Internal Controls and Operational Performance of Nonprofit Organizations

Nonprofits are a significant part of the economy with approximately 1.54 million nonprofit organizations contributing an estimated $1.047 trillion to the U.S. economy in 2016 (NCCS 2019). Nonprofit entities receiving significant federal support are required to design, implement, and maintain effective internal controls (OMB 2003, §200.303). Prior nonprofit studies document evidence that internal control adoption is positively associated with the accuracy of financial reporting (M. Yetman and R. Yetman 2012) and that effective internal controls are positively associated with subsequent contributions (Petrovits, Shakespeare, and Shih 2011). We expand on these studies by addressing the following research question: Do internal controls impact operational performance for nonprofits? This question is important as poor operational performance can lead to negative consequences for the organization's mission-related activities.¹

An organization's system of internal controls helps it to achieve objectives in three categories: operations, reporting, and compliance (COSO 2013; Messier, Glover, and Prawitt 2017). Contemporary studies in the for-profit environment focus on the reporting objective and document evidence that auditor-identified material weaknesses for internal controls over financial reporting (ICFR) are negatively associated with operational performance (Feng, Li, McVay, and Skaife 2015; Bauer 2016; Cheng, Goh, and Kim 2018). Given that the monitoring incentives, performance goals, and operations of nonprofits differ from public firms (López and Peters 2010), it is not obvious that the internal control systems of nonprofit firms relate to the organization's operational environment parallel to that of a for-profit firm.

We examine the association between internal control quality and operational performance in the nonprofit environment where we are able to observe the external auditor's evaluation of both reporting and compliance controls. It is possible that investments in internal controls over reporting and compliance do not improve operational performance if they do not improve information relevant to the operations objectives of nonprofits. Additionally, it is possible that investments in internal controls over reporting and compliance (the two categories that are audited for nonprofits) actually impair operational performance if such investments pull resources away from a nonprofit's charitable activities or away from any internal controls designed to achieve operations objectives.

Anecdotal evidence suggests that the control environment is critically important for nonprofit organizations. The 2012 audit of the Hospital Service District of the Parish of St. Bernard, State of Louisiana revealed a material weakness related to system implementation for the patient revenue cycle. According to the audit report, the failure “of the original system implementation led to the inability of the District to appropriately capture and estimate net patient service revenue in its financial reporting systems on a timely basis as well as generate bills on 2012 charges” (Hospital Service District of the Parish of St. Bernard 2015). The audit report further noted that this system failure led to approximately $8.3 million of unbilled charges. As of January 2017, St. Bernard Parish Hospital reported plans to enter into a long-term agreement with a third party to assume management of operations (Thompson 2017). Although not all internal control deficiencies (ICDs) lead to such dire results, this anecdotal example demonstrates the consequences of control weaknesses on a nonprofit organization's operations.

We look to the nonprofit literature to identify relevant proxies for operational performance in the nonprofit environment. In a recent review of nonprofit financial performance measures, Prentice (2016) documents that financial measures are not interchangeable and that accounting constructs are multidimensional. The author concludes by suggesting that future nonprofit research employ multiple proxies to examine the construct of interest. To model the association between various auditor-reported ICDs and operational performance, we use two operational performance measures specific to the nonprofit environment: surplus and the charitable expense ratio (CER).

Surplus is the excess of total revenues over total expenses (scaled by total expenses). The CER is computed as program expenses scaled by total expenses (program, administrative, and fundraising expenses) and measures how efficiently a nonprofit utilizes its resources to fulfill its mission. Both of these measures are widely considered as valid proxies for operational performance by industry groups (GuideStar, Charity Navigator, the Better Business Bureau Wise Giving Alliance, and the American Institute of Philanthropy) and extant nonprofit research (Chang and Tuckman 1990; Tuckman and Chang 1991; Tinkelman 1998; Greenlee and Trussel 2000; Baber, Roberts, and Visvanathan 2001; Trussel and Parsons 2007; Bowman, Tuckman, and Young 2012; Amin and Harris 2017).

