1. Introduction and Background
Inherent industry-embedded values within the nonprofit sector have been shown to pose complex factors that hinder the identification, implementation, and functioning of essential internal control strategies ([7]). Thus, this flexible qualitative case study examined a single nonprofit organization in southeastern Wisconsin to understand how the absence or inadequacy of control strategies could increase an organization’s vulnerability to threats, such as fraud. The latent influencers associated with the problem were identified and assessed for enhanced understanding and awareness of its impact on the nonprofit sector. Likewise, this in-depth discovery yielded evidence explaining the current state of the problem and revealed suggested improvements for leaders.
The nonprofit sector encompasses organizations operating under a unique business model that increases the likelihood of threats and unethical behavior ([14]). However, contemporary research on internal control strategies and corrupt conduct within nonprofits remains underrepresented in current scholarship ([63]). This signified an opportunity to enhance comprehension of internal control strategies in a nonprofit context. Thus, the study’s results advance nonprofit research by addressing the limited availability of practical guidance from current scholarship.
Organizations in the nonprofit sector are more exposed to unethical activities due to a lack of internal control strategies that provide a protective shield against threats, such as theft or fraud ([7]). Internal controls serve as a supportive shield against harmful actions toward nonprofits ([7]; [14]). However, recent research revealed a lack of preparedness among nonprofits to mitigate deceptive behaviors or endure targeted attacks ([48]). Although this case indicated a lack of required competency and capacity, nonprofit organizations require effective strategies to counter the negative consequences caused by exploited weaknesses ([30]; [48]).
Nonprofit organizations exemplify how the absence or inadequacy of internal control strategies can create problematic circumstances arising from the interplay of multifaceted factors ([48]). Compared with for-profit entities, organizations in the nonprofit sector operate under different legal and regulatory standards ([48]). These differences illustrate the existence of a self-regulatory business system within the nonprofit sector ([48]) with an inherent culture characterized by a reduced initiative to establish oversight, control, and ethical guidelines ([30]; [56]). However, these concepts are fundamental to an effective control system designed to guard against threats, such as financial mismanagement, corruption, or fraud ([30]; [48]; [56]). Thus, non-existent or insufficient internal controls form a corruptible foundation capable of exposing the organization by making it more vulnerable to internal or external attacks ([7]; [14]). For example, negative consequences caused by inadequate controls include threatening behaviors, such as fraud, deceitful conduct, and corrupt actions against the organization ([7]). Still, applicable nonprofit scholarship remains limited in its references to these significant conceptual themes ([63]). Therefore, this reinforced this study’s explicit emphasis on nonprofit internal control strategies as critical business practices for mitigating threats and reducing vulnerability.
1.1. Discussion of Research Question
RQ: How can the issue of a possible lack of internal control strategies, which could increase vulnerability to threats and fraud, within a single nonprofit organization in southeastern Wisconsin be improved?
This question served as the study’s central question that guided the research project, investigation, and response to recent research requests for exploration of the broader issue of rising fraud within the nonprofit sector, ill-equipped for counterattacks ([7]).
1.2. Problem and Purpose Statement
The general problem addressed was the lack of internal control strategies, resulting in potentially increased vulnerability to threats and fraud. For instance, nonprofit organizations are prone to setbacks caused by absent or insufficient internal control strategies that fail to deter or detect intrusions by internal or external threats, such as fraud or fraudsters ([63]). Hence, this reinforced the study’s focus on advancing nonprofit research and developing practical solutions to help organizations prevent harmful acts and threats ([14]). Thus, nonprofit leaders and managers require well-developed competencies in internal controls, strategy, and threat detection to recognize and mitigate risky structures better and promote an effective internal control environment ([7]). Furthermore, the specific problem addressed was the possible lack of internal control strategies within a single nonprofit organization in southeastern Wisconsin, resulting in potentially increased vulnerability to threats and fraud.
The purpose of this qualitative case study was to investigate how a potential lack of internal control strategies within a nonprofit organization could increase its vulnerability to internal and external threats. The examination yielded insights into the contributing factors within the nonprofit sector by exploring effective designs to produce practical applications ([63]). Likewise, the study’s findings advance business acumen regarding internal control strategies and enhance understanding of insufficient control practices in a nonprofit context ([63]). Therefore, this flexible qualitative case study of a single nonprofit organization in southeastern Wisconsin strengthened understanding of how internal control strategies reduce exposure to vulnerabilities, such as fraud. This process employed qualitative methods to uncover patterns and themes from real-life experiences through exploratory human interactions ([39]).
1.3. Significance of the Study
An organization’s capability and capacity to mitigate intensifying vulnerability to intrusive threats requires further research to enhance understanding of the underlying problem of a lack of internal control strategies ([44]; [46]). As mentioned in earlier passages, existing control-oriented frameworks include the anti-fraud risk aversion approach by the Committee of Sponsoring Organizations of the Treadway Commission, the criminology-based theoretical design named the fraud triangle ([7]; [14]; [46]; [63]), and the three-line defense model, endorsed by the Institute of Internal Auditors ([44]). Although these approaches have been proven as valuable internal control guidelines, they often lack an appropriate fit for practical application within the nonprofit sector ([24]; [63]). However, the magnitude of this study lies in its contributions to the existing, yet limited, body of literature by focusing on explaining the root of the problem concerning the lack of internal control strategies within the nonprofit sector, thereby revealing practical advice ([14]; [63]).
