Operations Audit
User Guide

1. About This Tool

An operations audit is the internal self-examination most nonprofits should do annually, and most never do. It's not the financial audit your CPA performs (that one looks at the books). It's a systematic review of how the organization actually operates: are your policies being followed, are your internal controls working, is your governance documentation current, are your HR practices defensible, are your IT systems secured, are your programs being delivered as designed.

Without an operations audit, problems compound silently. The board doesn't know that the Conflict of Interest disclosures haven't been collected in two years. The Treasurer doesn't realize the bank reconciliation hasn't been reviewed by anyone but the bookkeeper in a year. The Executive Director doesn't see that program intake forms are being filled out incompletely. Each individual lapse is small. The cumulative effect is significant operational and reputational risk.

The Operations Audit Tool walks you through eight standard audit domains, captures findings as you go, produces recommendations, and generates a board-ready report with a remediation tracker. Designed to be completed by an internal team (Board chair + Audit/Finance committee + key staff) in 4-8 hours of focused work spread over 2-3 weeks.

2. Getting Started

Who this is for

• Executive Directors doing the annual operational health-check before the board year ends
• Audit Committees / Finance Committees performing oversight beyond the financial audit
• Board Chairs preparing for a board retreat or strategic planning cycle
• New executive directors conducting a 90-day assessment of organizational state
• Funders or accreditors requiring evidence of internal operational review
• Boards in transition preparing for an external review or succession

What you'll need

• Bylaws and Articles of Incorporation
• Most recent audited or reviewed financials
• Most recently filed Form 990
• Adopted governance policies (Conflict of Interest, Whistleblower, Document Retention, Gift Acceptance)
• Current org chart and HR policies (if any)
• Insurance policy summary (D&O, GL, Cyber, Property, Auto, WC as applicable)
• List of programs with intake and outcome documentation
• IT inventory: software systems used, data storage, access controls
• State charity registration status (for each state you solicit in)

How long it takes

4-8 hours of focused work, typically spread over 2-3 weeks. Most teams break it into 8 sessions (one per domain). The findings/reporting phase adds another 1-2 hours.

★ Your First Session: Complete Your First Audit and Generate the Report

This walkthrough takes you from a blank app to a scored dashboard and a board-ready report. Follow the steps in order, using the exact screen and button labels you will see. Plan on 45 to 90 minutes for the first run (you can save and return any time).

Step 1: Sign in

1. Open the Operations Audit app. On the secure portal screen, click the blue Sign in button.
2. Complete sign-in with your All In One Nonprofit account (passwordless email link or Google). You are returned to the app.
3. First time in? A short onboarding sets up your organization. After that you land in the audit.

Step 2: Fill the Organization Profile

1. The audit opens at the first section, Organization Profile. Enter your legal name, EIN, state, year founded, mission area, budget range, and your program, staff, and volunteer counts.
2. Click Save & Continue → at the bottom to move to the next section.

Step 3: Answer the seven scored sections

1. Work through each scored section in order: Governance & Board, Financial Health, Legal & Compliance, Programs & Impact, Human Resources, Fundraising & Development, and Operations & Technology.
2. For each question, click the radio option that best describes your organization. Answer honestly, not aspirationally, the score is a tool, not a grade.
3. Click Save & Continue → after each section. The progress bar and the side list track where you are; you can click any section in the side list to jump.
4. On the last section, the button reads Complete Audit ✓. Click it to finish.

Step 4: Review your scored Dashboard

1. You land on the Operations Audit Dashboard with your health scores by domain. Your first completed audit is automatically saved as your baseline.
2. To revise an answer later, click ← Edit Answers on the dashboard.

Your Operations Audit score and weak areas also feed the Operations domain of the organization-wide Compliance Copilot (/copilot/), a free dashboard that rolls up a single Organization Health Score (0 to 100) across Compliance, Governance, Documents, and Operations. The Copilot pulls from the audit you complete here automatically, so completing and re-running your audit keeps your organization-wide picture current.

