Charity Scandal: What To Do if Charity Assets Have Been Embezzled

In short: If charity assets have been embezzled, immediately secure all bank accounts, cards, and access credentials tied to the suspect. Preserve evidence, place the individual on leave pending investigation, and bring in a forensic accountant. Report the matter to police and your insurer, and consider whether the Canada Revenue Agency needs to be notified. Only make a public statement once the facts are confirmed.

A Charity embezzlement incident is emotionally devastating, erodes the public's trust, jeopardizes grants and funding contracts, scares off new donors, can attract scrutiny from regulators, and in the worst cases, can bring down a Charity.

The Canada Revenue Agency's Charities Directorate has signalled in its 2026 Quarterly Updates that it is watching internal controls more closely than ever, meaning how a charity responds to fraud can matter almost as much as the fraud itself.

Charity embezzlement can involve anyone: officers, directors, employees, volunteers, contractors, vendors, etc. In our experience, it is often someone that is trusted implicitly such that their reports are never questioned.

This guide is written for charity directors, board members, and executive directors who need a clear, actionable response plan the moment embezzlement is suspected or confirmed.

Below is a checklist which Charity directors can take to deal with the aftermath of an embezzlement incident.

Who Can Commit Charity Embezzlement

Charity embezzlement can involve anyone with access to funds or assets: officers, directors, employees, volunteers, contractors, or vendors. It is most often someone trusted implicitly — a long-serving bookkeeper, treasurer, or program manager whose reports are rarely questioned. That trust is exactly what makes the fraud possible, and exactly why segregation of duties matters regardless of how long someone has worked with the organization.

Step-by-Step Checklist: What to Do After a Charity Embezzlement

1. Secure the Charity's Assets

Upon learning of the embezzlement, the first step the Charity leadership must take is to secure the Charity's assets to prevent further losses. If the perpetrator was a signer on any bank accounts or had online access to accounts, revoke their access immediately. If they had company credit cards, cancel them. If the loss involved other types of assets, take whatever steps are necessary to secure them.

2. Preserve Evidence

Preserve evidence of the Charity embezzlement by revoking access to company accounts including company email, cloud-based software platforms, and corporate social media accounts.

3. Sideline the Suspect Pending an Investigation

If the Charity organization has either proof or strong suspicion of who the perpetrator was, the Charity will need to sideline the suspect while it conducts a thorough investigation. If the suspect is an employee, they can be placed on administrative leave. If they are a volunteer, suspend their clearance to serve as a volunteer.

4. Recover Keys and Access Credentials

Secure the suspect's keys and key cards if any. If there is a concern a copy was made or if the keys can't be recovered, re-key the locks and change access codes.

5. Conduct a Forensic Investigation

It may be necessary to bring in an outside investigator. Ideally, a forensic accountant will uncover exactly how much was taken and how it was taken.

6. File a Police Report

Ideally, the Charity organization should file a police report. The police report should strictly recite provable facts uncovered during the investigation. The Charity organization does not want to be sued for defamation.

7. Report the Loss to Your Insurer

An organization's general liability insurance may have coverage for theft. Those with employment practices coverage may have coverage for employee theft. However, to access it, the insurer typically requires a copy of the police report. Do not delay in reporting the event to the insurer, as a delay could jeopardize coverage.

8. Notify the Canada Revenue Agency

Charities have an ongoing obligation to maintain accurate books and records under the Income Tax Act. A significant embezzlement or fraud can affect the accuracy of a charity's financial reporting, so directors should turn their mind to whether the incident needs to be disclosed in the charity's next T3010 filing or flagged proactively to the CRA's Charities Directorate.

The CRA's 2026 Quarterly Updates have signalled a growing focus on internal controls and governance, not just intentional wrongdoing, when assessing "serious non-compliance". This means a poorly handled or undisclosed fraud incident can itself become a compliance issue, separate from the theft.

Donors, staff, or board members who suspect fraud can also report it anonymously through the CRA's Leads Program. Charities should not wait for a tip to come in through that channel — getting ahead of the issue with the CRA is almost always the better position.

9. Shore Up Policies and Procedures

When an embezzlement, theft, or fraud event has occurred, it is critical that the Charity be honest about what happened and have a good story to tell. A good story should focus on the good news: it was caught, appropriately reported to the police and the Canada Revenue Agency, steps were taken to recover funds (perhaps they were even recovered), and the organization's processes and procedures were overhauled to ensure it will never happen again. Depending on the severity of the event and the level of public interest, consider engaging a crisis communications expert.

10. Communicate Honestly with Stakeholders

If the Charity's leadership isn't honest and transparent with its stakeholders, they will sense something is off, and their assumptions will often be worse than the actual facts. Without naming names, the better approach is to be transparent about what happened and focus on the steps being taken to prevent it from happening again. In particular, reach out to major funders as soon as possible. Funders have seen it all before and know that these things happen even under the best of circumstances. An open line of communication will go far to shore up confidence.

Common Mistakes Charities Make After an Embezzlement

• Going public too early. Naming a suspect or making accusatory statements before an investigation concludes creates real defamation exposure.
• Delaying the insurance claim. Most policies require prompt notice, and a copy of the police report — waiting to "get the full picture" first can jeopardize coverage.
• Skipping the forensic accountant. Without a proper accounting, a charity may understate or overstate the loss, both of which create problems with police, insurers, and the CRA.
• Failing to document the internal investigation. A clear paper trail protects the charity if the matter is later challenged, litigated, or reviewed by the CRA. You can report suspected charity fraud or scams directly through the CRA's scam and fraud reporting page if you believe your charity's accounts have been compromised.

How to Prevent Future Embezzlement

• Segregate financial duties so no single person can both authorize and record a transaction.
• Require two signatories on bank accounts and any transaction above a set threshold.
• Schedule independent audits or financial reviews, not just internal reconciliations.
• Adopt a whistleblower policy and a strong conflict of interest policy, so staff and volunteers have a safe, clear way to report concerns.

For a deeper look at board-level obligations, see our guides on Charity Board of Directors: Legal Requirements and Best Practices in Canada and Charity Governance Best Practices for Canadian Nonprofits, or browse our full ONCA resource hub for governance requirements under Ontario law.

Frequently Asked Questions

What should a charity do first if embezzlement is suspected? 

Immediately secure bank accounts, cards, and any systems the suspect had access to, then preserve records before starting a formal investigation.

Does a charity have to report embezzlement to the CRA? 

There's no automatic requirement to report every incident, but significant fraud can affect the accuracy of a charity's books and records and may need to be addressed in the next T3010 filing or disclosed proactively to the Charities Directorate.

Can a charity lose its registered status because of an employee's fraud? 

It's uncommon for fraud alone to trigger revocation, but a poor response, weak internal controls, or a failure to address the issue afterward can raise compliance concerns with the CRA.

Should a charity call the police before or after an internal investigation? 

Securing assets and preserving evidence comes first. A police report is best filed once the facts are reasonably established, since it should recite only provable information.

Is a charity liable if a volunteer steals charity funds? 

A charity can face reputational and, in some cases, legal exposure depending on the oversight in place. Strong financial controls and clear volunteer policies reduce this risk significantly.

‍