2. Literature Review
2.1. Control Practices
Organizations employ a variety of control-oriented frameworks to design effective strategies that provide multifaceted protection for the organization ([14]; [63]). Therefore, the ensuing information explains both traditional and standard internal control approaches ([27]; [63]). This process includes the existing default guidelines for developing critical cross-functional internal control programs ([7]; [27]).
Common internal control approaches comprise theory- and practice-based frameworks developed for use and enforcement by firms in the for-profit sector to comply with anti-corruption laws and regulations under the Sarbanes-Oxley Act ([27]; [63]). For example, a standard for-profit industry framework, created by the Committee of Sponsoring Organizations of the Treadway Commission, originated for firms’ financial reporting requirements under the Sarbanes-Oxley Act of 2002 ([7]; [27]). Still, nonprofit fraud scholars call for urgent improvements to nonprofit internal control practices ([14]). Likewise, [63] argued that no specific fraud prevention model designed for the nonprofit sector exists. In comparison, [14] explained how adopters of the industry-standard control framework reported reduced fraud risk. However, [27] found that non-adoption of this benchmark model was linked to factors such as insufficient financial and human capital, inadequate reserves, and resource restrictions. Moreover, developing and implementing a practical, functional control system costs upwards of $8 million ([17]: p. 478).
Examples of criminology-based internal control methods, such as the fraud triangle and its enhanced counterpart, the fraud diamond, focus on preventing intrusions of the organization by understanding the behavior and attitudes characteristic of usual offenders ([63]). The fraud triangle evaluates what compels, motivates, and rationalizes the offender to use an opportunity to infiltrate an organization’s security measures ([55]; [58]). In contrast, the fraud diamond affixes capability to the fundamental factors that comprise the fraud triangle ([58]). However, the existence of opportunity raises questions about the adequacy of this model, even when considering the capability additive, in preemptive risk reduction ([58]; [68]).
In comparison, the Institute of Internal Auditors endorses the three-line model of defense ([9]; [62]). Although the essence of this design provides ample support in defending against fraud, it lacks simplicity and directness ([9]). Indeed, an organization’s governance guidelines and risk management capabilities are vital; however, the model’s reliance on the internal audit function hinders its practical feasibility within a nonprofit organization ([9]; [62]). Moreover, while financial and human resources are necessary to establish a functioning internal audit division, many nonprofits face capacity constraints, such as insufficient financial reserves or inadequate staffing, which make the three-line model of defense less compelling ([62]).
In addition, the internal audit function assesses the organization’s governance and risk management processes ([7]). This function involves coordinated exchanges among the board of directors, members of its audit committee, and the organization’s leaders to evaluate and report internal control activities ([61]). Internal auditors have expertise in conducting risk evaluations to detect, deter, and prevent threats to the organization, thereby enhancing its protection ([7]). Although some nonprofits may find it challenging to implement an internal audit function, a similar alternative is to appraise the quality of governance and executive roles ([17]). For instance, self-assessments are a tool for supporting strategic decisions about controls and vulnerabilities with greater certainty by evaluating the system, structure, and supervisory components, as well as the effectiveness of the board of directors, board subcommittees, such as the audit committee, and senior leadership and management ([13]).
Critical Control Functions. Systematic and humanistic actions influence an effective control system ([32]). Therefore, the control system and individual morality are considered in designing effective ethical practices ([47]). Hence, it makes sense that the organization extends its layers of security to include each internal division with additional control tools for protection ([7]; [38]). Thus, critical control functions, such as oversight, ethics, and accountability practices, are essential. Furthermore, at the divisional level, collaborative cross-functional tasks with adequate control must occur.
Effective control practices are established by a sound organizational structure, supported by a robust governance system that includes oversight and accountability policies ([63]). However, [68] found that, if the opportunity arises, 85% of individuals are inclined to participate in fraud or similar misconduct, such as embezzlement (p. 89). Likewise, research focused on the nonprofit sector suggested that offenders tend to hold positions of power, such as chief executive or senior officer roles ([14]). In fact, [38] found that around sixty percent of fraud cases involved an executive-level employee.
Strategic business practices streamline organizational processes and enable leaders to prioritize their efforts by utilizing performance, impact, efficiency, and quality measures ([59]). Strategy-related activities within the nonprofit sector are typically developed by leaders but guided and authorized by the organization’s board of directors ([21]). However, a critical need for practical strategies aligned with the nonprofit’s explicit design was noted, given its unique business model and inherent deficiencies ([24]; [63]). Furthermore, strategy through a stewardship lens emphasizes accountability as a mission of attentiveness to value-driven long-term goals ([50]). Strategic thinking underscores an initial stage of a continuous cognitive process encompassing assessing, classifying, and confirming information to inform determinations ([3]; [23]; [59]). In contrast to this contemporary perspective of strategic thinking, a traditional view describes a future-forecast-focused approach ([23]). Moreover, personal, environmental, and demographic factors influence strategic thinking and decision-making across approaches ([23]). Furthermore, in a nonprofit context, strategic thinking fosters awareness of the alignment required among the organization’s mission, resources, and vision, thereby clarifying the connection among organizational, divisional, and stakeholder requirements ([50]; [59]).