Step 5: Turn findings into an action plan

1. On the dashboard, click 📋 Action Plan (or open Action Plan under the Audit & Reports group in the sidebar).
2. Your weak answers appear as findings, sorted critical first. Work them top to bottom.

Step 6: Generate the board report

1. Click 📄 Generate Report on the dashboard.
2. Review the report, then use 🖨 Print Report or export to Word for board distribution.

3. Running an Audit

The Tool runs a structured audit through 8 domains. For each, you review specific items, document findings, and generate recommendations.

Step 1, Set scope

Define audit period (typically the past 12 months), audit team members (Audit Committee chair + Executive Director + one other officer is a common composition), and target completion date.

Step 2, Domain reviews

Work through each of the 8 domains. For each item in the domain checklist, mark: Compliant / Partial / Non-Compliant / Not Applicable. Add notes explaining the rationale and any context.

Step 3, Findings synthesis

The Tool auto-generates findings based on your responses. You refine, prioritize (High / Medium / Low), and add recommendations.

Step 4, Remediation tracker

For each High and Medium finding, assign an owner and a target completion date. This becomes the working document the Audit Committee uses to track follow-up.

Step 5, Board report

Generate the board-ready report. Typically 6-12 pages: executive summary, methodology, findings by domain, prioritization, recommendations, remediation tracker.

4. Using the Tool

The Tool organizes the audit around 8 standard domains. You can run all 8 in sequence, focus on a subset, or revisit specific domains in subsequent years.

Total checklist items across all 8 domains: 100-145. Most organizations complete each domain in 30-60 minutes.

Click-path: open each tool from the dashboard

After you complete the audit, the Operations Audit Dashboard has a row of buttons, and the left sidebar repeats them under the Audit & Reports group:

• 📄 Generate Report (sidebar: not a sidebar item, use the dashboard button) builds the full findings report.
• 📋 Action Plan turns your weak answers into a prioritized to-do list.
• 📈 Trend History charts your score over repeated audits.
• 🗄 Board Summary packages results for the board.
• 📅 Compliance surfaces filing and registration items.
• 📝 Document Templates (sidebar) offers policy and document starters.
• ← Edit Answers reopens the audit so you can change a response.

Click-path: let the AI draft an improvement plan

1. On the dashboard, click ✨ AI Automations (or the AI Automations sidebar item directly under Dashboard).
2. Cards are grouped by module and start collapsed. Expand Operations Improvement Plan and click its ✨ Run button. The plan is built from your real audit scores and red flags, so you must complete the audit first.
3. In the draft window, edit as needed, then export with Copy, Text, Print, ↓ Word, or ✉ Email.

Worked example, end to end: first annual operations audit

1. Sign in and complete the Organization Profile, then click Save & Continue →.
2. Answer all seven scored sections, clicking the radio that matches reality and Save & Continue → after each; click Complete Audit ✓ on the last one.
3. Read the Dashboard. Note your lowest-scoring domain (say Financial Health).
4. Open the Action Plan (📋 Action Plan) and read the critical findings at the top.
5. Draft the plan. AI Automations → expand Operations Improvement Plan → ✨ Run → export to ↓ Word.
6. Report to the board. Dashboard → 📄 Generate Report → 🖨 Print Report, and open Board Summary for the board-facing recap.
7. Six months later, click ← Edit Answers, re-run, and check Trend History to see your improvement.

5. Exporting the Report

Three export options for the final audit report:

• Download as Word (.docx): formatted with table of contents, findings by domain, prioritization, and remediation tracker. Best for board distribution.
• Download as HTML: for posting on a private board portal.
• Copy to Clipboard: plain text for pasting into board materials or external sharing.

