How Nonprofit Growth Changes Compliance Risk

Welcome to the Nonprofit Compliance Brief, where we explain charitable solicitation and multistate fundraising requirements in clear, practical terms for nonprofit leaders and finance teams. This podcast is produced by Ironwood Registrations.

It's, uh, it's really great to be back here diving into this with you today.

Yeah, and today we're doing something a little bit different for this deep dive. Usually, you know, we're way down in the weeds, right?

The nitty-gritty of filing in Mississippi versus Massachusetts.

Exactly. But today I want to zoom out. I want to look at the entire life cycle of a nonprofit organization through a very specific lens. We're diving into a stack of research and case notes that tackle a problem most nonprofit leaders, they don't really realize they have until it's arguably too late.

It's the classic unknown unknown.

It really is. We are looking at the side effects of success because let's be honest, every leader I know is chasing growth.

Of course they are.

They want the budget to double. They want the donor list to triple. They want to change the world on a massive scale. But the core thesis from the materials we're analyzing today is that compliance isn't just some static box you check when you incorporate.

No, not at all.

The literature actually suggests that risk is biological. It evolves. It changes shape as your organization grows.

That is it. I mean, that is just the perfect way to frame it. I think the biggest misconception we see in the sector is this idea that compliance is just a— set it and forget it administrative task, right? You get your 501 determination letter from the IRS. You maybe register in your home state and you think, great, I'm legal, I'm done.

I have the paper now. Let me just get to work.

Exactly. But the data shows that what keeps you safe as a $50,000 startup is completely inadequate and potentially negligent for a $5 million regional player.

Wow.

And it is arguably dangerous for a national organization. The shield that protected you at stage 1 becomes a liability at stage 3.

So let's unpack this correlation a bit. The research highlights a concept called organizational activity as the main driver here, but I wanna play devil's advocate for a second.

Sure.

If you're a nonprofit leader and you're simply doing more of the good work, you know, raising more money to feed more people or save more puppies, why does that create risk? If you aren't scamming people, why does the risk profile change just because the bank account is bigger?

It really comes down to a concept called the regulatory surface area. Okay. Think of it this way. Compliance requirements are tethered to specific triggers. As you grow, 4 things usually happen regardless of what your mission is. First, your fundraising volume goes up.

Right.

Second, your geographic reach expands.

Yeah.

You're not just in one town anymore. Third, your financial reporting gets significantly more complex. And fourth, your public visibility skyrockets.

Okay, so a lot more moving parts.

Exactly. But here is the why. Regulators, mainly the state attorneys general, they aren't there to monitor your mission's effectiveness. They are there to protect the consumer.

Which is the donor.

Yes. In the eyes of the law, a donor is a consumer. When you're small, you are essentially a lemonade stand. If something goes wrong, the harm to the public is minimal. But when you become a multi-state organization, you are effectively a multinational corporation in terms of consumer reach.

That makes sense.

The state has a vested interest in ensuring that the massive amounts of money flowing through your organization are actually going where you say they are.

So growth doesn't create risk because we're doing something wrong, but because the oversight mechanism tightens to match the volume of public trust we're holding.

Precisely. Right. You are under a brighter light. The expectations for transparency and documentation scale up faster than most organizations scale their back office. And that lag between the growth of the fundraising and the growth of the back office, that is exactly where the risk lives.

Let's walk through this evolution. The research breaks this down into stages, which I found really helpful for visualizing where the danger zones are. Let's start with stage 1, the early stage organization. I'm picturing, you know, the passionate founder, maybe a working board operating out of a home office or a coworking space. Paint the scene for us regarding compliance here.

This is what the researchers call the contained phase. Typically, these organizations are operating locally. Their fundraising channels are high-touch but low-range.

Like local events.

Yeah, local events, passing the hat at a church, direct mail to friends and family. The systems are usually pretty informal. You've got receipts in a shoebox, maybe basic Excel sheet, or a volunteer treasurer coming in once a month.

It sounds romantic., you know, in a scrappy kind of way.

It is. And frankly, the compliance load is fairly light here. You have your corporation filings, your annual 990-N postcard to the IRS, which is really just verifying you still exist and make under $50,000, and your charitable solicitation registration in your home state.