Using a sample of large nonprofit filings from 2001 to 2011, we find that reported ICDs (significant deficiencies and material weaknesses over both financial reporting and compliance with major federal program requirements) are negatively associated with surplus and the CER. To reduce concerns that our results are endogenously determined by unobserved characteristics of the nonprofit that simultaneously drive internal control quality and operational performance, we also perform change analyses examining the time-series changes in surplus and CER as a function of new and remediated ICDs. One advantage of a changes analysis is that it uses the same firm as its own control and thus mitigates the correlated omitted variable concern (Cheng et al. 2018). We find evidence that new ICDs are associated with concurrent decreases in both surplus and the CER. We also find that remediation of ICDs is associated with concurrent increases in surplus, although not associated with changes in the CER. Our results are robust to sample restrictions excluding organizations suspected of expense manipulation and to alterative proxies for operational performance.

Our study contributes to multiple streams of research within accounting. First, we contribute to the nonprofit literature pertaining to internal control over both financial reporting and compliance over major federal programs (Petrovits et al. 2011; Nezhina and Brudney 2012; Rich and Zhang 2014; Burks 2015; López and Rich 2017). Audit reports for nonprofit organizations are intended to help stakeholders assess the risk that organizations are not effectively carrying out their mission-related activities and fiduciary responsibilities. Our analyses demonstrate that audit metrics (reported ICDs) correlate with operating performance information, which ultimately impacts contributions as documented by prior research (Weisbrod and Dominguez 1986; Okten and Weisbrod 2000). Second, our results contribute to the broader literature on internal controls. Contemporary studies of the association between internal controls and operational performance are set in the public-issuer environment where researchers are only able to observe deficiencies in ICFR. We examine outcomes separately for ICFR and internal controls over compliance and find evidence supporting associations between both internal control areas and overall performance.

Finally, our study is of interest to nonprofit stakeholders, including donors and managers. The market for nonprofit funding is competitive and resources are scarce (Petrovits et al. 2011, Garven, Beck, and Parsons 2018; Waymire, Webb, and West 2018). Investments into internal control systems may divert resources from the charitable mission or they may fundamentally “pay for themselves” by improving the organization's operational efficiency, freeing other resources to be allocated to the charitable mission in the current or subsequent periods. Our results are consistent with a net positive effect of internal controls and add to the body of evidence that strong internal controls are valuable in the nonprofit environment (Petrovits et al. 2011; Cohen 2012; Yetman and Yetman 2012).

The remainder of this paper is organized as follows: Section II provides background information and develops our research question. Section III presents research design. Section IV describes sample selection and descriptive statistics. Section V presents empirical results. Section VI presents sensitivity analyses. Section VII provides the conclusion.

The nonprofit sector makes up a considerable portion of the greater U.S. economy with annual charitable giving of approximately $427.7 billion in 2018 (Giving USA 2019). These organizations include schools, healthcare providers, affordable housing, research laboratories, etc. Nonprofits provide a public benefit and, in turn, receive preferential tax treatment from the IRS under Section 501(c)(3) as public charities or private charitable foundations.

Despite their economic magnitude, nonprofits are not governed to the same regulatory standards as for-profit corporations. The Sarbanes-Oxley Act of 2002 (SOX) imposes strict internal control standards on publicly traded companies but largely excludes nonprofits.² However, there are unique regulatory requirements for those organizations that receive federal funding (a large portion of the nonprofit sector). Nonprofit entities receiving significant federal support are required to design, implement, and maintain effective internal controls (OMB 2003, §200.303). In accordance with the Single Audit Act, all organizations with federal expenditures greater than $750,000 ($500,000 for fiscal years ending before December 26, 2014, and $300,000 for fiscal years ending before January 1, 2004) must undergo an audit conducted in accordance with the Office of Management and Budget (OMB) Circular A-133 Audits of States, Local Governments, and Non-Profit Organizations (Petrovits et al. 2011). Similar to public for-profit firms, the results of these audits are publicly available online.

Akin to a standard public company audit, A-133 audits require the auditor to evaluate both the financial statements and the organization's internal controls. Similar to the for-profit environment, ICFR for nonprofits include, for example, bank reconciliations and the accounts receivable aging schedule (Garrett 2012). Unique to audits of nonprofits, auditors are also required to evaluate and report on internal controls related to compliance with federal requirements for major federal programs (Tassin, Waymire, and Hines 2019).³ For each program, the government outlines the compliance requirements, which are published in the OMB A-133 Compliance Supplement. Specific audit areas include allowable activities and costs, cash management, program eligibility, budgeting (such as matching, earmarking, etc.), procurement, reporting (both financial and programmatic), and subrecipient monitoring, among other areas (Garrett 2012). Because both ICFR and compliance controls impact informational quality, it is not clear ex ante which controls are more relevant to an organization's overall operating effectiveness.

