Fraud and Risk Management for Church Extension Funds

If you lead a Church Extension Fund, you already know the feeling. The audit is approaching, the loan spreadsheet doesn't quite match the cash report, someone is chasing down a missing approval by email, and you're hoping the investor statement file is the current one. Nothing may be wrong. But you also know that “probably fine” isn't a control framework.

I've spent enough years around CEF operations to say this plainly. Fraud and risk management isn't corporate theater. It's stewardship. You're protecting invested funds entrusted by church members, preserving liquidity for borrowers, and giving your board a defensible picture of what's happening inside the organization.

The problem in many ministry finance environments isn't bad intent. It's fragmented process. Manual workarounds create blind spots. Legacy systems separate loans from notes, cash from the general ledger, and approvals from the transactions they're supposed to govern. When that happens, small errors can sit unnoticed, and intentional misconduct can hide in the same clutter.

Stewardship Through Diligence Beyond Spreadsheets

The most common setup I see is familiar. A capable finance team is doing its best with spreadsheets, exported reports, email approvals, and a few people who “just know how it works.” That approach can limp along for years. Then one employee leaves, one exception isn't reviewed, or one payment change gets pushed through too quickly, and leadership discovers how much of the process depended on memory rather than control.

That's why I push CEF leaders to stop treating fraud prevention as a side topic for auditors. It belongs in the center of operations. A widely cited fraud-risk guide says cases often go undetected for 12 months, and by the time they surface the median loss is $145,000 according to this fraud-risk management overview. In a CEF, that kind of delay can affect more than one transaction. It can reach investor records, borrower disbursements, reconciliations, and board reporting before anyone sees the pattern.

What stewardship actually requires

Stewardship is not the same as trust without verification. Healthy ministry organizations trust people and still build safeguards. Those two ideas don't compete with each other. They support each other.

Here's the practical shift. Stop asking, “Do we trust our staff?” Start asking:

• Where could money move without a second look
• Where could records change without an audit trail
• Where are we relying on a person instead of a process
• Which exceptions would we spot quickly, and which would sit for weeks

Practical rule: If one person can initiate, approve, and reconcile the same transaction stream, you don't have a staffing workaround. You have a control failure.

For most CEFs, better fraud and risk management starts with boring discipline. Reconcile daily or as close to daily as possible. Tie note activity to cash. Review user access. Lock down changes to investor banking instructions. Require documented approval for construction draws. None of that is flashy. All of it matters.

Compliance is part of ministry protection

Your controls also need to support the compliance burden that already sits on your team. State securities requirements, investor communications, tax reporting, and annual audit prep all get harder when records are fragmented. A helpful way to think about this is through the lens of streamlining compliance processes. The principle applies directly to CEFs. Clean intake, consistent documentation, and controlled approvals reduce both fraud exposure and the scramble that follows weak documentation.

A formal program doesn't have to be complicated. It does have to be real. Written responsibilities. Defined approvals. Exception review. Document retention. Incident escalation. Board reporting. If those pieces are loose, your team is depending on goodwill and stamina. That's not a strategy.

The Foundation Your Annual Risk Assessment

Every CEF needs an annual risk assessment that reflects how money, data, and approvals move through the organization. Not a generic template. Not a document copied forward from last year with a new date. A working assessment tied to your operations.

Use this visual as the backbone of the exercise:

Start with assets, not abstract risks

If your team begins with vague categories like “cyber” or “fraud,” you'll get vague results. Start with the assets your CEF must protect:

1. Cash and bank access
   Operating accounts, ACH files, wires, reserve accounts, escrow balances.

2. Loan portfolio records
   Draw schedules, payment histories, payoff figures, covenant tracking, collateral files.

3. Investor note data
   Ownership records, rates, maturity details, payment instructions, tax IDs.

4. General ledger integrity
   Journal entries, subledger tie-outs, month-end close support.

5. Reputation and trust
   Board confidence, investor confidence, borrower confidence, audit credibility.

Then identify plausible CEF-specific threats

A good risk assessment names the scenarios that can happen in your shop. For CEFs, that usually includes unauthorized investor banking changes, manual interest errors, unsupported journal entries, fake or inflated construction draw requests, duplicate disbursements, and internal transfers processed outside normal approval channels.

Use a simple working table like this:

A risk register should describe real failure paths, not idealized policy language.

Score what matters most

You don't need a complicated scoring model. You do need consistency. Assess each risk by likelihood, operational impact, and difficulty of detection. That third factor is where many teams fall short. A risk that would be obvious within a day is very different from one that could hide until month-end or audit season.

If your organization needs a practical external checklist for technology exposure, this guide on how to strengthen digital assets in 2025 is a useful companion for the IT side of the exercise. For governance and compliance structure inside a CEF environment, I also recommend reviewing governance, risk, and compliance services to frame how policy, process, and reporting should connect.

Keep it alive all year

The annual assessment is the floor, not the ceiling. Update it when you launch a new investor product, change banking workflows, add a payment channel, or restructure duties after turnover. The risk register should move when operations move.