2.2. Strategic Planning and Implementation
The thoughtful deliberation resulting from the strategic thinking phase yields informed understanding that translates into actions during the strategic planning phase ([16]). Strategic planning requires organization-wide collaboration across leadership functions and an understanding of the strategy among managers and staff ([19]). Moreover, the success of planning and executing strategies that reach targets relies on the fidelity of the organization’s leaders and managers ([50]; [59]). Likewise, leaders who comprehend strategic facets generate strategic capacity ([3]; [19]). For instance, [16] proposed a three-step approach, including budget analysis, authority delegation, and board consensus, for effective strategy implementation. Thus, the complex, multi-faceted nonprofit setting requires board involvement in the planning and execution of organization-oriented strategies ([60]). However, the structure of nonprofit organizations often leads to strong decision-maker influences of complacency ([21]). Furthermore, resistance to change emphasizes a failure to implement strategies ([19]). Therefore, at a minimum, successful execution of strategies requires feedback from all organizational members to assess their understanding and outlook of the strategy ([3]).
Strategic decisions are made by organizational leaders using a systematic design that encourages collaboration and communication ([60]). However, nonprofit decision-making and decision-makers are often shaped by the sector’s inherent trust and mission-oriented objectives, which lead to negligent or lax oversight practices ([20]). Likewise, [21] found that decision-making in formal planning efforts was lacking at the board level. In comparison, [60] mentioned an increase in board immersion in the control and management of decisive strategies. On the contrary, [3] noted a strategic trend that unites leaders, managers, and staff in a modernized decision-making forum. Thus, the decision-making process involves both instinctive and rational reasoning, at the individual and group levels, to inform strategic thinking and planning ([59]).
Strategic management comprises decision-making phases, including thinking, planning, collaborating, and implementing ([3]). Likewise, the strategic thinking and decision-making skills of organizational leaders and managers support strategic management efforts ([59]). Moreover, strategic management involves cross-functional collaboration ([19]; [21]). For instance, human resource routines, such as hiring, onboarding, and retention, are essential examples of strategic management activities ([19]; [21]). In comparison, board and executive leadership succession strategies incorporate a shared leadership contingency to maintain continuity of the governance system and, by extension, the control system ([22]). Furthermore, governance-designed strategies improve responsive accountability to mitigate control mechanisms ([50]).
2.3. Conceptual Framework and Constructs, Governance, Accountability, and Oversight
The structure of nonprofit governance differs from other sectors, such as the for-profit sector ([48]). For instance, a governing board characterizes for-profit corporate governance, whereas cooperation between the board and leaders underscores a nonprofit governance system supported by a team rather than an independent structure ([44]; [48]). Moreover, a nonprofit governance team collaborates to establish organizational guidelines, including developing effective strategies and policies ([48]; [54]). In contrast, for-profit firms often have greater resources to establish a formal internal audit division and further enhance organizational protections to reduce vulnerabilities ([44]). Likewise, board composition, traits, experience, specializations, strategic vision, and leader relations influence organizational controls ([54]). However, the onset and evolution of nonprofit governance systems remain underexamined in terms of the duality between humanistic and systematic processes that intersect with organizational actions, decisions, transactions, procedures, and outcomes ([48]; [54]). Furthermore, the governance function upholds the organization’s social contract, where governing board members represent community welfare and hold the organization accountable ([48]; [50]).
The board of directors authorizes and enforces appropriate accountability measures designed by leaders ([44]). However, each member of the organization’s core workforce must maintain personal responsibility for adherence to the standards established by policies and procedures set by leaders ([24]; [38]). Moreover, the governance system must ensure transparency in accountability standards by disseminating them to all employees to exemplify and establish accountability, support leaders and managers, and increase trust ([50]). In contrast, stakeholder accountability practices refer to the assurances provided to participants assigned to organizational programs and services ([38]). Likewise, organizations must consider other stakeholders, such as investors, donors, and funders, to ensure that accountability policies exist to protect the organization ([32]; [38]; [50]). Therefore, nonprofit accountability policies must employ decisive strategies with intentional design, effective communication, and robust enforcement processes to meet the diverse needs of stakeholders ([14]; [63]).
Ethics and compliance tools, overshadowed by inherent trust factors and general ineptitude, enable misbehaviors in the nonprofit sector ([18]). Thus, it illustrates how nonprofit organizations experience organic circumvention due to non-adoption of the recommended ethical and compliance guidelines ([18]). However, it also suggests that the elements of an ethical environment are not limited to documented policies and procedures but also require leaders to promote integrity ([7]; [14]; [63]) to foster organization-wide commitment and cultivate a climate grounded in shared principles and values ([48]). Furthermore, contemporary ethical conduct programs have evolved to include counteractive tools, such as whistleblowing programs, to encourage appropriate ethical behavior and boost internal compliance ([7]; [14]; [38]).
