Church Money, Donations & Financial Controls

What to Do If You Suspect Financial Misconduct

Published 2026-09-05 · Church Money, Donations & Financial Controls

Short answer: don't confront the person, don't announce it, and don't start pulling files on your own. Write down what you've observed with dates, secure the records and the access, tell the board chair or the next person up who isn't involved, and talk to a lawyer before you take any investigative step. Then notify your insurer within its deadline. The first 48 hours decide whether the church ends up with a resolvable problem or an unrecoverable one.

You've noticed something. A deposit that doesn't match the count sheet. A vendor nobody can identify. A card statement with charges the treasurer explains a little too smoothly. And the person involved is someone you've prayed with for years.

Everything in you wants to do one of two things: ask them directly and clear it up, or say nothing and hope you're wrong. Both are wrong. Both make it worse. Before you decide what you're actually looking at, it's worth knowing how church embezzlement usually happens, because what looks like theft is sometimes a bookkeeping mess, and what looks like a bookkeeping mess is sometimes theft. What follows is the order that protects the church, the congregation, and (this matters) the person you suspect, who may turn out to have done nothing.

Why not just ask them?

Because a direct conversation, before anything is secured, causes three specific harms.

Records disappear. Not always deliberately. Someone under pressure "tidies up," deletes an email thread, or takes a laptop home. Once the records are gone, the truth is gone with them, including the truth that would have cleared them.

The church loses its options. How a matter is investigated affects whether an insurer will pay, whether an employment decision holds up, and whether law enforcement can act. Steps taken in the first days are hard to unwind.

You may defame someone. Boards are sometimes wrong. An accusation that has already circulated isn't repairable by an apology, and people have lost jobs and reputations over an accounting error nobody understood.

The instinct to confront comes from decency. It's still the single most damaging thing a well-meaning board member does in week one.

What do you do in the first 48 hours?

1. Write down what you actually observed. Facts, dates, amounts, documents you saw and where. Separate observation from inference. "The March deposit slip shows $2,140; the count sheet shows $2,610" is an observation. "He is stealing" is not. Keep this note private.

2. Tell exactly one person: the next authority who isn't connected. Usually the board chair. If the board chair is involved, the vice-chair or the full board minus that person. Don't tell the staff. Don't tell your spouse's small group. Every additional person increases the chance of a leak, and a leak destroys a congregation's trust far more reliably than the underlying loss.

3. Preserve everything. Bank statements, deposit records, count sheets, invoices, credit card statements, payroll files, emails, accounting backups. Don't alter, annotate or reorganize anything. Take copies and leave the originals exactly as they are. If your accounting system has an audit log, don't let anyone purge it.

4. Secure access quietly. Online banking permissions, check signing, the credit card, the accounting system, the donor database. This can usually be done as a routine administrative change without signalling anything. Changing bank authority isn't an accusation; it's a control.

5. Consult a licensed attorney before you investigate. This isn't a formality, and it isn't about lawyering up against a church member. An attorney tells you what you may and may not do next, helps you engage a forensic accountant in a way that protects the work, and keeps the church from taking a step that forfeits its insurance or its employment position. Do this before interviews, before you pull the person's file, and before any communication goes out.

6. Check the insurance clock. Your crime, fidelity or employee dishonesty coverage almost certainly has a notice requirement measured in days, and late notice is one of the most common reasons a claim is denied. Find the policy, find the notice provision, and diary the deadline the same day. If you're not sure what you carry, this is the moment to find out. Reading your church insurance policy is a task most boards have never done, and this is when it bites.

Who should be handling this?

Not the person who found it, working alone at night.

The board owns this, or a small subcommittee it appoints, because handling church funds prudently is a board duty and it can't be delegated away once a question is raised. A church's exempt status carries obligations that sit with the organization itself, not with one bookkeeper (IRS Publication 1828, Tax Guide for Churches).

Three rules govern who sits on that subcommittee:

• Anyone related to, supervised by, or supervising the person in question steps out. Record the recusal in the minutes.
• The finance staff involved in the transactions don't run the review of those transactions. They may be entirely innocent and still can't be the ones testing their own work.
• Nobody investigates a matter they've already formed a public view about. If a board member has told three people what they think, that person is a witness now, not an investigator.

Keep the group small. Two or three people, with counsel, is usually right.

What order does the rest go in?

Once records are preserved, access is secured and counsel is engaged:

1. Scope the question. What specifically are we testing, over what period, from which records? An open-ended trawl produces months of work and no conclusion.
2. Engage a forensic accountant if the amounts or the complexity warrant it, through counsel, on counsel's advice about how the engagement should be structured.
3. Decide the reporting question deliberately. Whether and when to involve law enforcement is a real decision with real consequences either way, and it interacts with insurance and employment. Make it with your lawyer, not at 11pm because someone thinks they should call the police.
4. Handle the employment side separately and carefully. Suspension, paid leave, and termination each carry their own exposure. Don't fire anyone before you have advice. See how to terminate a church employee correctly.
5. Interview only when you're ready, with counsel's guidance on who conducts it, who is present, and what is recorded. The interview with the person you suspect comes late, not early.
6. Decide restitution, discipline and disclosure last, once you know what happened.

