I’d start with resources from the Nonprofit Risk Management Center and the AICPA, as both offer useful guidance around internal controls and risk management. You might also look at sample policies from established nonprofits and adapt them to your own operations. The key is keeping controls practical enough that staff will actually follow them.