The simplest test is this. If a board member asked why a specific transaction process is considered high risk, could your team answer in one minute with evidence? If not, your assessment isn't doing its job.

Designing Controls That Protect and Enable Ministry

A wire request hits the queue late on Friday. The borrower says the closing cannot wait. Staff are trying to help. One person updates the instructions, another is out, and the review gets rushed. That is how good ministries lose money. Not because people meant to do harm, but because the process made it too easy to act fast and too hard to verify.

A sound control structure protects assets without slowing legitimate ministry work to a crawl. In a Church Extension Fund, that balance matters. You are handling investor funds, borrower relationships, and board-level stewardship obligations at the same time. Controls have to satisfy governance expectations and hold up in the daily realities of disbursements, payment changes, reconciliations, and month-end close.

Put segregation of duties at the points of highest consequence

Start where money can leave the organization or where records can be changed in ways that affect cash, investor balances, or loan terms. If one employee can set up a disbursement, approve it, and clear the reconciliation, you have a design problem. If the same person can change investor instructions and release the next payment, you have another one.

For CEFs, I recommend three bright lines:

• Separate setup from release so the employee who enters a wire, ACH batch, or banking change cannot transmit it.
• Separate servicing from accounting so loan modifications, note changes, and general ledger posting do not sit in one unchecked workflow.
• Separate reconciliation from cash activity so the reviewer is independent of the transaction stream being reviewed.

Boards should expect management to define these lines clearly, document exceptions, and review any temporary override caused by staffing gaps or vacations.

Use system controls to carry the load

Lean teams are common in CEFs. That does not excuse weak control design. It means your systems, permissions, and approval rules need to do more of the work.

Focus on controls that stop bad transactions before they settle:

• Dual approval for outgoing funds
  Require a second approver for wires, ACH batches, and changes to investor payment instructions.

• Role-based permissions by function
  Limit user rights to the tasks each role performs. A practical model starts with access control best practices for finance and operations teams.

• Audit trails that cannot be altered quietly
  Track who changed a note rate, maturity date, address, payment instruction, or borrower record, and preserve the prior value.

• Required documentation at approval
  Do not let staff approve exceptions, disbursements, or account changes without the supporting file attached.

• Review queues built around exceptions
  Managers should spend their time on unusual activity, overrides, reversals, stale reconciling items, and after-hours changes.

The strongest controls usually create a short pause. A second approval, a locked field, a callback requirement, or a reconciliation hold often prevents the loss entirely.

Write controls so they survive turnover

A common mistake in ministry finance is confusing a dependable employee with a dependable process. If the control works because one experienced staff member always catches issues, the control is fragile. It will fail during leave, turnover, or peak volume.

Write the rule. Set the threshold. Assign the reviewer. Define the evidence that must be retained. Then test whether the control still works when your most experienced employee is unavailable.

That is the standard. A CEF should be able to show the board not just that controls exist, but that they operate consistently in real workflows. That is how you protect the ministry's assets and keep operations moving.

Automating and Monitoring Your Defenses in Real Time

Manual spot-checking has one strength. It feels responsible. It also has a major weakness. It misses patterns that don't stand out until you connect records across systems.

That's why mature fraud and risk management moves from periodic review to continuous monitoring. A CEF should know, quickly, when an investor payment is directed to a new account, when a borrower's disbursement behavior changes, when a journal entry lands outside normal patterns, or when subledgers stop tying to cash.

This kind of visibility depends on connected data, not heroic effort.

Better alerts start with better identity data

One reason teams give up on monitoring is alert fatigue. If every review queue is full of noise, staff stop trusting the system. Precision matters.

Unit21 reports that precise identifiers can materially improve fraud detection quality. Its published data shows 95.21% true positive rate for phone-number matches and 85.02% for physical-address matches, and it notes that precise identifiers like phone numbers can push true positive rates above 90% in fraud detection workflows, as described in its analysis of how precision in data points sharpens fraud detection. The lesson for CEFs is straightforward. Exact identity resolution beats loose matching.

For CEF operations, that means your monitoring should lean on stable fields such as:

• Verified contact information tied consistently to investors and borrowers
• Authoritative account records rather than copied spreadsheet values
• Standardized addresses and entity names to reduce duplicate or mismatched records
• Controlled change logs so alerts reflect true exceptions, not data cleanup noise

Build monitors around known failure points

Don't start with a giant wish list of dashboards. Start with the transactions that can hurt you fastest.

A sensible monitoring set for a CEF often includes:

The utility of purpose-built platforms becomes clear. Generic accounting tools rarely understand the relationships among loans, notes, cash, statements, and servicing events. A unified environment can surface those relationships automatically. If you're evaluating what modern monitoring looks like in a financial platform, review the capabilities discussed in bank fraud detection software.

“If your team only reviews fraud indicators at month-end, you're accepting a delay that operations can't afford.”

Automation should reduce effort, not just add alerts

A weak automation strategy creates more queues. A strong one reduces manual reconciliation, standardizes approvals, and gives investigators better context when something unusual appears. That's the difference between a system that helps and a system that nags.

