Direct mail, an increasingly popular way for charities to raise money, is extremely difficult to regulate, and its integrity depends on charities' internal controls, according to state regulatory officials.

Thirty-eight states have enacted statutes governing how charities may operate and what they must report to government agencies, but only a handful have the resources and expertise to enforce those laws actively.

For most states, which attempt to keep tabs on thousands of charities with staffs numbering fewer than six, the task is overwhelming.

As a general matter, "direct mail is vulnerable to fraud and misrepresentation," said Ed Edgerton, president of the National Association of State Charity Officials and the chief charity regulator in North Carolina. "It's an impossibility" to keep track of all charity fund raising.

In Virginia, a staff of three, including one secretary, is assigned to monitor charities. "That's just not enough," said J. Michael Wright, coordinator of charitable solicitations in the state Office of Consumer Affairs.

Even in New York, which is widely regarded as having one of the largest and toughest offices of charity regulators in the country, officials in the Office of Charities Registration rely on spot checks to weed out abuse.

"We're the largest office in the country, and we're talking about a dozen souls from the director to the clerk," said a top New York regulator. "And we have 10,000 charities to keep track of."

Rather than extensive auditing and exhaustive reporting requirements, which officials say would create an unwieldy bureaucray, all but a few states rely on charities themselves to disclose their year-end financial reports and forms filed with the Internal Revenue Service. Regulators say that if charities' own internal controls are insufficient, there is little they can do to ensure that fund-raising drives are aboveboard.

In the case of the American Kidney Fund, state officials say, the organization's own board of trustees had not implemented adequate safeguards against abuse. The absence of those safeguards, state officials say, opened the way for the "secret" sweepstakes, bank accounts and other activities that Kay Hatch conducted in the name of the American Kidney Fund.

"I don't think anyone in an organization should have almost complete control over what goes on," said David E. Ormstedt, head of the public charities unit in the Connecticut attorney general's office. "And I think in this case Kay Hatch did."

Since Hatch's death, officials of the Kidney Fund, after reviewing "the adequacy of its internal financial controls," have implemented 15 new measures designed to prevent fraud, misappropriation and conflicts of interest. According to the fund officials, few of these policies were in place from 1974 to 1985 when Hatch ran the Kidney Fund.

Among the the new provisions is a conflict-of-interest policy that prohibits business dealings among Kidney Fund employes and their families or housemates. The fund's previous policy covered only conflicts involving trustees, but did not extend to staffers, an omission that acting director Wayne A. Gray called "an oversight."

Another new policy requires the Kidney Fund board to authorize in advance every fund-raising campaign the charity undertakes. That is a departure from past policy, under which Hatch was left to handle fund raising for the Kidney Fund with few restrictions from the board of trustees.

The trustees also have required that an in-house accountant be hired to review the fund's internal finances.