does not tell you who in your organization should fix it. For a nonprofit that receives federal awards, the findings usually appear in a schedule of findings and questioned costs, which is part of the Single Audit package. Other observations may come in a separate management letter, which lists recommendations on internal control that the auditor noted during the engagement without issuing them as formal findings.
That gap is normal. Auditors describe conditions and criteria: what the records showed, what the rule or policy requires, and what effect the gap could have. Ownership depends on your org chart, your staffing, and who has authority over the process involved. A finding about payroll changes may sit with human resources and finance together. A finding about grant reporting may sit with program staff who track the deliverables. The audit firm has no way of knowing which of your people has the time or the access to act.
Many organizations read the report, forward it to the executive director, and wait. The result is a list with no owner, and the same items come back the following year. Repeat findings are often a sign that nobody was assigned to the fix, or that the person who was assigned lacked the system access or the authority to make the change.
Before you assign anything, reread each finding and write down the affected process in one sentence. "Expense approvals are not documented before payment" names a process. "Improve controls" does not. The sentence sounds like a small step, but it changes the conversation, because it shows which function holds the work and which people need to be in the room.
Check the assumptions behind each finding too. Sometimes the auditor tested a sample that does not match how the process runs today, or the written policy in the file is out of date. Confirming the facts first keeps you from building a fix for a problem that was already corrected, or for one that was described incorrectly. Ask the audit team to walk you through the population, the sample, and the exception. That conversation is part of the response, and it gives the eventual owner a clearer target.
Sorting findings by severity before anyone takes a task
Severity sets how fast a response must move and who needs to see it. Auditors use a few standard categories. A material weakness is a deficiency, or a combination of deficiencies, that creates a reasonable possibility that a material misstatement would not be prevented or detected in time. A significant deficiency is less severe but still deserves the attention of the people responsible for oversight. Below those sit control gaps that the auditor communicates as lower-risk deficiencies.
Your board does not need to read every item line by line, but it does need to know which findings reached the material weakness or significant deficiency level, and which ones involve federal awards, donor restrictions, or cash controls. A simple sort into three groups helps: items that need board attention, items the finance lead owns, and items that belong to a program or operations manager. Each group gets a different level of reporting, which keeps the board meeting focused.
Use the auditor's classification as a starting point, not the end point. If the classification is unclear, ask for the basis. The conversation with the audit partner often shows whether a finding is a design problem, meaning the process as written cannot prevent the error, or an operating problem, meaning the process exists but was not followed. The two need different answers.
That distinction matters for ownership. A design problem usually needs a policy or system change, which means someone with authority over the process has to approve the new design. An operating problem usually needs training, a review step, and evidence that the steps are happening. The owner of a design fix is often a manager or a board committee, while the owner of an operating fix is usually the person who runs the process every day.
Write the sort in a short table or list that the board can read in one meeting. Include the finding title, its severity as the auditor described it, whether federal or restricted funds are involved, and whether the item repeats from the prior audit. Keep the entries factual. Add your own view of severity only if you can explain the reasoning. Finally, flag any item that affects the reliability of the current year's statements, because those items may need attention before the next set of financial statements is finalized.
Three ways nonprofits divide ownership of each fix
Most nonprofits use one of three approaches to assign fixes. None is right in every case, but each suits a different kind of organization and a different kind of finding. The table compares them on the attributes that usually matter when a response starts to slip.
Approach Who assigns the fix Who does the work Who confirms it is closed Main risk
Executive-led Executive director Department heads, as directed Executive director Controls depend on one person's attention
Finance-led Finance lead, with executive sponsorship Finance staff, outside accountants, and program staff for their steps Finance lead, reviewed by the treasurer or committee chair Program staff may not see themselves as owners
Board-committee-led Audit or finance committee Named staff owners Committee, using evidence supplied by staff The committee becomes a reporting body with no operating authority
The executive-led model fits a small organization with few staff, especially when the findings are operational and the executive director already runs most processes. It is fast, because one person decides. Its weakness is concentration. If that person is busy with fundraising or a program crisis, the fixes stall, and nobody else has the standing to push them forward.
The finance-led model is the most common in organizations with a finance manager, an outside bookkeeper, or a part-time finance leader. It works well when the finance lead has real authority over the process being fixed, such as approvals, reconciliations, or the chart of accounts. It fails when finance tries to fix processes that belong to someone else. A late grant report, for example, may come from program staff who do not send the data on time, and no amount of finance review solves that.
The board-committee-led model suits repeat findings, material weaknesses, and situations where the executive or finance lead has a conflict. The committee sets priorities, reviews evidence, and decides when an item is closed. The risk is that the committee starts to act like the operator. Its job is to ask for proof and make sure the work is owned, not to do the work itself.
