Board Members and Compliance: What They’re Actually Responsible For

Welcome to the Nonprofit Compliance Brief, where we explain charitable solicitation and multistate fundraising requirements in clear, practical terms for nonprofit leaders and finance teams. This podcast is produced by Ironwood Registrations.

It is, uh, really great to be here for this deep dive today.

Yeah, we're glad to have you. So I want you to picture this for a second. You are really passionate about a cause. Uh, maybe it's literacy, maybe it's saving the wetlands, whatever it is, right?

You're deeply invested.

Exactly. You've been volunteering. You've been volunteering, you've been donating a bit, and finally someone taps you on the shoulder and says, "Hey, we want you on the board." Oh, that's a moment of pride for a lot of people. You really feel like, "Wow, I'm gonna make a difference." Yeah, you say yes, you show up to that very first meeting. Yeah. And then the binder lands on the table.

The dreaded binder.

Or these days, the massive Dropbox link arrives, and suddenly it is not just about saving the wetlands anymore. It's about fiduciary duties, liability insurance, multi-state compliance. I mean, I've had friends tell me they actually wanted to quit after their first meeting. Yeah. Because they were just terrified.

Terrified they're gonna break a law they didn't even know existed. Yeah, exactly. Yeah. That's what I call the Sunday night panic. It is incredibly common because that shift from being a supporter to being a governor, it's a massive psychological leap. You go from basically cheering for the team to suddenly realizing you are technically responsible for the entire stadium.

And that is exactly the murky water I want to clear up for everyone in our deep dive today. Because there is just this massive gap between what people think a board member is responsible for, which is usually, you know, everything.

Right. Literally everything.

And what they are actually responsible for. So to set our roadmap today, we need to answer the central question. If I'm on a board, do I need to be the one filing the tax returns? Do I need to like memorize the charitable solicitation statutes of all 41 states?

The short answer is a very hard no. Okay. But the long answer is that you do need to know enough to know if those things are actually happening. We really need to separate oversight from operations today. I mean, if you are doing the actual filing, you aren't governing. You're just volunteering as unpaid staff.

Which happens a lot.

It does. But those are two very different lanes. Okay.

Let's establish those lanes right now because I think they get blurred constantly. Especially in smaller organizations where everyone is just pitching in. If the board's lane is oversight, what does that actually look like in practice? Because oversight is kind of just a vague corporate buzzword.

It is vague. Yeah. Until you break it down into the actual legal framework. In the nonprofit world, we generally talk about the three primary fiduciary duties. And honestly, if you take nothing else away from this discussion today, memorize these three: duty of care, duty of loyalty, and duty of obedience.

OK, those sound a little bit like wedding vows. To love, honor, and obey.

They kind of are.

Let's unpack them a bit. So duty of care. That sounds like I just need to be nice to people.

It sounds soft, sure, but it is actually about competence. Duty of care means you are simply paying attention. You are reading the board packet before the meeting. You're asking questions. Like, if the building is actively burning down, you aren't ignoring the smoke.

Right.

It essentially means acting with the level of care that a, quote, prudent person would use in a similar situation.

So if I skip, say, 5 meetings in a row and I don't bother to read the financial report that clearly says we're going bankrupt, I've breached the duty of care.

Precisely. You were completely asleep at the wheel. That's a breach. Got it.

Okay, number 2 was duty of loyalty.

Yeah, this one is about putting the organization's interests way above your own. This is basically where conflicts of interest live. So, Let's say you're on the board and your brother owns a printing company. Okay. The nonprofit needs some new brochures. If you push the organization to hire your brother without disclosing that relationship to anyone, or if the price is way higher than the standard market rate, that is a breach of the duty of loyalty. You are serving your brother, not the nonprofit.

That feels pretty straightforward though. I bet it gets really messy in like small towns where everyone knows everyone.

Oh, absolutely. It happens all the time.

What about the third one? Duty of obedience. That one sounds the most strict. Who exactly are we obeying? The board chair?

No, no. You are obeying the mission and the law. And this is really where compliance comes in. You have a strict duty to ensure the organization stays true to its tax-exempt purpose.

So no mission drift.