According to scholars such as [5] and [56], whistleblower mechanisms are vital control tools that leverage observations from the internal workforce to communicate concerns about potential weaknesses, vulnerabilities, infractions, manipulations, mismanagement, or breaches of the control system components. However, planning and implementing a successful whistleblower program requires decision-makers with specific skills. Likewise, the board must be involved as advisors and overseers, and coordination with other departments, such as human resources, reinforces complete functionality. Therefore, this was found to be a viable option for nonprofit organizations to consider incorporating into their governance structures to provide greater assurance of protection and security measures.
2.4. Evaluation, Education, and Training
Evaluation, education, and training are interlinked concepts that illustrate the peripheral mechanisms supporting the monitoring aspect of control supervision, ensuring ongoing assessments of the effectiveness of current control efforts ([14]; [24]; [38]). For instance, evaluation refers to the evaluator’s role in supervising, monitoring, and mitigating processes implemented at the operational level ([7]; [24]). This entails specific skills and knowledge to understand control strategies, related policies, and procedures for observing and reporting control system data to leaders ([63]). While research highlighted challenges in recruiting and acquiring qualified, competent, and capable personnel, this study reinforced the role of internal initiatives in developing employees through training, professional development, seminars, and continuing education opportunities ([7]; [14]; [24]). In fact, fraud awareness, anti-fraud training, risk assessment strategies, and audit skills were found to be significant areas for enhancing internal control monitoring across all organizational levels ([14]; [24]). Thus, investing in staff skill enhancement or continuing education improves the organization’s resilience and adaptability, thereby upgrading its response to dynamic conditions without compromising sustainability or security ([14]; [24]).
2.5. Constructs
The researcher identified three interrelated constructs central to the study’s investigative framework ([49]). These include the control system ([54]), control structure ([14]), and control supervision ([7]). The review of recent scholarship revealed distinct descriptions of these constructs ([11]). Likewise, associations between the constructs and other components of the study’s conceptual framework were noted ([49]; [51]). Thus, the following passages provide a comprehensive perspective on these elements.
The control system shapes the structure, processes, transactions, and interactions of the governance function ([54]). However, the governance system, as a necessary component of the control system ([7]; [12]), has been noted to lack suitable frameworks for the unique nonprofit business model ([63]). However, the board and organizational leaders comprise the governance team that coordinates governance practices, including control activities, such as oversight, accountability, ethics, and compliance ([7]; [14]; [24]). Organizational leaders and managers work under the advisement and guidance of the board of directors to formulate the guidelines, standards, policies, and processes that aim to support the strategic initiatives of the control system ([14]; [24]; [38]; [63]). Ethics and compliance policies are a foremost factor of an effective control structure and should be integrated into formal strategic plans ([14]; [38]). However, research has highlighted this as an area of weakness in nonprofits, where vulnerability increases, and the control tools fail to prevent, detect, or protect the organization’s welfare and security ([14]; [63]). Furthermore, the design of systematic policies and standard operating procedures was found to be a critical function of an effective nonprofit control structure ([14]; [38]; [63]).
Control supervision underscores a critical control construct for evaluating whether the implemented processes align with policies and standards developed by the board and leadership team ([7]; [24]; [38]). However, recent research indicated that a lack of applicable skills and knowledge among managers hinders practical monitoring efforts ([24]; [38]). Likewise, leaders must bring communication and mentoring skills to engage supervisors and support the effectiveness of control reporting duties performed by operational managers ([7]; [24]).
2.6. Related Studies
[36] explained how a review of the existing literature supports the discovery and identification of studies similar to the investigative problem and supportive of the research. This enabled the researcher to highlight comparable studies that incorporate diverse experiences and viewpoints from contemporary journal articles. For instance, exploring the literature revealed similar case analyses and research studies on nonprofit strategies, practical guidance for nonprofits, and specific perspectives from the nonprofit sector relevant to this study and the related investigative problem. Thus, adding support for the significance of a functioning nonprofit internal control system based on effective strategies to ensure its capability to protect the organization from vulnerabilities and threats, such as economic breaches, including fraud. Furthermore, the following passages present a synopsis of each bracketed study the researcher discovered.
[6] contributed a study in an issue of the Nonprofit Policy Forum journal focused on oversight within charitable organizations. A benefit of this study was found in its contemporary perspective on oversight in the nonprofit or charitable sector. Likewise, the perspectives of the enforcer and regulator are highlighted. There were also insights into nonprofit oversight practices, which support this case study. Thus, adding value to the discussion on oversight as a potential weakness in nonprofit control protocols.
[29] explained the connection between the perspectives of nonprofit stakeholders, such as benefactors, and the organization’s transparent actions concerning fraud against the organization. Their peer-reviewed article was published in the Nonprofit and Voluntary Sector Quarterly. The study focused on understanding the relationship between nonprofit organizations that demonstrate transparency by communicating instances of misconduct or fraud and their contributors, supporters, and stakeholders. Therefore, these findings were valuable and aligned with the anticipated and discovered themes on stakeholder perception.
