WASHINGTON, DC.- The Detroit Riverfront Conservancy, a nonprofit intended to beautify the city’s once-industrial waterfront, had more than $100 million in assets, and tens of millions more flowing in annually from government and private donors.

One man had near total control of the group’s money, according to federal charging documents released Tuesday: its chief financial officer, William A. Smith.

Smith’s grip on the nonprofit’s finances was so tight that even the nonprofit’s accountant, charged with tracking spending, could not log into one of the group’s bank accounts. Only Smith had the password. He gave her the bank statements on paper and met her only four times a year, in the parking lot of a Honey Baked Ham store 40 miles from the office.

On Wednesday, federal prosecutors said Smith abused his power to pull off an astonishing fraud: He stole nearly $40 million between 2012 and this March, they said, equal to 39% of all the money that the group had reported spending in that time, burning through the group’s cash reserves.

Smith, 51, was charged with bank fraud and wire fraud, both felonies that can come with as much as 30 years of prison time.

The case highlights an enduring problem among nonprofits. A lax or informal approach to financial management can leave groups that handle millions of dollars in public and private funds vulnerable to waste, runaway costs or, in the worst cases, insider theft. When this happens, it’s often hard to catch. While the IRS has oversight over nonprofits, the average annual audit rate by the agency is less than 1%.

Brian Mittendorf, a professor who studies nonprofit accounting at Ohio State University, said that the conservancy’s official documents show that it took steps to safeguard its finances — including oversight from its board of directors and annual audits.

“All these things sound as if it’s an organization with a pretty robust review in place. On the other hand, only one person can access the money, and provides paper copies in a Honey Baked Ham parking lot?” Mittendorf said. “Those sound like the opposite of a robust governance mechanism.”

“It’s a story we’ve seen over and over again” in the nonprofit world, he said. “We don’t enter financial circumstances with enough skepticism.”

An attorney for Smith did not respond to a request for comment.

In a written statement, the Detroit Riverfront Conservancy commended prosecutors for investigating “a nefarious scheme to subvert layers of financial controls and embezzle resources from one of the greatest waterfront projects in the United States.”

The nonprofit’s outside auditing firm, which had conducted annual financial checkups, declined to comment.

The group has successfully redeveloped a long stretch of the city’s Detroit River waterfront and, until recently, had shown no public signs of distress. Local foundations contributed to it annually and it received grants from the Environmental Protection Agency, among others. In 2013, Smith was named a finalist for “CFO of the year” by a local business magazine.

But the nonprofit discovered problems with its finances this spring and invited Michigan State Police to investigate, according to reporting by The Detroit News. The police then handed the case to the FBI. In May, the group fired Smith.

Prosecutors say Smith used one of the nonprofit’s bank accounts — the one to which he held the password — to begin paying his own American Express bills in November 2012. Those bills included charges from airlines, Louis Vuitton, a diamond dealer and an interior design firm.

Over the next 12 years, prosecutors said, he used the nonprofit’s money to pay $14.9 million in American Express bills. They said Smith also simply transferred $24.4 million from the same account to a company he owned.

He covered it up by altering the paper bank statements, charging documents say.

When he gave the statements to the nonprofit’s accountant, Smith removed the payments to himself and replaced them with fake payments to other vendors, charging documents say.

Prosecutors said that by last year, Smith had a new problem: He had stolen so much money that the nonprofit was running out of cash. So he forged documents to take out a $5 million line of credit in the nonprofit’s name, then transferred that money into the account he was using to pay himself.

The leaders of the nonprofit, Smith’s supervisors, did not discover that line of credit until more than a year later.

This article originally appeared in The New York Times.