Audit report disclosures related to the severity of ICDs are also more expansive in the nonprofit environment than in the public company environment. A material weakness is a deficiency, or combination of deficiencies, in internal control, such that there is a reasonable possibility that a material misstatement of the entity's financial statements will not be prevented, or detected and corrected on a timely basis (AICPA 2008, 1844). A significant deficiency (also known as a reportable condition) is a deficiency, or a combination of deficiencies, in internal control that is less severe than a material weakness, yet important enough to merit attention by those charged with governance.⁴ While audit reports disclose only material weaknesses in the public company environment, audit reports in the nonprofit environment disclose both material weaknesses and significant deficiencies. It is not clear ex ante whether these less-severe ICDs (significant deficiencies) impact an organization's operational effectiveness.

A key integrated component of the COSO framework is Information and Communication. The COSO framework notes “Information is necessary for the entity to carry out internal control responsibilities to support the achievement of its objectives” (COSO 2013, 5). This observation has motivated a stream of literature examining associations between observed ICDs and operational performance. Contemporary studies in the public company environment document evidence that auditor-identified material weaknesses in ICFR are negatively associated with operational performance (Feng et al. 2015; Bauer 2016; Cheng et al. 2018). This evidence is consistent with management making poor operational decisions when they are in an impaired information environment and motivates our research question: do internal controls impact operational performance for nonprofits?

Within the nonprofit environment, Burks (2015) notes that accounting errors are strongly predicted by internal control deficiencies. Conversely, Duh, Chen, Lin, and Kuo (2014) find a positive relation between internal control implementation and teaching-related efficiency in private universities, suggesting that an improved information environment may improve performance. Specific to our focus on operational performance, ineffective internal control over donation reporting may negatively impact management's ability to forecast future donations and cause misallocation of resources to fundraising efforts. Ineffective internal control over expenditure reporting and compliance may impair management's ability to identify misallocations or even misappropriations of resources. Nonprofit studies support such expectations as they demonstrate that internal control systems enable management to respond quickly to strategic and reporting risks (Jeffrey 2008) and facilitate high-level fraud detection (Holtfreter 2008).

Although the evidence discussed above provides reasons to expect a negative relation between internal control deficiencies and operational performance, there is the possibility this association will not be observed. Given that the internal controls scope of the A-133 audit focuses on ICFR and controls over federal program compliance, the operational effectiveness component of internal control (COSO 2013) may not be realized by the organization. Because internal controls are costly to the organization, managers may choose to instill but not properly maintain operational controls that are not otherwise required for a clean audit report. The purpose of our research question is to investigate whether internal control deficiencies are negatively associated with operational performance for nonprofits.

We estimate the model for each of four ICD variables reported in the A-133: SD_FR, MW_FR, SD_COMP, and MW_COMP. These indicator variables equal 1 if the auditor reports an ICD within one of the four classifications; 0 otherwise. The prefix SD_ identifies an ICD classified as a significant deficiency by the auditor. The prefix MW_ identifies an ICD classified as a material weakness by the auditor. The suffix FR identifies an ICD that is related to internal controls over financial reporting. The suffix COMP identifies an ICD that is related to internal controls over the compliance requirements of major federal programs. This additional insight into the internal control environment available in the nonprofit environment allows us to expand our analyses beyond what is documented in the for-profit environment (which only examines material weaknesses in ICFR). Additionally, we utilize a summary measure, ICD_N, calculated as the sum of SD_FR, MW_FR, SD_COMP, and MW_COMP.

