Data Governance & Payment Security Review

A body with a seven-figure reserve and a two-person office is a soft target holding hard money. The controls that would stop a fraudulent payment instruction are cheap, well understood, and almost never written down.

The gap this addresses

Payment fraud against small institutions is ordinary rather than exotic: a change of bank details arrives by email from a familiar address, and it is actioned. There is typically no adopted control requiring verification through a second channel, no requirement that two people approve a transfer, and no obligation to tell members that it happened.

These points test written controls and disclosure practice. They do not require the reviewer to test any system, and no reviewer should attempt to.

The review points

12 points, grouped by what each tests. This set is a draft. It would be versioned, opened for public comment, and re-applied to every prior review when it changes, in line with our Methodology.

Moving money

1. Dual authorisation. Whether any adopted policy requires two people to approve an outbound transfer above a stated amount, and whether the two may be the same person in different roles.
2. Change of payment instructions. Whether a change to a vendor’s bank details must be verified through a channel other than the one that requested it, and whether the verification is recorded.
3. Standing authorisations. Recurring payments, purchasing cards, and auto-debits — who may establish them, and who reviews the list.
4. Reconciliation. Who reconciles the accounts, whether that person is independent of whoever initiates payments, and how often the board sees the result.

Credentials and custody

5. Multi-factor authentication. Whether it is required on banking, payroll, and email accounts, and whether the requirement is written down or merely customary.
6. Who holds the credentials. Whether banking and portal credentials are held by the entity or by its agent, and what the management agreement says happens to them at termination.
7. Turnover procedure. What is revoked, and when, on the departure of an officer, employee, or agent — and whether anyone verifies it was done.
8. Third-party access. Which vendors hold access to the entity’s systems or member data, under what agreement, and whether that list exists.

Member data and disclosure

9. Data inventory. What personal information the entity and its agent hold about members, where it lives, and how long it is kept.
10. Breach notification. The entity’s obligation to notify members under applicable law, whether any adopted policy addresses it, and what was done on any past occasion.
11. Loss disclosure. Whether any payment loss appears anywhere members can see it — the financial statements, the minutes, or a communication.
12. Insurance. Whether crime, fidelity, or cyber coverage is carried, at what limit, and whether the limit bears any relation to the balances held.

Where this applies

• Residential community governance — reserve and operating accounts administered by a third-party agent.
• Municipal governance — Business Improvement Districts and small authorities operating outside central finance controls.
• Public agencies — grant disbursement and vendor payment functions.
• Corporate & institutional boards — small nonprofits and foundations with concentrated signing authority.

How this connects to the rest of the work

Dual authorisation above a threshold, out-of-band verification of payment-detail changes, and a duty to disclose a loss to members are three adopted controls that cost nothing and are almost never required. They belong in a model standard scaled to entity size.

The in-field evidence base for Focus 1 — building by building, firm by firm — is published at condoscoopsnyc.org, which documents the underlying statutory gaps this practice was built to detect.

Other review practices

TASFGA is pre-incorporation. This review practice is a published draft, not an offered service, and no engagement is available. Members of a governed body who wish to apply these points to their own entity are free to do so.