6. What an Operations Audit Is (and Isn't)

An operations audit IS

• A structured, self-administered review of how the organization actually operates
• Focused on processes, controls, policies, and documentation, not just financial transactions
• Designed to surface problems early, before they cause real harm
• An expression of good governance (the board is responsible for ensuring management is operating effectively)
• A working document, findings drive remediation, not a one-time report that gets filed

An operations audit ISN'T

• The financial audit (that's a separate engagement with an external CPA)
• A program evaluation (that's a separate exercise focused on outcomes)
• A strategic plan (that's about where the organization should go, not how it currently operates)
• A performance review of the Executive Director (related but distinct)
• An accreditation audit (some accreditors do similar work; this complements rather than replaces accreditation)

7. Operations Audit vs Financial Audit

The two are complementary. The financial audit gives external assurance about the financial statements. The operations audit gives internal insight into how the organization runs. Most well-governed mid-size nonprofits do both.

8. The Eight Audit Domains

1. Governance

Are bylaws current and being followed? Is the board operating at quorum? Are minutes being kept and approved? Are board officer terms being honored? Are required disclosures being collected? Does the board annually review and adopt key governance documents?

2. Financial Controls

Are financial duties segregated? Are bank reconciliations performed and reviewed? Are check signers approved by board policy? Are expense reimbursements supported by documentation? Is the budget reviewed monthly? Is the audit firm independent?

3. HR & Employment

Are personnel files complete? Is the employee handbook current? Are I-9s on file for all employees? Is payroll being filed and paid on time? Are required posters displayed? Are compensation decisions documented?

4. Programs

Are program intake forms being completed? Are outcomes being measured? Is beneficiary feedback being collected? Are program staff meeting required training/certifications? Are program documentation requirements (often imposed by funders) being met?

5. IT & Data

Is there a current inventory of systems? Are access controls in place (passwords, MFA, role-based access)? Are backups happening and being tested? Are data privacy practices in place (especially for donor and beneficiary data)? Is there a breach response plan?

6. Risk & Insurance

Is insurance coverage adequate for current operations? Are policies being renewed timely? Is there a risk register? Are incidents being documented? Is there a crisis management plan? Is D&O coverage adequate?

7. Compliance

Is state charity registration current in every state where you solicit? Is Form 990 filed timely? Are required state filings current? Are required licenses (program-specific) in good standing? Are required employment notices posted?

8. Policies & Documentation

Are required governance policies (COI, Whistleblower, Document Retention, Gift Acceptance) adopted and being followed? Are policies reviewed periodically? Is institutional documentation (org chart, position descriptions, procedure manuals) current?

9. Audit Cadence & Scope

Annual vs biennial

For most small to mid-size nonprofits, annual operations audits work well. Once the team has done one, subsequent audits move faster. Biennial is appropriate only for very stable organizations with strong existing controls and accreditation pressure that limits change.

Full vs partial scope

The first year, do all 8 domains. Subsequent years, you can do a full audit (recommended every 2-3 years) and partial audits (3-4 domains) in interim years. The partial audit focuses on areas where prior findings remain open or where significant operational changes have occurred.

Calendar timing

Best timed at the END of the fiscal year (you have complete data for the period) but BEFORE the financial audit (so any operational findings can inform the audit firm's work). Common: complete the operations audit in the first 60-90 days after fiscal year end, then engage the external audit firm.

When to call in external help

• First-time operations audit at an organization with weak existing controls
• Post-incident (fraud, breach, regulatory action) when objectivity is important
• Pre-merger or strategic transition
• Funder or accreditor specifically requests external review

Most nonprofits can run internal audits successfully, especially after the first one establishes a baseline.

10. Findings, Recommendations & Follow-up

Findings format

Each finding should include:

• Condition: what was observed (the fact)
• Criteria: what should be true (the standard)
• Cause: why the gap exists
• Effect: what risk or impact the gap creates
• Recommendation: what to do about it

Prioritization

Remediation tracker

Each High and Medium finding gets:

• Owner (specific named person, not a committee)
• Target completion date
• Resources required (budget, time, external support)
• Status updates (typically quarterly to the Audit Committee)

Follow-up cycle

The Audit Committee reviews the remediation tracker quarterly. Completed items are marked done; overdue items get escalated. The next annual audit verifies that prior High and Medium findings have actually been remediated, this is what makes the audit cycle a continuous improvement loop rather than a one-time exercise.