[38] examined the effectiveness of control systems in mitigating security risks within the nonprofit sector. Their research found that most organizations impacted by threatening behavior lacked the necessary oversight and accountability policies. Likewise, they found that nonprofit control systems often fail to detect and prevent threatening intrusions. However, they also found that the absence of controls contributed to reported misbehaviors or crimes against the organization. These findings reinforce the significance of the investigative problem. For instance, the study emphasizes the seriousness of sound organizational control systems within the nonprofit sector, as evidenced by its publication in the Nonprofit and Voluntary Sector Quarterly.
2.7. Anticipated and Discovered Themes
During the contemporary literature review, the researcher identified themes related to this study’s investigative problem ([11]; [66]). Therefore, the following passages emphasize the projected themes identified in advance of conducting this study ([11]; [66]). Moreover, the major themes identified in this case study represent ideas beyond the anticipated themes ([11]; [66]). Thus, this provided additional insight into the commonalities and differences between the predetermined and exposed themes ([66]).
Based on the literature review, the first foreseen theme was transparency and trust ([7]; [14]; [24]; [38]; [63]). Accountability and oversight are functions of the board of directors and its subcommittees, which create the capacity for increased transparency ([54]). In fact, practicing transparency through accountability was found to enhance the concept of trustworthiness, capable of replacing a common nonprofit control framework built on notions of inherent trust, innate moral judgment, and communal decency ([7]; [24]; [63]). In comparison, trust in the nonprofit sector underpins inherent weaknesses, or perceptions held by stakeholders such as participants or donors, which are all integral to the organization’s overall welfare ([63]). Thus, [41] argued that organizations need to improve trustworthy relationships with supporters by sharing performance metrics, adhering to budgets, and realizing objectives.
The second projected theme was stakeholder perception, which was considered because, unlike for-profit firms, nonprofit organizations attend to a diverse portfolio of multi-dimensional stakeholders ([29]). For instance, contributors, whether individual donors, corporate philanthropists, or government grantors, are both supporters and investors who provide dollars or in-kind services to the organization through various means, such as cash, equities, funds, or time ([29]). Moreover, the nonprofit organization’s program participants or service beneficiaries exemplify stakeholders ([24]). Thus, the varied stakeholder perceptions, each of which must be considered differently by the organization’s decision-makers, are significant considerations for nonprofit leaders ([24]; [29]).
The broad topic of resources was highlighted in a remarkable amount of nonprofit-focused scholarship, making it the third projected theme ([24]; [63]). A narrower view of nonprofit resources, associated with the investigation problem of ineffective control strategies and underscored by resource-related requirements, highlighted granular details, such as availability, procurement, provisions, restrictions, and limitations ([21]; [24]; [63]). Indeed, nonprofit resources were found to be vital but vulnerable to risk, such as misappropriation, thereby requiring protective measures to safeguard the organization and its mission ([41]; [68]). In comparison, resource constraints reinforce the importance of internal control strategies in protecting the organization and its assets ([63]).
The fourth and final foreseen theme was volunteerism. This theme emerged from the essential link between nonprofits and the unpaid human capital provided by volunteers ([31]). For instance, the nonprofit sector is highly dependent on volunteer labor, with volunteers often participating in organizational activities at either the staff or board level ([14]; [24]). Although a volunteer-based core workforce reduces an organization’s expenses, it also increases vulnerabilities, such as control circumvention, that compromise the organization’s security protocols ([14]; [24]; [63]). Furthermore, the board of directors’ competencies and capabilities were cited in contemporary research as issues, emphasizing how the inclusion of volunteer members introduced differing perspectives that could compromise the ethical structure, including oversight and accountability policies ([24]).
2.8. Common Differences of Themes Anticipated and Discovered
The major study themes that emerged from the investigation surrounded ethics and compliance operationalized through policies and procedures; systematic cooperative governance function reinforcing accountability; collaboration and communication enabling safeguarding; and threat mitigation through internal and external training, education, and evaluation ([4]; [25]). The study’s themes emphasized the fundamental attributes of an effective control system that protects a nonprofit organization. Additionally, the study data supported conclusions connected to the anticipated themes discovered prior to conducting the investigation. For instance, the study findings on transparency and trust indicated a clear awareness of appropriate actions within a complex nonprofit environment ([24]; [38]).
3. Methodology, Summary, and Conclusions
Flexible research schemes are well-suited for qualitative investigations because they support exploration of emerging themes and patterns through an adaptive capacity to respond to minor shifts in direction ([52]). For instance, a flexible scheme incorporates a responsive inquiry process that fosters both regulated and unstructured probing ([39]). Thus, in this study, it facilitated a deeper understanding of the investigative problem through inquisitive, yet systematic development of evidentiary material ([11]; [39]; [52]). Furthermore, the design’s inherent flexibility enabled the identification and integration of disparate data points to support informed analytical decisions ([39]).
