The community’s stunned reaction is typical, say experts, but theft at the parish and diocesan level is hardly surprising. In fact, it’s the norm.

A whopping 85 percent of U.S. dioceses have detected embezzlement over the past five years, according to Villanova University researchers. “No question about it, it’s a large number,” said Charles Zech, director of the school’s Center for the Study of Church Management and coauthor of the 15-page paper, “Internal Financial Controls in the U.S. Catholic Church,” that details the findings. Supported by a grant from the Louisville Institute, Zech and Villanova accounting professor Robert West surveyed 174 diocesan chief financial officers. Seventy-eight responded.

The researchers don’t put a precise dollar figure on how much was embezzled, but the range indicates it’s significant. In 11 percent of the dioceses at least $500,000 was stolen over the last five years (meaning that a minimum of $4.3 million went missing) while one-third of the dioceses reported thefts of under $50,000. “You can only wonder about those [96] dioceses that didn’t respond to our survey,” said Zech.

Dishonest church employees and volunteers are the immediate cause, but the heart of the problem lies elsewhere, say the researchers.

“Unlike corporations which provide quarterly financial statements to the SEC and hold quarterly conference calls with outside analysts, the church is subject to almost no recurring outside financial scrutiny,” according to the report. Further, while “many dioceses provide parishioners with an annual financial and administrative newsletter, which provides a highly summarized view of the cash flows for the year and the results of social and spiritual programs offered by the diocese – many other dioceses do neither.”

While external oversight of diocesan and parish finances is virtually nonexistent, internal checks are hardly any better. “Only 3 percent of the dioceses conducted an annual internal audit of their parishes,” while “21 percent of the dioceses indicated that they seldom or never audit their parishes.” When such reviews do occur, the researchers say, it’s frequently because a pastor or bookkeeper has ceased working in the parish.

Meanwhile, in more than 10 percent of the dioceses, the chief financial officer is responsible for hiring the external auditor, whose job it is to review the work of – the chief financial officer. The bishop or the diocesan finance council should hire the external auditor, say the researchers. “It’s one of those controls that is so obvious that you wonder why it isn’t being done,” said Zech.

At the national level, theft and other irregularities are an issue for the U.S. Conference of Catholic Bishops’ Committee on Budget and Finance. That committee’s document on internal financial controls lists seven specific types of fraud to which parishes and dioceses are susceptible. Among them: lapping (where an employee defers the recording of cash receipts from one source and covers the shortage with receipts from another source); accounts payable fraud (where an employee falsifies payments to real vendors or creates phony vendor addresses to which checks are sent); kickbacks and outright theft.

The bishops’ committee described a typical case of embezzlement related to the Sunday collection.

“In this scenario, one person is responsible for counting the Sunday collection, making out the deposit ticket, taking the deposit to the bank, and recording amounts to parishioner records. This case is easy to detect and can be prevented by requiring a number of safeguards, including involvement of more than one individual in handling collections, dual counts and signatures evidencing concurrence of counts, segregation of the count procedures from deposit preparation, and recording of cash receipts.”

Bishops’ conference guidelines on financial issues provide a good basis for establishing internal controls, but they lack any enforcement mechanism. “The USCCB guidelines are just that – guidelines,” said Zech and West. “Individual bishops can abide by them in whole or part, or reject them entirely.”

Corruption is a big issue, but so is competence, according to the diocesan financial officers surveyed. “Lack of expertise at the parish level” and “parish finances and controls” were cited as the two greatest risk factors by the diocesan financial officers. Such basic procedures as withholding payroll taxes from parish-employee paychecks frequently go undone according to diocesan financial officers, said Zech.

Zach and West offer nine specific recommendations to improve church internal financial controls. They include implementation of the bishops’ conference guidelines in every diocese, establishment of fraud policies in every diocese, annual internal parish audits supplemented by triannual external audits, quarterly meetings of diocesan financial councils, annual or more frequent submission of financial data by all parishes and high schools, and selection of the diocesan auditor “by someone other than the diocesan chief financial officer.”

Still, it seems unlikely that the recommendations will be universally accepted anytime soon. The report notes that “since churches rely on sacred belief systems, internal controls might be viewed as a secular concern and either inherently evil or at a minimum unnecessary in churches. In fact, it might be considered insulting to church workers and volunteers to even imply that internal financial controls are important.”

Said Zech, “Part of the problem in faith-based organizations is that we assume people are honest, so we don’t put in the controls that a business would put in. They just want to believe that [theft] won’t happen and they’re always stunned when it does happen.”

- - -

Joe Feuerherd is National Catholic Reporter Washington correspondent.