11. Reporting to the Board

Standard report structure

1. Executive Summary: 1 page covering scope, overall assessment, count of findings by priority, key recommendations
2. Methodology: 1 page describing audit team, period, domains covered, sources reviewed
3. Findings by Domain: 4-8 pages covering each finding with condition/criteria/cause/effect/recommendation
4. Remediation Tracker: 1-2 pages listing each High/Medium finding with owner and target date
5. Appendix: Detailed checklist responses (often only included for items rated Partial or Non-Compliant)

Board engagement

• Audit Committee reviews the report first, refines it, and recommends to the full board
• Full board receives the report at a regular meeting; Executive Summary is presented; recommendations adopted
• Executive Director takes ownership of the remediation tracker and reports quarterly to the Audit Committee
• Audit Committee reports quarterly to the full board on remediation progress

Confidentiality

The full audit report contains operational details that should remain internal. The board treats the report as confidential; share only with audit committee, full board, Executive Director, and any relevant senior staff. Don't post it externally. Funder due diligence requests typically receive a summary rather than the full report.

12. Who Conducts an Operations Audit

Internal audit team

Typically 3-5 people:

• Audit Committee Chair (or Finance Committee Chair if no separate Audit Committee): leads the audit
• Executive Director: provides operational context; sometimes recused from sections where Executive Director-specific issues arise
• One other Board officer: often Treasurer or Secretary
• One staff member: typically the senior administrator or finance lead, for operational detail
• Optionally: one external advisor (CPA, attorney, retired auditor) on a pro bono or low-fee basis

What individuals contribute

• Board officers bring governance perspective and authority to act on findings
• Executive Director brings operational knowledge of what's actually happening (including informal practices not documented)
• Staff bring ground-truth on whether documented procedures are being followed
• External advisor brings objectivity, particularly important if Executive Director-related findings arise

When Executive Director should recuse

If the audit surfaces concerns about Executive Director conduct, compensation, or authority concentration, the Executive Director should be recused from those specific discussions. The Audit Committee Chair leads those conversations alone or with other board members only.

13. Common Pitfalls

Treating the audit as a one-time exercise

The audit's value is in the annual cycle, not the single report. Year 1 surfaces baseline issues; Year 2 verifies remediation and surfaces drift; Year 3 confirms the operational maturity. A one-time audit is mostly a snapshot. An annual cycle is a discipline.

Audit becomes paperwork compliance instead of substance

The audit checklist asks whether the Conflict of Interest policy exists. The yes/no answer is meaningless if the answer is "yes" but nobody has signed the disclosures in three years. Audit teams need to probe beyond the surface: not just "does the policy exist" but "is it being followed."

Soft-pedaling findings to avoid difficult conversations

If the audit finds problems but the report describes them softly, the board doesn't act on them. Findings should be direct: "Bank reconciliations are being prepared but not reviewed by an independent person" is more useful than "Bank reconciliation review process could be enhanced."

Findings without owners

"The organization should improve its document retention practices" is not actionable. "The Operations Manager will adopt a written Document Retention Policy by August 1 and present it to the Finance Committee for review" is.

Audit team without authority

If the audit team is just staff with no board involvement, their findings don't drive change. The Audit Committee Chair (board officer) needs to lead or co-lead to give findings the weight required for action.

Skipping prior-year follow-up

The next audit should start by checking whether prior High and Medium findings have been remediated. Without this, findings pile up and the audit becomes a recurring complaint document.

Confusing operations audit with performance evaluation

The operations audit examines processes and controls, not whether the Executive Director is meeting goals. Don't conflate the two. The Audit Committee runs the operations audit. The Executive Committee or full board runs the Executive Director evaluation.

Administrator Access

The Operations Audit Tool supports an Administrator role with elevated permissions for managing user accounts and application data.

First-Time Setup

From the sign-in screen, click Administrator Access in the side links. On first use, set an admin password. Stored as a hash in your browser's local storage.

Subsequent Sign-In

After setup, the Administrator Access link prompts for the password and grants administrative permissions.

Forgot the Admin Password?