A case study design draws on multiple data sources to provide a comprehensive understanding by blending quantitative and qualitative techniques ([11]; [39]; [57]). In comparison, quantitative methods rely on conclusive numerical data, whereas a case analysis employs inferences derived from observations, logic, and examination techniques ([33]). For example, case studies provide valuable insights into organizational challenges by analyzing the perspectives of organizational leaders and managers, making them a common choice in organizational studies ([11]; [39]; [52]). Hence, the case study was validated as a suitable design for this investigation because it enabled the incorporation of multiple distinct perspectives, facilitating a profound examination of the multifaceted investigative issue within a single organization ([11]; [39]; [52]).
3.1. Appropriateness of Chosen Methods for Methodological Triangulation
The researcher adopted a methodological triangulation approach to complement the primary research methodology, following consideration of data triangulation ([65]), investigator triangulation ([34]), and theory triangulation ([42]) as alternative viable options. The researcher further evaluated methodological triangulation’s ability to provide a comprehensive explanation of the research problem through various data types ([65]). Like bracketing ([26]), methodological triangulation helps reduce inherent researcher bias ([34]; [65]), increases evidence integrity ([42]; [57]), and leads to more credible conclusions ([34]; [65]) by enabling side-by-side or blended data analysis from more than one collection method ([34]; [42]; [57]; [65]).
3.2. Discussion of Population
The researcher defined the study’s main population to align the logic with the central problem and question, thereby facilitating adequate explanations and conclusions ([39]; [51]; [64]). The population was defined by various attributes, such as position, role, function, and geographic location ([1]). Therefore, in the context of this study, a holistic population was defined as a broad range of operative nonprofit organizations across the nation. In contrast, a nonprofit organization operating in southeastern Wisconsin provided a geographic context that enabled a more precise depiction of the targeted population for this study.
The researcher used a conceptual model to determine the attributes of this study’s population ([39]). Hence, the conceptual framework served as directive guidance for determining the population through the assigned actors, including the board, leaders, and managers ([39]; [49]). Eligible participants had to fall into one of these professional expertise categories, and the population was limited to individuals affiliated with this study’s case organization. Thus, rather than relying on specific demographic information, such as gender or age, this study focused on the participants’ professional positions and expertise ([53]). Further, the case organization needed to have an established board of directors and an adequate pool of leaders and managers.
Sampling. Population sampling, a researcher-directed recruitment activity, involved selecting a specific sample from the defined primary population ([53]). Moreover, an extensive primary population and constraints such as time, resources, and location enable the use of a sample group drawn from the main population ([1]; [53]). For instance, a sampling frame depicts a formatted list that approximates the population ([53]). Therefore, the researcher selected a sample of participants from the defined population. Sample size guidelines vary, but studies employing smaller participant groups achieved saturation ([8]; [53]). In contrast, varied, large sample sizes are more apt to reach saturation but also impose greater burdens on the researcher, participants, and the research ([53]).
Data Collection
The researcher established plans to ensure that the data collection process was efficient and effective for obtaining the necessary evidence for the study ([11]; [15]). For instance, by employing a qualitative method, a common and effective approach in exploratory case studies ([57]). A standard method in qualitative research, in-depth interviews are compelling in case study investigations due to their ability to provide singular stories with rich descriptions and multi-angled depth ([15]; [35]). Therefore, the researcher used this interview style to develop a more nuanced interpretation of the investigative issue, thereby addressing the central research question ([15]; [35]; [39]; [51]). This approach involved a live, conversational setting that enabled personal connections with study participants ([35]; [69]). Thus, these interview sessions explored the participants’ understanding to gather sufficient relevant data to address the research question.
As the primary data collection instrument, in-depth interviews facilitated a deep exploration of the problem ([39]). The interviews enabled an organic flow of information about the participants’ perceptions, while also allowing the researcher to probe further as needed through real-time follow-up interviews to learn more and clarify understanding ([15]; [39]).
Surveys are a structured inquiry method for collecting comparable data about participants’ understanding of a problem ([67]). Therefore, the researcher employed this quantitative technique as a secondary data collection method to support methodological triangulation, thereby increasing the validity of the conclusions ([11]). Hence, the comprehensive strategy for collecting evidence comprised in-depth interviews (a qualitative methodology) and surveys (a quantitative methodology) ([11]; [34]).
Instruments
Aligned with the in-depth interviews, the researcher used interview guides to provide structure to the logical flow of data collection, including logistical data, such as duration, audio recording, and transcription documentation protocols ([15]; [43]). Thus, the interview guide was an effective tool for organizing the questioning outline procedures of open-ended inquiries segmented into conceptual themes linked to the investigative framework that the researcher asked each participant, along with probes for immediate follow-up and clarification ([34]; [69]).
The interview questions were designed with clarity and precision to strengthen participants’ ability to understand and respond to them effectively ([15]). The questions were practical for qualitative case studies aimed at developing deeper insight into the investigative issue ([15]). Likewise, the questions were worded to encourage expansive responses ([35]).
