For about six years, the High Museum's chief operating officer altered invoices and used his own sign-off to make personal purchases with museum money. The approval power he held is not atypical of organizations we work with. The question to ask, if you sit on a board, is who monitors the spending of the top executives. In my experience, the answer is either nobody, or someone who reports to them.
Brady Lum was the chief operating officer of the High Museum of Art in Atlanta. For about six years he used his own sign-off to buy himself guitars, music lessons, and woodworking tools with museum money. On November 2, 2026, a federal judge sentenced him to a year in federal prison.
What intrigues me most about it is that it happened in plain sight and still flew beneath the radar for six years. The approval power granted him is not atypical of any organization I've worked with. The question to ask if you're a board member is who monitors the spending of the top executives? In my experience, the answer is either nobody, or someone who reports to them.
What happened
Lum started as COO on January 2, 2019. By that September, less than nine months in, he had started taking money. It went on until the museum found it in November 2025, shortly after which he resigned.
According to the DOJ's description of the crime, his methods were very simple. He changed invoices so personal purchases looked like museum purchases. He approved expenses himself. He made accounting adjustments that spread the charges across different cost centers, so no single budget felt a shock. And he used two billing channels: supplier invoices, and reimbursements through the museum's corporate card.
In total he took $607,688.18. According to the U.S. Attorney's Office, he received more than 700 reimbursements over the course of the scheme, most of them for less than $1,000. A charge that size made by a top executive may fall beneath the threshold of scrutiny, and I suspect that's a big part of why it lasted.
He pleaded guilty to one felony theft charge. Before sentencing he paid it all back, plus around $500,000 to cover the museum's investigation and legal costs. Prosecutors asked for an 18-month sentence. The judge gave him 12 months, followed by a year of supervised release. Lum's lawyer compared the purchasing to an "addictive obsession," closer to gambling than greed, and said the items purchased sat unused. However, the judge could not justify no jail time, given years of repeated choices.
Where the board gets its picture of the finances
In small to mid-sized nonprofits, I often see controls built from the bottom up. A program assistant needs a manager's signoff to buy supplies. The manager needs the director's approval for anything over $1,000. However, that chain of authority stops at the top of the org chart with the executive director or COO.
That's where the board's problem starts. Almost everything a board knows about the finances, from the monthly budget-to-actual report to the reason that travel ran over, comes from a chief executive or from someone who reports to them. So the people the board would most need to check are also the ones explaining the numbers.
A volunteer board relying on the executives it oversees for its information is a blind spot built into the structure. Treasurers usually have full-time jobs of their own, and a line-by-line review of executive spending asks more of a volunteer than is reasonable. In a small organization it can also feel like an accusation, and that has a real cost of its own.
One simple fix is to put someone in the reporting and analysis role who is accountable to the board. That person should sit either at the bottom of the approval chain or outside it entirely, as an independent third party. Their job is to prepare the numbers the board sees and to notice patterns, like a new vendor, charges drifting from one cost center to another, or journal entries that move expenses after the fact. That last one is exactly what Lum did. They won't catch everything, since a well-altered invoice can fool anyone who only reads the books, but patterns are harder to hide from someone whose job is to look for them.
The first option comes with a catch. A staff accountant at the bottom of the chain still reports to the ED or COO, who decides whether they keep their job, so speaking up about something odd can cost them a lot. The role only works if they have a real line to the board, such as a standing meeting with the treasurer or finance committee without the executive in the room, and a clear promise that raising a concern won't be held against them.
The second option is what firms like mine do, so take this with that in mind. I still think it's the cleaner fix for many small organizations, with one condition. The board should be the one that engages the outside firm, or at least the firm should answer to the board, because a reviewer hired and paid by management has the same problem as the staff accountant.
The reason to do any of this before something goes wrong is that finding it afterward is expensive, and executive fraud tends to be the costliest kind. The Association of Certified Fraud Examiners' 2024 study put the median loss from fraud by owners and executives at $500,000, compared with $60,000 for regular employees. The High spent about $500,000 on lawyers and investigators alone, roughly 82 cents for every dollar Lum took. He paid that back. Not every case ends that way.
Standard controls to review once a year
The questions below cover standard internal controls, the checks and balances every organization should have written down and approved by its board. Nonprofit guidance covers the basics. The Minnesota Council of Nonprofits' Principles and Practices, for example, calls for board-adopted internal controls, separated financial duties, and a whistleblower policy. I'd add one habit: the treasurer walks through these once a year, the same way the board reviews the budget. Clear controls protect the executives as much as they protect the organization. If one of them doesn't have a clear answer, start there.
Who approves the executive director's expenses and card charges? The answer should be a person's name, and that person shouldn't report to the ED. I recommend the board chair or the treasurer. Even a quick review likely helps. In its 2024 study, the Association of Certified Fraud Examiners found that organizations with controls built to actively look for fraud, like surprise audits, lost half as much to fraud, or less, and caught it twice as fast or faster. It also credits visible oversight with building a "perception of detection."
Who can spend the organization's money, and how much? Ask to see the written policies behind it. The main one often goes by a name like delegation of authority policy. It spells out who gets spending authority and what the limits are per day, week, or month. A corporate credit card policy covers who gets a card. A check signing policy covers banking and payroll, including who the signers are on the checking account and when two signatures are needed. Then look at the actual names. If the same one or two names show up as the people who spend, approve, and sign, it's worth talking about adding someone else to the chain.
Who can make accounting adjustments or change transaction details after they're approved? Lum used accounting adjustments to move charges around. Ask who has permission to make those changes and whether anyone reviews them afterward.
Can I see the executive team's card statements? Not the summary. Once a quarter, the treasurer or someone on the finance committee should skim them and leave the deeper review to the reporting person. A quick look is enough to catch things that don't fit, like a music store on a museum's card, or the same vendor every month with no program it clearly belongs to. Sometimes a charge that looks suspicious is just human error, like a personal purchase made on the wrong card, and the spender can easily pay it back.
Does our auditor look at executive expenses on purpose? You can ask them to. You may be able to request a review of officer expenses, or a short set of agreed-upon procedures, for an added fee.
Where does someone report a concern, and who hears it? A whistleblower policy only works if the person receiving the report isn't the person being reported on, so make sure the route leads to the board. Form 990 asks whether you have a written whistleblower policy (Part VI, line 13), which makes this a good one to check anyway.
Where I'd go from here
If you're a treasurer, pick two of the questions above and bring them to your next finance committee meeting. If you're an executive director, you could bring them yourself. And if you'd like a second set of eyes on how approvals are set up at your organization, that's the kind of work we do at Lyra Works, and I'm always glad to talk it through.
Sources
U.S. Attorney's Office, Northern District of Georgia: sentencing press release, November 2, 2026
U.S. Attorney's Office, Northern District of Georgia: guilty plea press release, July 13, 2026
Atlanta Journal-Constitution: sentencing report, November 2, 2026
Association of Certified Fraud Examiners: Occupational Fraud 2024, A Report to the Nations
Minnesota Council of Nonprofits: Principles and Practices, Financial Management
IRS: Form 990, Part VI, Section B, line 13 (written whistleblower policy)