The model controls for a number of nonprofit metrics common in prior studies (Krishnan, M. Yetman, and R. Yetman 2006; Petrovits et al. 2011; Yetman and Yetman 2012). lnSIZE is the natural logarithm of total assets at the beginning of the period and lnFEDEXP is the natural logarithm of total federal expenditures. COMPLEXITY is the number of non-zero revenue sources (public support, government contributions, and/or program revenue) that the nonprofit reports within the year. RISK is an indicator variable that equals 1 if the nonprofit is classified as “not low risk” by their auditor on the A-133 audit report; 0 otherwise. NEWGRANTEE is an indicator variable that equals 1 if observation is the nonprofit's first year in the A-133 data; 0 otherwise. lnAGE is the natural logarithm of the length of time that the nonprofit has been registered with the IRS as a tax-exempt organization. The model controls for three distinct audit firm tiers: BIG4, REGIONAL, and SPECIALIST. Finally, the model includes industry and year fixed effects.⁵ See Appendix A for detailed variable definitions.

Table 1, Panel A outlines our sample selection procedures. We begin with 189,735 nonprofit-years that appear in both the A-133 and National Center for Charitable Statistics (NCCS) databases from 2001 to 2011. The sample begins at 2001 because this is first year that ICDs for compliance with major federal programs are reported in the A-133 data. We drop any observations with beginning total assets that are either missing or less than $5 million.⁶ We drop observations with missing or $0 values for total revenues, total expenses, or program service expenses as these variables are critical for our operational performance proxies. Each of these sample restrictions helps us to focus on large nonprofits with reliable and relevant data. We drop observations whose audit report does not cover an annual period and observations that demonstrate no change in total assets from the prior to current period or from the current to subsequent period (suggesting duplicate or otherwise invalid observations). Finally, we drop observations missing data for variables from Model (1), leaving 37,994 observations from 8,263 nonprofits in our sample. Table 1, Panel B also reports the observations by NTEE industry classification with the Education, Human Services, and Health industries having the highest proportional representations (respectively) within the sample.

Table 2 provides descriptive statistics for the variables within the sample. The average SURPLUS position within the sample is a positive 7 percent and the average CER is 85 percent.⁷ Consistent with the sample utilized by Petrovits et al. (2011), 16 percent of observations in our sample disclose a significant deficiency in controls over financial reporting (SD_FR) and 6 percent of observations disclose a material weakness in controls over financial reporting (MW_FR). Additionally, 15 percent report a significant deficiency in controls over compliance (SD_COMP) and four percent report a material weakness in controls over compliance (MW_COMP).⁸ Our summary metric (ICD_N) takes a mean value of 0.40. The observations report, on average, $166.45 million in total assets (SIZE) with an average of $20.03 million in total federal expenditures (FEDEXP). They report revenues from an average of 1.8 different sources and 29 percent are classified as “not low risk” by their auditor. Four percent are new grantees in the A-133 data and the average age within the IRS data are 39.6 years. The proportions of the sample audited by Big 4, regional, and specialist auditors are 24, 21, and 36 percent, respectively.

Table 2 also compares mean values of the dependent and control variables between observations with one or more ICDs and observations with no ICDs. SURPLUS and CER are both lower for observations with ICDs than for observations without ICDs (differences statistically significant at p < 0.01). Table 3 presents Pearson correlations among the variables utilizing the full sample of observations that include values for all variables in Models (1) and (2). The two dependent variables (SURPLUS and CER) are negatively correlated with one another.⁹ All four ICD variables (SD_FR, MW_FR, SD_COMP, and MW_COMP) and the summary metric (ICD_N) are negatively and significantly correlated with SURPLUS and CER. All four ICD variables are positively and significantly correlated with one another, motivating separate analysis of each ICD classification.

Table 4 reports the results of estimating Model (1) utilizing SURPLUS as the dependent variable and each ICD variable of interest included separately. Estimation is conducted using ordinary least squares with standard errors clustered at the nonprofit organization level. The estimated coefficients for three of the ICD variable (SD_FR, SD_COMP, and MW_COMP) are negative and statistically significant (at p-value < 0.01, p-value < 0.01, and p-value < 0.05, respectively).¹⁰ The estimated coefficient for the summary ICD metric (ICD_N) is also negative and statistically significant (p-value < 0.01). Overall, the evidence regarding our research question suggests that ICDs are associated with poor operational performance. Variance inflation factors for all tabulated determinants are below 3.0, reducing concern over multicollinearity (untabulated).