Exactly. If you're an animal shelter, you can't suddenly start using funds to, I don't know, fix potholes in the city streets. But you also have to obey external laws. That includes IRS filings, basic employment laws, and crucially for our listeners today, charitable solicitation registration.

Right. And this is exactly where the anxiety spikes for people.

Hmm.

Because obeying the law sounds very binary. You either did it or you didn't.

Right.

And if the organization missed a filing in, say, Mississippi, has the board breached its duty of obedience? Are they in trouble?

This is where the nuance really matters. The board is not expected to know the exact deadline for the Mississippi renewal form. They are expected to ensure a system exists that knows the deadline.

Ah, okay. A system.

Yes. If the board says, hey, we don't care about state laws, we're just going to fundraise illegally anyway, that is a massive breach. But if the board says, Executive Director, do we have a process for our state registrations? And the ED says yes. And then the ED just makes a clerical error and misses one.

That's not on the board.

Exactly. That is not a board failure. That's an operational error.

Wow. Okay. That is a, that's a huge distinction. So my job isn't to actually, you know, lick the stamp. My job is to ask, do we have a budget for stamps and is someone assigned to mail these letters?

Exactly. Yeah. But the key is you have to actually ask. You can't just assume it's happening. The whole day-to-day misconception is that the board needs to micromanage those filings. They really don't. In fact, if a board member is like rewriting the grant application or double-checking the math on the state registration forms, they are probably getting in the way.

There's that old phrase, right? Nose in, fingers out.

That is the classic mantra. Stick your nose in to smell if anything is burning, but keep your fingers completely out of the pie.

I love that. Let's talk about the money, though, because duty of care implies I really need to understand the financials. And frankly, a lot of board members are not accountants. They see a massive spreadsheet, their eyes totally glaze over, and they just vote yes to approve the budget because they don't want to look stupid in front of everyone else.

And that is an incredibly dangerous dynamic. Look, you do not need to be a CPA, but you absolutely need to understand the narrative of the numbers.

Financial oversight is the bedrock of compliance because it all comes back to the money.

Always. Almost every single compliance failure eventually shows up somewhere in the bank account.

So give us the cheat sheet then. If I'm a non-financial person looking at a big balance sheet, what are the red flags I should be hunting for?

I always tell people to look for 3 specific things. First, solvency. Do we actually have enough cash to pay the bills for the next 3 months? If the cash flow is razor thin, you need to be asking really hard questions about sustainability right then and there.

Makes sense.

Second, look at restricted funds. This is a huge trap for nonprofits.

Explain that one a bit more. The difference between restricted and unrestricted.

Sure. Let's say you got a $50,000 grant specifically to build a new playground. But payroll is coming up on Friday, and the general checking account is totally empty. So the executive director decides to just borrow from the playground money to pay the staff, fully intending to put it back later when donations come in.

I mean, that sounds logical, but I'm guessing it's highly illegal.

It is a massive compliance violation. That is restricted money, period. If a board member sees that the quote unquote playground fund is empty, but they look outside and no playground has been built, they need to stop the meeting immediately. That is a duty of obedience issue. You cannot use restricted funds for basic operating expenses.

That is a really great specific example. What's the third thing on your cheat sheet?

The connection to the audit. If you are a big enough organization to actually have an independent audit, the auditor will give you something called a management letter. It's usually separate from all the big number crunching. It lists your internal control deficiencies.

That sounds incredibly boring, but I'm guessing it's where all the skeletons are buried.

It is arguably the most important document the board will ever see. It tells you if, for example, the exact same person writing the checks is also the person balancing the checkbook.

Oh, wow.

Yeah. If an auditor says, hey, you have a major lack of segregation of duties here, and the board just ignores it for 3 years, and then someone eventually embezzles $100 grand, now the board is absolutely on the hook because they were officially warned and they did nothing about it.

Okay. You just said the scary phrase. On the hook. Let's pivot to personal liability.

Mm.

Because this is the nightmare scenario for everyone, right? I'm volunteering my free time, I'm trying to help my community, and suddenly I'm being personally sued or fined because the nonprofit messed up. How real is that fear, really?

The fear is often much, much larger than the reality, but I have to be honest, it's not zero. The legal standard for personal liability usually involves gross negligence or willful misconduct.