Your finance staff should spend their time resolving high-confidence exceptions, not hunting through emails to reconstruct what happened.

Preparing Your Incident Response Playbook

At some point, someone on your team is going to see something that doesn't look right. A payment instruction changed unexpectedly. A journal entry lacks support. A borrower file contains documents that don't line up. The worst time to decide what happens next is in that moment.

Every CEF needs a break-glass playbook. Not a thick binder nobody reads. A short, approved response plan with names, authority lines, and first actions.

The first hour matters most

When a potential incident appears, the priority is containment. Not debate. Not blame. Not broad internal discussion.

Use a sequence like this:

1. Freeze the affected process if possible
   Pause the payment, hold the disbursement, disable the suspect access, or suspend the user action that could extend the damage.

2. Limit who knows initially
   Tell the people who must act. Don't circulate speculative emails. Loose communication destroys evidence and creates confusion.

3. Preserve records immediately
   Save reports, screenshots, audit logs, emails, approval histories, and related documents in a controlled location.

4. Escalate to the designated response lead
   Usually that's the CFO, executive director, controller, or a pre-assigned incident owner depending on the issue.

Assign roles before you need them

Your response plan should name specific functions, not general intentions.

• Operational lead handles immediate transaction containment.
• Finance lead assesses cash exposure, ledger impact, and reporting implications.
• Legal or outside counsel advises on privilege, notification, and regulatory implications.
• IT or security support preserves system evidence and access logs.
• Executive spokesperson manages internal and external communications if needed.

If you suspect cyber involvement, don't let well-meaning staff start “cleaning up” devices or changing a trail of evidence. Preserve first. Investigate second.

Board advice: Pre-approve your escalation path so staff don't waste precious time asking who has authority during an incident.

Control the communication pattern

Most organizations either say too much too early or too little for too long. Neither helps. Write a communication tree in advance. Include who notifies executive leadership, who informs the board chair or audit committee chair, and who handles requests from auditors, banks, or regulators.

A practical incident checklist should also answer:

• When do we contact our bank
• When do we involve outside forensic support
• Where is evidence stored
• Who approves customer or investor communications
• What documentation will we need for audit follow-up

The goal is calm execution. In a ministry setting, reputational harm can spread faster than the facts. A disciplined response protects both assets and trust.

Reporting Oversight and Regulatory Alignment

Monday morning. The board chair asks for a clear answer after reading your packet over the weekend. Are we carrying more fraud risk than last quarter, and what are you doing about it? If your materials force directors to hunt through raw exceptions, policy language, and scattered updates, management has already made oversight harder than it should be.

CEF boards need reporting that connects governance to operations. They need to see where exposure sits today, whether controls are performing as designed, and which issues need direct board attention. Staff can live in the detail. Directors need the signal.

Build a board-ready risk dashboard

Give the board a disciplined dashboard, not an operating report in disguise. A good packet lets directors assess management performance in a few minutes, then spend meeting time on decisions instead of clarification.

For a CEF, that usually means reporting in four lanes:

• Top risk areas
  Identify the few exposures with the greatest impact on liquidity, investor confidence, loan operations, cash handling, or reputation.

• Control status
  Show whether key controls are working, where testing found gaps, and which items are under remediation.

• Open incidents and exceptions
  Include meaningful events, repeat exceptions, and items that point to a control weakness. Leave out the noise.

• Management actions
  Name the owner, the deadline, and the current status. If no one owns the fix, it is not a real remediation plan.

The test is simple. A director should be able to read the dashboard and answer three questions without calling staff afterward. Where are we exposed? Are controls working? What needs attention now?

Align your reporting with recognized governance principles

Your board reporting should reflect the same discipline regulators and auditors expect to see. Clear policies. Defined processes. Accountable people. Tested controls. Timely escalation. CEFs are not banks, but the governance standard is still relevant. Management must show that fraud risk is identified, monitored, controlled, and tied to the organization's actual structure and complexity.

That matters because CEF oversight sits in a tighter operating environment than generic fraud guidance usually admits. You are protecting investor funds, supporting ministry lending, handling state securities obligations, and preserving trust inside a faith-based community where reputational damage travels fast. Board reporting has to reflect that reality.

A concise dashboard might cover:

Keep fraud oversight tied to the broader compliance picture

Fraud reporting should not sit in its own corner of the packet. For CEFs, fraud risk touches access management, vendor oversight, disbursement controls, note servicing, treasury activity, tax reporting, and business continuity. If those threads are reported separately with no connection, the board gets fragments instead of oversight.

That is also why technology governance belongs in the conversation. Teams reviewing resilience expectations in more digital operating models may find this discussion of DORA compliance for enterprise AI security useful because it reinforces a point CEF leaders should already accept. Regulators care about accountability, resilience, and evidence that controls work in practice.

Good oversight reporting does not try to use complex language. It gives directors a clear basis for challenge, approval, and follow-up.

Then close the loop with discipline. If the same unresolved issue appears quarter after quarter, the board will start treating it as background noise. Assign an owner. Set a due date. Retest the control. Document the result. That is how a CEF shows real stewardship, not just good intentions.