Many organizations combine the models. The committee sets priorities and reviews closure, the finance lead coordinates the plan, and each fix has a named operational owner who does the work. That hybrid can be the right answer, but only if it is chosen on purpose. Write down who decides, who executes, and who verifies. A single page is enough. Without that page, each new finding starts the same argument again.
Who signs the management response and what it commits the organization to
The management response is the organization's written answer to each finding. It usually appears in the audit package, so the people who read it include auditors, board members, funders, and sometimes regulators. For federal awards, the auditee must prepare a corrective action plan that addresses each finding. The response is more than a formality. It records what the organization has agreed to do, in its own words, and it becomes the baseline the next audit will test against.
The executive director often signs the response, because the response speaks for the whole organization. That is a good reason to make sure the signer can deliver what the response promises. A signer who has not read the process description, or who has not discussed the timeline with the owner, may commit the organization to work nobody has scoped. The finance lead usually drafts the language, and the executive director reviews it against what the team can actually do.
Commitments need specific wording. "We will review our controls" is vague, and an auditor reading it next year cannot tell whether the review happened. "The finance lead will require a second approval for vendor payments above the threshold in our written policy, effective with the next payment cycle, and will keep the approval log for review" names an owner, an action, a start point, and evidence. Promise actions, not outcomes. Do not write that errors will be eliminated, because no organization can promise that.
Auditors read responses at the next engagement, and a response that describes a process change nobody implemented is worse than no response at all. It creates a record that the organization said it would act and did not. For that reason, review each commitment with the owner before signing, and confirm that the person who will do the work accepts the date and the evidence requirement.
Suppose What's A Interim CFO In Massachusetts community arts nonprofit receives a finding that its grant reports go out without a second review. A weak response says the team will be more careful. A stronger response names the program director as the drafter, the finance lead as the reviewer, and states that the second review will be documented on the reporting checklist starting with the next report. The stronger version is easier to check, and it puts the work with the people who can do it. Keep a copy of every response with its date and signatures, because the next audit will ask what you committed to and whether you did it.
Building a fix plan with one named owner for each action
Once the findings are sorted and the response is drafted, the work turns into a plan. A workable plan follows a short sequence, and each step is a decision that someone has to make in writing:
Write the action as a verb, such as "require two approvals for bank transfers." Name one owner who is accountable for the outcome. Set a checkpoint date when the owner reports status to the reviewer. Define the evidence that will show the action is in place and working. Name a reviewer, what's a interim CFO in Massachusetts separate from the owner, who confirms closure.
The single-owner rule feels strict, but shared ownership usually means no ownership. Support staff can be listed as contributors, and that helps with coordination. Accountability still belongs to one person. When two people share a fix, each can assume the other is tracking it, and the item can stay open for a year without anyone noticing.
Evidence is where many plans fall apart. A status like "completed" is not evidence. Examples of evidence include a signed and dated policy, a bank reconciliation with the reviewer's initials, a screenshot of a system setting with its date, an attendance record for what's a interim CFO in Massachusetts a training session, or a sample of transactions that someone retested after the change. Decide the evidence before the work starts, because it is much harder to reconstruct after the fact.
Accounting systems often hold the fix. In QuickBooks or NetSuite, for example, approval workflows, user permissions, and audit trails may need configuration changes. The owner of that fix must have administrative access, or must be able to ask the system administrator or vendor for the change in writing. If the change depends on someone outside the organization, put that dependency in the plan, with a fallback if the change is delayed.
Check the assumptions in the plan as well. If a fix depends on hiring someone, the plan should say what happens if the hire starts later than expected, and who covers the work in the meantime. A forecast of when the fix will be complete is more useful when you can explain what would change it, such as a vendor delay, a staff departure, or a new grant requirement. Review open items at each board or committee meeting, not only at the next audit. Monthly review is enough for most organizations, and it keeps the plan alive between audits.
Where the board and audit committee fit without doing the work
The board's role in an audit response is oversight. Its members approve policies, receive the sorted findings, ask for evidence, and decide when an item can be closed. They are not the people who approve the payments, reconcile the accounts, or change the system settings. When board members start doing operating work, two problems appear: the operating staff stop feeling responsible for the process, and the board loses the independence it needs to judge whether the fix really works.
Conflicts are a particular concern. A treasurer who also approves payments cannot easily review a finding about payment approvals. A board member who has a relationship with a vendor involved in a finding should step back from that item. The audit committee should be made up of people who can look at the evidence without being part of the process being tested. Where the organization is small and independence is hard to achieve, say so in the minutes and add an outside reviewer for the items that carry the most risk.