Define gross negligence for us. Is that just making a really, really big mistake?

No, no. Making a normal mistake is just negligence. Gross negligence is a reckless disregard for the truth. It's basically seeing the cliff approaching and hitting the gas pedal anyway. Okay. So if a board member actually steals money, liability. If the board knows the organization is actively running a fraudulent fundraising scheme and just sits back and does nothing, liability. But if the organization simply forgets to file a 990 extension and gets hit with a penalty fee, That just comes out of the organization's budget. It does not come out of the board members' personal pockets.

So regulators aren't like hunting for board members' houses because of a typo on the state form.

Exactly. Regulators just want compliance. They don't want your house. They want to see what we call active governance.

What does active governance actually look like to an outsider? If an attorney general from, say, California or New York looks at a charity, how do they know if the board is doing its job?

They look at the minutes.

Minutes. The boring notes that literally nobody wants to take.

I know, but if it isn't written down, legally it didn't happen. If the board made a major decision like entering a contract with that brothers printing company we talked about earlier, and the minutes don't show a discussion, a formal vote, and a recusal by the brother, then it looks like corruption to an investigator. Wow. But if the minutes show a robust debate, a review of 3 competitive bids, and note that the conflicted member physically stepped out of the room It looks like perfect governance. Documentation is your shield.

That is so important. So we've covered the duties, we've covered the liability. Yeah. But organizations change over time. A startup board is going to act very differently from the board of a $20 million organization. As the nonprofit grows, the compliance footprint gets way bigger, doesn't it?

It does. And this brings us to a really critical realization, which is that compliance tends to expand alongside fundraising growth. And organizations that review requirements periodically avoid most problems.

It almost sounds like a law of physics. Yeah. As the money grows, the paperwork grows.

Mm-hmm. It's undeniable. Think about it. When you start out, you're usually just asking friends and family for money. You're likely only registered in your home state, but then you add a Donate Now button to your website.

And suddenly anyone can give.

Exactly. Suddenly you might be soliciting in all 50 states. Then you start mass email campaigns. Then you hire a professional fundraiser. Every step adds a new layer of rules.

And I assume the states don't all use the exact same form, right? That would be too easy.

I wish they did. There is something called the Unified Registration Statement, or URS, which was a noble attempt to standardize things years ago. But honestly, many states have moved away from it entirely to their own custom online portals. So now you have different deadlines, different fee structures, entirely different audit thresholds for every state.

So So a board member of a rapidly growing organization just needs to pause and ask, hey, we just launched a national campaign. Did we actually update our state registrations?

Exactly. The board does not go fill out those state forms, but they must ensure the annual budget includes the filing fees and the staff or external partners to manage that sheer volume of work. You cannot run a national fundraising program on a local compliance budget.

That makes perfect sense. And this brings us right to policies. Earlier, we talked about duty of loyalty and you mentioned conflicts of interest. Is that usually just a handshake agreement among friends?

No, it needs to be a written policy formally signed annually by every member. This is really where the board protects itself. A conflict of interest policy is your first line of defense, but there are a few others you absolutely need.

Which ones are completely non-negotiable?

A whistleblower policy is essential.

See, that always sounds so dramatic to me, like we're expecting a corporate spy in the ranks. Why does a tiny literacy nonprofit need a full whistleblower policy?

Because intimidation happens everywhere, regardless of size. If a junior accountant notices the executive director is using the company credit card for personal vacations, they need a legally safe way to report that directly to the board without getting fired by that same ED.

Ah.

If that policy doesn't exist, the fraud just continues until the money is completely gone. The policy creates a safe pathway for the truth to reach the board.

That totally makes sense. It's a safety valve. What about document retention?

That's the third big one. Document retention and destruction policy. It sounds incredibly dry, but you need to know exactly how long to keep donor records, employment records, and board minutes. And equally important, when to actually destroy them so you aren't paying ridiculous storage fees for paper from 1990 that you have zero legal requirement to keep.

It's so true. All right, so we have the 3 duties, the growth curve, the policies, but let's get real for a second. Most board members are busy professionals. They have full-time day jobs. They're quickly reading the board packet on the train on the way to the meeting. How do they actually do all of this oversight without it becoming a second full-time job? We need some practical habits here.