Table 5 reports the results of estimating Model (1) utilizing CER as the dependent variable and each ICD variable of interest included separately. Similar to our results in Table 4, the estimated coefficients for all four of the ICD variable (SD_FR, MW_FR, SD_COMP, and MW_COMP) and the summary ICD metric (ICD_N) are negative and statistically significant (each at p-value < 0.01 except MW_COMP which is p-value < 0.05).¹¹ This further supports the negative association between ICDs and operational performance shown in Table 4. Variance inflation factors for all tabulated determinants are below 3.0, reducing concern over multicollinearity (untabulated).

The directions of statistically significant estimated coefficients for the control variables suggest that, in general, stronger operational performance is associated with larger nonprofits (positive estimated coefficients for lnSIZE), less risky nonprofits (negative estimated coefficients for RISK), and younger nonprofits (positive estimated coefficients for NEWGRANTEE and negative estimated coefficients for lnAGE). Relative to the baseline, each of the auditor quality indicators (BIG4, REGIONAL, and SPECIALIST) are associated with weaker operational performance. This is salient given that higher audit fees would reduce a nonprofit's ability to maintain a surplus or direct resources to charitable expenditures (all else equal). However, recent evidence (Elder, Lowensohn, and Reck 2015; Garven et al. 2018) suggests that the cost of specialist auditors results in the benefit of improved financial reporting quality for nonprofit organizations. The data suggest that diverse revenue sources (higher COMPLEXITY) help a nonprofit to maintain a surplus but impair their ability to direct resources to charitable expenditures. Most interestingly, the data suggest that higher funding from federal programs (lnFEDEXP) is negatively associated with SURPLUS but positively associated with CER. This is reasonable as nonprofits are required to expend federal funds quickly (decreasing the chance of carrying a surplus to a subsequent period) and have strict limits on how much can be used for administrative costs (increasing the percentage of funds that will be directed to charitable expenditures).¹²

Table 6 reports the results of estimating Model (2) utilizing change in surplus (ΔSURPLUS) from periods t to t+1 as the dependent variable. Per the first analysis in Table 6, the estimated coefficient for ΔICD_N is negative and statistically significant (at p-value < 0.05), consistent with the statics analysis in Table 4. Table 6 proceeds with analyses of new and remediated ICD variables of interest within their respective sub-samples. The left column of the second analysis examines the occurrence of new significant deficiencies in controls over financial reporting (NEW_SD_FR) from period t to t+1 on a sub-sample where the nonprofit reported no significant deficiency in internal controls over financial reporting in the current period (SD_FR_t = 0). Among these observations, there is a new significant deficiency in the subsequent period (NEW_SD_FR = 1) 8.6 percent of the time (see Variable of Interest [VI] Mean Value in Table 6). The estimated coefficient for NEW_SD_FR is negative and statistically significant (at p-value < 0.01). The right column of the second analysis examines the occurrence of remediated significant deficiencies in controls over financial reporting (REM_SD_FR) from period t to t+1 on a sub-sample where the nonprofit reported a significant deficiency in internal controls over financial reporting in the current period (SD_FR_t = 1). Among these observations, the significant deficiency is remediated in the subsequent period (REM_SD_FR = 1) 44.9 percent of the time (see VI Mean Value in Table 6). The estimated coefficient for REM_SD_FR is positive and statistically significant (at p-value < 0.01). Table 6 proceeds to examine new and remediated ICDs for the three remaining ICD specifications: MW_FR, SD_COMP, and MW_COMP. While not every relationship is statistically significant, the results as a whole demonstrate evidence supporting a negative impact of new ICDs and a positive impact of remediated ICDs. These relationships are consistent with our primary results and demonstrate that ICDs are associated with poor operational performance.

Table 7 reports the results of estimating Model (2) utilizing the change in the charitable expense ratio (ΔCER) from periods t to t+1 as the dependent variable. Analyses proceed in the same order as Table 6. Table 7 presents some evidence that changes in ICDs and new ICDs are negatively associated with ΔCER. However, these results are not demonstrated across all ICD specifications and do not extend to analyses of remediated ICDs.

Bowman et al. (2012) examine several variations of the surplus metric and assert that it is valuable to improve the metric with adjustments for gains and losses, changes in restricted net assets, investment income, and endowments. We re-perform the analyses presented in this paper utilizing the following alternate calculation of surplus.¹³ The negative associations between ICDs and surplus continue to be supported by this specification of surplus (untabulated). We also perform our analyses using a dichotomous version of SURPLUS that equals 1 if our main surplus specification is positive; 0 otherwise. Within our sample, 68 percent of observations have positive SURPLUS values. Our results are robust to this specification (untabulated).