What do you tell the congregation?

Something, eventually. Not everything, and not yet.

Silence past the point where people plainly know something is happening reads as concealment, and concealment is what splits churches. Early disclosure of an unproven allegation, though, harms someone who may be innocent and can compromise the review.

The workable path is to say, at the right moment, that the board has become aware of a financial question, that it's being reviewed with outside professional help, that the church's funds are secured, and that the board will report the outcome. No names, no amounts, no theories. Then actually report back, because a church that promises an update and never gives one has created a second problem larger than the first.

Draft that statement with counsel before anyone speaks. The version composed in a hallway is the one that gets quoted.

How do churches make this worse?

Confronting first. Covered above, and worth repeating because it's what most boards do.

Handling it "internally to protect the church's witness." That impulse is understandable and it has ended ministries. Concealment converts a loss into a cover-up, and a congregation's response to a cover-up is categorically worse.

Letting the person resign quietly with no record. It feels merciful. It leaves the church unable to claim on insurance, unable to answer a future reference request honestly, and exposed if the same conduct happens at the next organization.

Promising confidentiality nobody can deliver. If a staff member reports a concern, don't promise their name will never be known. Promise that the church won't retaliate, that access will be limited to those who need it, and that you'll tell them if that changes.

Retaliating, even mildly. Reassignments, cold shoulders and sudden schedule changes after someone raises a concern are how a manageable matter becomes a lawsuit. A written whistleblower policy exists precisely to make the anti-retaliation commitment concrete before it's tested.

Skipping the insurer. See above. Diary the notice deadline on day one.

Doing nothing because the amount seems small. Financial misconduct is rarely a single event, and the first discovered transaction is usually not the first transaction. There's a tax dimension as well: when church money ends up benefiting someone in a position of influence, the tax code treats that as its own problem with its own penalties (IRS, Intermediate sanctions (excess benefit transactions)).

The controls that would have caught it

Once the matter is resolved, the board's real work begins. In nearly every case, the conditions were visible long before the conduct.

The usual pattern: one person receives, records and reconciles; the offering is counted by whoever is available; bank statements go unopened to the same person who writes checks; nobody outside finance ever looks at a vendor list. None of that is anyone's fault individually. It's a structure that makes misconduct possible and, just as importantly, makes an honest person impossible to exonerate. It also puts the exemption in play, because a church's earnings can't be allowed to benefit a private individual (IRS, Inurement / private benefit).

Fix the structure: two unrelated people count the offering and both sign, someone who doesn't write checks opens and reviews the bank statement, dual signatures above a threshold, a board member reviews the vendor list annually, and no single person controls a transaction end to end. Church internal controls that prevent fraud and a two-person offering count procedure walk through both.

Controls aren't a statement of distrust. They're what allows you to trust someone in public.

Common questions

What if I'm the only one who sees a problem and the board dismisses it?

Put your concern in writing to the board chair, keep a copy, and note the date. If it involves the chair, or the board is unwilling to look, you may need to talk to a lawyer yourself about your own position and obligations. A documented concern that was raised and refused is a very different record from a concern that was never raised.

Should we call the police right away?

Sometimes yes. Other times an immediate call complicates the church's own review and its insurance position. Make that call with your attorney and make it quickly, within days rather than months. Just don't make it on instinct.

The person offered to pay it back. Can we just accept that?

Don't accept restitution as a way of closing the matter without advice. Repayment can affect an insurance claim, may not resolve reporting questions, and doesn't by itself discharge the board's duty to understand what happened and fix the conditions. Under the excess benefit rules, correcting a transaction is its own separate step rather than an eraser (IRC §4958, Excess benefit transactions).

Does our whistleblower policy actually matter here?

Yes, more than boards expect. It's what tells a staff member where to report when the person to report to is the problem, and it's the church's written commitment not to retaliate. Adopting one after an incident is far less useful than having one on the shelf. Why the IRS asks about a whistleblower policy covers the reasoning.

How long does this take?

Longer than anyone wants. A small, well-scoped review can conclude in weeks; a complex one takes months. Set expectations with the board early so nobody rushes a conclusion to make the discomfort stop.

The practical wrap

Observe, write it down, tell one person, preserve the records, secure the access, call a lawyer, notify the insurer. In that order, inside 48 hours.

Then let the process be a process. The churches that come through this intact aren't the ones that acted fastest. They're the ones that resisted the two tempting shortcuts, confronting early and containing it quietly, and let people who do this work for a living do it properly. For the frame underneath all of it, start with the three fiduciary duties of a church board member.

---

Have the reporting path in place before you need it. The Whistleblower Policy is the protection clause most church bylaws are missing: where a concern goes when it involves the person it would normally be reported to, plus the board's written commitment against retaliation. $29, instant download.

*Faith Docs provides self-help document templates, not legal advice. We are not a law firm. For representation, consult a licensed attorney.*