The password is browser-local and cannot be recovered. Use Reset All Data on the Admin Settings page (clears all data including the admin password hash). Export work first.

Predictions

The Predictions page sits in the left sidebar directly under the Dashboard (next to AI Automations). It scores capacity risk by audit area so you can see, at a glance, which parts of your operation are most likely to need attention next. It complements the Trend History view: Trend History shows where your scores have been, Predictions points at where the pressure is now.

Every score is computed only from your own audit data, right in your browser. There is no black-box machine learning and no outside data. Each area's rank is driven by two transparent factors:

• Current score for that audit area, lower scores rank higher (more attention needed).
• Decline since your last audit snapshot, an area that has slipped since you last ran the audit ranks higher than one that is steady.

The low-and-declining areas surface at the top. Because the page shows the factors behind every score, you can always see exactly why an area was flagged. Run a second audit so the page has a prior snapshot to compare against, that is when the decline factor comes alive.

Operations Capacity Brief (AI)

Each Predictions page also has one AI button that turns the scored areas into a short, prescriptive Operations Capacity Brief: a plain-language read of which areas carry the most capacity risk and the concrete next steps to shore them up. See the AI Automations Guide for details.

AI Automations

The dashboard's ✨ AI Automations button opens seven drafting tools, several of which work directly from your audit results: an Operations Improvement Plan (priorities and a first-90-days plan from your section scores and red flags), a narrative Board Operations Summary, a grant-ready Organizational Capacity Statement built from your audit strengths, an Implementation Guide for any single improvement, an Internal Controls Checkup, an Operations Manual Starter, and an SOP Drafter for documenting recurring tasks.

Every draft opens in an editable preview with Copy, Text, Print, Word (with your document branding), and Email. Drafts never invent scores or findings, and everything is operational guidance, not legal or accounting advice. See the AI Automations Guide.

Contact & Support

This Operations Audit Tool is part of All In One Nonprofit, a growing library of self-service tools and learning content for nonprofit organizations.

Looking for help beyond the platform? See our Helpful Resources page for vetted external resources on legal and tax filing, funder research, governance training, insurance, technology discounts, and more.

The Operations & Compliance Suite

This app is included with the Operations & Compliance Suite and is also available as part of an All-Access Subscription. See pricing →. The apps in the suite:

• Compliance Tracker, every federal and state deadline on one calendar
• Document Retention & Security, data-retention, privacy, and security policies
• Nonprofit HR Management, HR policies, classification, and hiring docs
• IRS Forms Assistant, the annual federal Form 990 return
• Technology & Digital Services, website, email, security, and your annual tech plan

Related All In One Nonprofit tools

• Compliance Tracker, helps maintain the regulatory calendar items reviewed in the Compliance audit domain
• Risk Management & Insurance Audit, the Risk & Insurance audit domain references this app's outputs
• Document Retention & Security Policy Generator, the Policies audit domain checks for documents this app produces
• Nonprofit HR Management Policy Generator, the HR audit domain checks for documents this app produces
• IRS Forms Assistant, the Compliance audit domain confirms Form 990 filings are current
• See all suites & pricing

Questions, suggestions, bug reports

Reach us through the contact form on buildyourclub.com.

Important disclaimers

This tool provides a framework for internal operations audits based on widely accepted nonprofit governance practice. It is not a financial audit and does not substitute for one. It is not legal or accounting advice. Findings and recommendations require professional judgment in interpretation. Have any concerning findings reviewed by qualified counsel or your CPA before acting on them externally.

Document branding, signatures & snippets

In your settings you can brand the documents this tool generates and speed up repeated writing:

• Letterhead and footer: add your organization's letterhead image and a footer (address, contact details, EIN) that appear on your Word and PDF exports.
• Signature: save a default closing (for example, "Sincerely,"), your name, your title, and an optional signature image, added at the sign-off on letters.
• Stats & Snippets: save reusable blocks of text you use often (your mission statement, boilerplate, a standard call to action) and copy any of them into a document you are drafting.

Set these up once and apply them to your exports.