It really comes down to the dashboard concept. You do not need to read every single email the staff writes. You just need a simple 1-page dashboard presented at every meeting.

What's on a dashboard?

Compliance status, green, yellow, red. Are our state filings up to date? Yes or no? Are our 990 and our audit on schedule? Yes or no?

So I don't need to see the actual receipt for the filing fee. I just need to see the green light.

Correct. And then you need a section for risk. What is keeping the executive director up at night right now? Is it a cash flow issue? Is it a potential lawsuit? A new state regulation? The board meeting should focus on the future and the big risks. Not just reviewing what happened 3 months ago.

That is a great pivot for a board to make. Move from history class to a strategy session.

And part of that is asking the right questions. Instead of asking, hey, why did we spend $50 on coffee for the office? Ask, do we have sufficient reserves to cover next month's payroll if this big grant is delayed? That is a governance question. The coffee is a management question.

That distinction right there, governance versus management, that seems to be the hardest thing for people to learn, especially if the board member used to be a hands-on volunteer who literally was the one making the coffee.

Oh, it is the hardest transition by far. We often call it founder syndrome when the original board just can't let go of the daily tasks. But for an organization to scale, the board has to mentally move up to the balcony. You simply can't see the whole dance floor if you're down there in the mosh pit.

Mm, I love the idea of the balcony. But sometimes, you know, the view from the balcony is a bit foggy. What if the staff just isn't being transparent? What if the dashboard is showing all green lights but the reality on the ground is red?

That is exactly where the relationship comes in. Ronald Reagan used to say, "Trust, but verify." This is why you have an external audit. This is why you occasionally hold executive sessions where the board meets without any staff present just to check in honestly with each other. And honestly, it's why you have to cultivate a culture where bringing bad news is okay.

Say more about that culture piece.

Well, if a board screams and points fingers every time there is a tiny mistake, the staff will naturally start hiding their mistakes. But if the board says, thank you so much for bringing this compliance gap to our attention, let's figure out how to fix it, then you get real transparency. You want a culture where the executive director feels completely safe saying, hey, We messed up and missed a deadline in Florida.

Because if they are too scared to tell you about Florida, they definitely won't tell you about a massive financial crisis.

Exactly. Fear always drives compliance underground. Support and resources bring it into the light.

We've covered a ton of ground here today. We've gone from the big three—duties, care, loyalty, obedience—all the way to the specifics of financial red flags and the absolute necessity of good policies. If we had to boil this down for the listener who is, let's say, walking into a board meeting tonight. Yeah. What is the one single thing they should change about their approach?

Stop trying to do the work yourself and start ensuring the work can actually be done by the organization.

Ensure the work can be done, meaning giving them resources.

Yes. A board absolutely cannot demand gold standard compliance and then turn around and refuse to approve the budget for a compliance officer or an external firm or good software. You can't ask for a mansion on a tent budget. The most compliant thing a board can ever do is ensure the staff has the time, the money, and the expertise to handle the regulations.

It's basically putting your money where your mission is. It is.

And it's realizing that your true value as a board member is your judgment. You are there to ask, does this make sense? Is this legal? Is this ethical? You are the conscience of the organization, not the administrative assistant.

I think that's gonna be a huge relief for a lot of people listening. You don't have to be the expert in every single thing. You just have to be the expert in asking why and how.

And who, who is actually responsible for this task? If you know who is responsible and they have the resources, you're halfway there.

I wanna leave our listeners with a bit of a provocative challenge today to think about on their own. We talked earlier about nose in, fingers out, but I want you to think about your specific organization. Right now. If the entire board disappeared tomorrow, just completely vanished, would the organization's compliance system keep running smoothly, or would it completely collapse because you are the one holding it together with cape and string?

Man, that is the ultimate test right there. It really is.

Because if the answer is it would collapse, then you haven't actually built a system. You've just built a dependency. And true governance is about building something that lasts way longer than your personal term limit.

That is the very definition of stewardship. Helping versus hovering.

Building versus patching. That has to be the goal.

Absolutely.

Couldn't agree more. If you found this discussion helpful, you can find additional compliance guides and visual resources at ironwoodregistrations.com. Thanks for listening.