A quantitative assessment was incorporated to complement the qualitative interview process, facilitating methodological triangulation by drawing on multiple data collection methods ([11]; [34]; [57]; [69]). Hence, a Likert survey was used ([19]). In contrast to the exploratory data from in-depth interviews, which used open-ended and probing follow-up questions, the quantitative survey employed closed-ended statements to gather measured evidence using structured questions and numerical data ([19]; [34]). These decisions enabled the study to generate reliable data while mitigating the qualitative research limitations of a one-source data collection process ([11]; [34]).
Data Organization
The researcher’s plan for organizing the collected evidence entailed a process for verification of the accuracy and completeness of the interview transcripts and survey responses, as well as dissecting the dimensions of the data to explore emerging themes with distinct patterns of conceptual meanings relevant to the research ([35]; [39]). The researcher considered this a reliable process for reviewing the data and deciphering words, phrases, and text segments to identify frequent recurrences or similarities across all the data, which aided in coding the information by distinct thematic categorical classifications ([2]; [39]; [45]). However, the coding process involved multiple stages of reduction to classify the emergent themes into similar groupings ([2]; [45]). Moreover, both digital and manual devices were used to document and store data related to the coding process and emergent themes, ensuring it could be easily accessed, tracked, and sorted during the analysis stage ([2]; [28]).
Requesting feedback from study participants enabled the researcher to confirm the authenticity of the meaningful contributions provided during the data collection ([37]). This was accomplished through member checking, a qualitative tool that validated participants’ perspectives by confirming the meanings as they ascribed ([37]). For instance, incorporating member checking verified and clarified the substance of interview responses, thereby confirming the accuracy of the explanations provided ([37]). Compared with formal follow-up interviews, member checking enabled the researcher to employ real-time paraphrasing and probing as follow-up techniques to confirm participants’ genuine truths during the interviews ([28]; [35]; [37]).
The follow-up interview served as another validation tool to confirm the authenticity of participants’ responses and ensure sufficient evidence collection ([35]). Although the traditional view of follow-up interviews describes subsequent conversations between the researcher and study participants, the researcher employed a combined approach supported by member checking and real-time follow-up to ensure a clear understanding of the initial contributions during the in-depth interviews ([35]). Likewise, this provided the researcher with an opportunity to re-examine the original information for clarity by paraphrasing participant perspectives ([28]).
Data Analysis
In broad terms, qualitative analysis employs an interpretive, fluid process to identify patterns, ideas, and meanings within the qualitative evidence ([35]). During data collection, various words and phrases related to the research question emerged ([40]). The researcher identified these emergent words, segments, and phrases and assigned codes based on similar characteristics ([28]; [40]; [45]). Once coded, the emergent themes were organized into broader topic classifications, which became a repetitive reduction process ([28]; [40]; [45]). At this point, the researcher was positioned for the interpretative phase, in which contextual insights were uncovered to provide a methodical understanding of the investigative issue and address the research question ([35]). Thus, the following passages offer further explanation of the researcher’s analysis.
Emergent themes were generated by participants’ recollection of encounters, perceptions, and viewpoints conveyed through in-depth interviews ([28]). This was an essential aspect of the methodical data discovery process, which enabled the natural flow of comprehensive information ([45]). Likewise, the emergence of themes provided a flexible framework for reflecting on the contextual meaning of word groupings and text segments that represented the ordinary occurrence of ideas, notions, and outlooks relevant to the investigation ([45]). Furthermore, to ensure that the emergent themes addressed the central research question, the researcher developed broader categories that grouped the themes into comparable classifications by category ([28]; [45]).
3.3. Reliability and Validity
The quality of research findings depends on the ability to achieve consistency throughout the data collection process to support replicability ([11]). Thus, the substance and quality of the research data, shaped by robust study protocols for data collection and analysis, determined the reliability of the researcher’s conclusions ([11]; [39]). For instance, the researcher’s decision to include two research methods not only supported methodological triangulation but also incorporated different, distinctive approaches to address the research question ([39]). Likewise, the researcher implemented protocols to maintain and safeguard raw data, field notes, reflexive bracketing, and digital transcription, thereby supporting the dependability of the research ([11]). Hence, these measures enhanced the reliability and trustworthiness of the study’s evidence, results, and conclusions, while also mitigating researcher bias ([39]).
3.4. Findings Overview
The researcher’s interpretations and findings from conducting a flexible, single-case study comprise themes generated from data collection and analysis of 13 participants representing the Board of Directors, leaders, and managers affiliated with a nonprofit organization in southeastern Wisconsin ([52]; [64]). Utilizing qualitative in-depth interviews, recorded and transcribed via videoconferencing software, and an online quantitative Likert survey enabled the use of multiple data-collection instruments and methods ([11]; [19]; [34]; [35]). Member-checking confirmed the accuracy of interview responses, and an online survey allowed each participant to anonymously rank statements about the organization’s internal controls ([37]; [39]). Direct quotations were integrated into the presentation of the findings; however, to ensure the privacy and anonymity of each participant, a coding process was used to assign a letter and number, for example, P1 for participant 1. Using the analyzed data sets from the quantitative and qualitative collection methods, the researcher’s findings comprise meaningful data, inferences, and scholarly support derived from a multi-layered data-coding-reduction approach, uncovering comprehensive themes that link the datasets through methodological triangulation ([2]; [11]; [34]; [45]; [57]). Hence, the following provides a thorough presentation of the collective conclusions from multiple perspectives derived from more than one collection method and supported by a visual representation of the data.