Minutes are part of the response. They should record which findings were reviewed, which owners were named, what decisions were made, and what evidence the committee requested. Minutes that say "the committee discussed the audit" give no proof of oversight. Minutes that say "the committee asked the finance lead for three months of reconciliations with reviewer initials before closing the item" show that governance acted and what it required.
Ask for evidence rather than status. "In progress" is a status. "The reviewer initialed the last three reconciliations, and the approval log shows the new workflow in use" is evidence. A good committee chair asks for the second kind of report, and the staff learn to bring it. Some boards overcorrect and take over the fixes themselves. That creates bottlenecks and blurs who answers for the process, so the committee should stay in its lane.
Massachusetts nonprofits also answer to state oversight, and the Attorney General's Office handles charities in the Commonwealth. The annual information return filed with the IRS includes governance questions about board review, so the record of that review is worth keeping. Keep governance records in a form you could produce if asked, and make sure the minutes, the sorted findings, and the closure evidence sit together in one place.
When an interim or fractional CFO can help, and what to define first
Some organizations do not have the internal capacity to run an audit response. Staff are stretched, the finance lead is new, or the executive team is in the middle of a leadership change. In those cases an outside finance leader can help, and the role varies. An interim CFO fills a defined gap for a set period, often during a transition. A fractional CFO works part-time over a longer period. A permanent CFO is a full-time hire. Outsourced accounting covers bookkeeping and closes. Each can take on pieces of an audit response, but the scope and the authority differ, so the choice should follow the work.
The benefit of an experienced finance leader is a second view of the process. That person can test whether the design fix would actually stop the error, draft the corrective action plan, and coordinate with the auditors on the sample and the evidence. The limits matter just as much. No outside advisor can guarantee the outcome of an audit, the next year's findings, or the board's acceptance of the work. An advisor also cannot fix a process that leadership will not authorize or staff will not follow.
Define the engagement in writing before it starts. The document should state which findings are in scope, who holds decision authority, what system access the advisor needs, who signs off on each deliverable, to whom the advisor reports, and when the engagement will be reviewed or ended. Pricing and terms vary by provider, so confirm them directly with each one. Do not assume the terms from a general description of the service.
Independence is another practical concern. If the outside person prepares the books and also tests the controls, the reviewer overlaps with the preparer. Where possible, separate the roles. The person who makes the fix should not be the only person who confirms it. If the organization does not have another reviewer, the board can ask the auditor, or a separate outside reviewer, to test a sample at closure.
Check where the advisor is based and whether they have worked with organizations in your state and country before you engage them. Ask for examples of similar findings they have handled, and ask for references you can call. Treat any figures or results in a biography as a starting point for a conversation, not as a forecast of what will happen in your case. Each organization has its own process, records, and people, and those details decide how much support it needs.
What to check before you call a finding closed
Closing a finding is a decision, and it should rest on evidence rather than on the owner's word. A finding can be closed when the new control is in place, has operated for a period the reviewer considers sufficient, and the reviewer has tested it. The auditor's follow-up at the next engagement is the outside check. Until then, the board's record of the decision is what shows the organization took the finding seriously.
The reviewer should be someone other than the owner. That person samples transactions from the period after the change, compares them against the new policy or setting, and records what was tested and what was found. If the test finds exceptions, the item stays open, and the reviewer notes the reason. Closing an item with known exceptions creates a problem that is harder to explain later.
Decide in advance what period counts as operating. A fix that has been in place for only a few days may not show a consistent pattern, especially for processes that run monthly or quarterly. Agree on the minimum period with the auditor if possible, or with the committee if not. Write the period into the plan, so nobody closes an item early because the work feels finished.
Watch for drift. A closed item can reopen when staff turn over, when a system is upgraded, or when a new grant brings different rules. Schedule a light review of closed items at the next audit cycle, and check whether the controls still run as described. This is the stage where a control that existed on paper turns out to have disappeared in practice.
Before the next audit, pull the prior year's findings and check each one against the list below. Items that cannot pass the list should be reported to the board as open, with the reason stated plainly. An honest open item is more useful to the organization than a closed item that does not hold up.
The owner has signed and dated a statement that the change is in place. Written evidence shows the new control ran at least once, such as an initialed reconciliation or an approval log entry. A reviewer who is not the owner has tested a sample from the period after the change. The updated policy, checklist, or system setting is saved with its version and date. Board or committee minutes record the closure decision and the evidence reviewed. The auditor's follow-up for the next engagement has been requested or noted in the file.