In order to be considered a low-risk auditee, the OMB Circular A-133 requires the nonprofit to have no identified material weaknesses in each of the preceding two years.¹⁴ As such, the RISK variable is also highly sensitive to the internal control environment and including RISK as a control variable may over-specify the models. As an alternate specification, we drop the RISK variable from the models and re-perform all analyses. Our results are robust to this specification (untabulated). Our results are also robust to including the percentage growth in total assets from the prior to current year (untabulated). As an alternate control for auditor size, we replace the audit firm tier indicator variables (BIG4, REGIONAL, and SPECIALIST) with a continuous variable measuring the total number of signatures by the audit firm's name within the A-133 database. Our results are also robust to this alternate proxy for auditor size (untabulated). Results are also robust to controlling for the issuance of a going concern opinion (untabulated).

Prior studies note that nonprofits may intentionally manipulate their CER by under-reporting fundraising and/or administrative expenses (Tinkelman 2004; Krishnan et al. 2006; Tinkelman 2009; M. Yetman and R. Yetman 2013). Such manipulation could affect our analyses and bias our results. To the extent that a low-quality internal control environment (particularly with internal controls over financial reporting) enables under-reporting of these expenses, we would expect to see a positive association between ICDs and the CER. As such, the possibility of under-reporting fundraising and/or administrative expenses likely biases against the directional relationship documented in our primary results.

We take two steps to limit the impact of organizations with manipulated financial reporting. First, we drop any nonprofits that never report fundraising or never report administrative expenses within the NCCS data. This restriction drops the main sample down to 28,897 observations. Our results are robust to this restriction (untabulated). Second, we identify observations with manipulated data based on the work of Trussel (2003). Trussel (2003) models determinants of accounting manipulation for nonprofits and prescribes a Z-score to identify potential manipulators. We calculate this Z-score and drop any observations with a value greater than 0.24.¹⁵ This restriction only drops the main sample down to 37,934 observations. Our results are robust to this restriction (untabulated) as well.

We extend the accounting literature pertaining to nonprofit organizations by examining how internal control deficiencies (ICDs) impact operational performance in this environment. Using two distinct measures of operational performance, surplus and the charitable expense ratio, we find that ICDs are negatively associated with operational performance. This is consistent with the evidence that poor ICFR leads to suboptimal operational performance documented in the for-profit literature (Feng et al. 2015; Bauer 2016; Cheng et al. 2018). Our results expand the academic knowledge of this relationship, as we are able to demonstrate in the nonprofit environment that the associations hold for ICFR in addition to internal controls over compliance.

Our findings are subject to limitations. Our analyses are focused on large nonprofits with reliable data. Endogeneity is a concern in cross-sectional tests in general. Our analyses examining the time-series changes in surplus and CER as a function of new and remediated ICDs help to alleviate concerns over endogeneity, but we cannot rule it out completely. Furthermore, we acknowledge that we cannot archivally observe the actual expenditure that organizations allocate specifically to internal controls implementation and maintenance.

Due to a mandatory change in disclosure regulation starting in 2008, nonprofit organizations began disclosing a comprehensive list of governance-related factors on their Form 990 annual reports. Future research may examine whether nuanced measures of governance quality such as board independence and executive compensation approval (Desai and Yetman 2015; Harris, Petrovits, and Yetman 2015) are associated with both internal control quality and operating performance.

Our study is informative to multiple nonprofit stakeholders, including donors, auditors, managers, and regulators. Our results are consistent with a net positive effect of investment in internal controls and add to the body of evidence that strong internal controls are valuable in the nonprofit environment (Petrovits et al. 2011; Cohen 2012; Yetman and Yetman 2012). While we find that a breakdown in internal controls has negative consequences on the organization's operations, we also find that the remediation of ICFR weaknesses can improve operational performance. As donors oftentimes recognize the nonprofit's performance through financial measures such as surplus and the CER (Tuckman and Chang 1991; Khumawala, Parsons, and Gordon 2005; Parsons 2007; Tinkelman and Mankaney 2007), organizations may benefit from expending additional resources on enhancing their internal control environment.