The quantitative survey and qualitative interview questions covered the following concepts: governance, accountability, and oversight; ethics and compliance; and evaluation, education, and training. Each concept corresponds to an associated construct, such as the control system, control structure, and control supervision. This methodological triangulation analysis yielded separate yet linked results that explain the frequent distinctions observed in the collected data ([34]). For instance, quantitative findings indicate strong agreement among participants. Highlighting the interconnected components of the conceptual framework that guided the investigation, ensuring alignment with the findings ([49]).
Using qualitative in-depth interviews and a quantitative Likert-scale survey, the researcher applied multi-layered coding and methodological triangulation to strengthen credibility and connect evidence across separate methods ([2]; [19]: p. 10; [34]; [45]; [51]; [57]). Participants consistently emphasized policies and standards, counterbalanced oversight, segregation of duties, authorization thresholds, and employee conduct expectations, with survey results indicating agreement that the organization promotes an ethical, compliant climate. Governance was depicted as a cross-level, cross-functional team founded on shared leadership principles that guide control activities and strategies to protect the organization. Organization-wide collaboration, open communication channels, and techniques such as recurring reviews, routine meetings, committee engagement, and third-party insights and expertise were identified as key defense mechanisms to mitigate vulnerabilities and weaknesses that create openings for threats, including fraud. Leaders and managers highlighted education embedded in training, internal risk assessments, and external audits as evaluation tools to supplement limited internal audit capacity. Thus, the overall conclusions from investigating potential internal control gaps that could increase vulnerabilities within a nonprofit organization led to the effective exploration and discovery of control strategies and practices and revealed practical insights from participant interviews and survey data.
3.5. Relationship of Findings to Research Question
The research findings yielded interpretations of authentic perspectives collected from participants and are consistent with the central research question and objective ([15]; [28]). For instance, the organization explained comprehensive strategies, “definitive, proactive, and back-end controls to mitigate any direct internal control issues” (P13). The research findings suggested that policies and procedures set expectations for the organization’s desired ethics and compliance ([7]). Another important finding concerned the organization’s governance, which must be immersed in the organizational oversight and accountability ([48]; [54]). Along the same lines, there must be ongoing transparency through collaboration and communication to ensure that the control strategies reach all levels and divisions of the organization ([29]). Participating in these collaborative communicative activities must also extend the organization’s boundaries to enlist the professional expertise of functions that might be lacking within the current structure, for example, IT and auditor support ([7]).
3.6. Application to Professional Practice
Potential implementation strategies, based on the themes identified by conducting the research, benefit leadership by providing effective solutions to support successful implementation and counter resistance to change ([3]). Although the researcher characterized the organization as a model for nonprofit internal controls based on the study results, the conclusions also identified specific areas that exemplify potential implementation strategies to enhance the existing control system. Comparing the findings with applicable strategies offers advice and practical solutions to improve organizational security and protection. Thus, the following uses the study’s results to provide the organization with enhanced guidance for control implementation strategies.
3.7. Recommendations for Further Study
The study revealed essential insights into nonprofit internal controls but also indicated an opportunity to extend the research in specific areas informed by the findings ([51]). For instance, despite multiple attempts, the researcher was unable to interview the organization’s board chair, an integral decision-maker who oversees board member communication and organizational strategy ([10]). In comparison, an underlying study theme on board composition and capacity, including specialized expertise, strategic vision, audit, risk management, and leader relations, was found to shape an organization’s internal control strategies ([3]). Moreover, the organization’s control effectiveness depends on board oversight of financial matters, ongoing training and education, and succession contingencies for key roles ([17]). Likewise, the study identified board expertise as a significant factor in the prevention and detection of threats and risks ([24]; [54]).
3.8. Summary and Study Conclusions
The significance of this study lies in its focus on addressing a critical problem that challenges many organizations in the nonprofit sector ([7]; [14]; [38]; [63]). The general problem highlighted the potential for a lack of internal control strategies, such as the absence or inadequacy of controls, to increase vulnerability to threats, such as fraud. Moreover, the specific problem was explored within a nonprofit organization operating in southeastern Wisconsin. Therefore, grounded by the conceptual framework, the investigation addressed the central research question. Furthermore, this effective planning and organization structured the study so that the outcomes aligned with the intended purpose.
The researcher’s conclusions confirmed the existence of the study problem through extensive contemporary research ([11]; [39]; [51]; [64]). To further investigate this problem, a nonprofit organization in southeastern Wisconsin was enlisted, and its board, leaders, and managers were recruited as volunteer participants. Through a series of in-depth, inquisitive interviews, a survey of statements, and extensive data reduction and analysis, this exploration evolved into developed themes and findings. Thus, it addresses the research question with clear resolutions. Therefore, this study provides credible, trustworthy, and practical tools and techniques to guide nonprofit leaders in better safeguarding the organization, its members, and stakeholders through adopting an effective control program built on strong internal control strategies.