Just the home state.

Usually. Yeah.

Yeah.

Unless you're situated right on a border, like in the tri-state area or Kansas City, you probably aren't actively soliciting outside your domicile. So the risk is contained. If you make a mistake here, it's usually easily fixable and the penalties are nominal. The regulators aren't hunting for you yet.

Okay. So that is the honeymoon phase. But then if things go well, and obviously we hope they do, we hit stage 2, the expansion. The materials call this the tipping point. What actually triggers this shift?

Well, it's rarely a single conscious decision where the board votes to expand. It's usually organic. You start reaching donors beyond your home state.

Right.

Maybe you launch a new website with a prominent Donate Now button. Maybe you strike up a partnership with a corporation that has offices in 3 other states. Or, and we see this a lot in the case notes, you get a piece of press like a viral tweet or a local news spot that brings in donors from California, Florida, and New York.

You mentioned vectors in the notes, expansion vectors.

Right. These are the channels through which you accidentally or intentionally cross state lines. And accidentally is the key word there, right?

This is where I think a lot of people listening get stuck. There is this persistent myth, and I hear it all the time, that says if I don't physically have an office in Florida, I don't have to register in Florida.

That is the most dangerous myth in the sector. It is dead wrong.

Wow.

The trigger for registration in most states is solicitation, not physical presence.

Yeah.

If you are asking residents of a state for money, whether via email, a targeted Facebook ad, or a letter, you are subject to their laws.

So suddenly you aren't just dealing with your home state's attorney general, you are potentially dealing with 41 different jurisdictions.

Correct. And this is where the complication really sets in. You might be perfectly compliant in Texas, but completely delinquent in Pennsylvania. The risk spikes because multiple regulatory systems apply simultaneously, and they definitely do not all agree on the rules.

Can you give us an example of that friction? Like how different can they be? Be?

Oh, they are wildly different. Take renewal dates, for example. In some states, your renewal is due on the anniversary of your registration. In others, it's due 4.5 months after your fiscal year ends.

That's a nightmare.

It is. In others, it's a fixed date like May 15th, regardless of your fiscal year. Or look at the signatures required. Some states require just the treasurer. Others require 2 officers. Some require wet signatures, actual ink on paper. While others are purely digital.

If you are still operating with that Stage 1 mindset, that shoebox mindset, you are going to get absolutely crushed by that complexity.

Absolutely. You will miss deadlines. And I imagine this catches people off guard. You celebrate a big influx of out-of-state donations, and then 2 months later you get a letter saying you're under investigation for unregistered solicitation.

And those letters aren't polite.

No, they're legal notices. They often come with fines or assurance of voluntary compliance agreements, which are legal bindings that stay with you. It takes the wind out of your sails very quickly.

Let's move to the next layer of complexity the research highlights: the financial shift. It seems like it's not just about where the money comes from, the geography, but how much money there is.

Yes. This is distinct from the geographic issue. Regulators want to ensure that as an entity handles more public money, there is third-party verification that the money is actually safe.

What are the thresholds here? When does a nonprofit stop being able to just file a self-prepared report?

It varies by state, which again is the headache, but a common threshold is around $500,000 to $1 million in gross revenue. Once you hit that, many states like California, New York, Illinois, they require you to submit audited financial statements prepared by an independent CPA.

Now, for those who haven't been through it, an audit is a completely different beast than just a, a basic bookkeeping review, right?

It is a massive lift. We're not talking about someone just checking your math. We're talking about a full examination of your internal controls, your restricted funds, your expense allocations. They will ask to see invoices from 18 months ago. Oh yeah. They will want to know why you categorized a specific lunch as program instead of admin.

And if you're used to a volunteer treasurer doing the books on QuickBooks on the weekends, an audit can be a shock to the system.

It can be totally paralyzing and it's expensive. An audit can cost $10,000, $15,000, $20,000 depending on complexity. Mm-hmm. But it's the cost of doing business at that level.

Mm-hmm.

This is where we see the shift from compliance being a background task to being a central strategic issue. You can't just whip up an audit in a week. It requires months of preparation.

This connects directly to the governance evolution mentioned in the outline. It seems like as the money grows, the way the ship is steered has to change too. The friends and family board doesn't cut it anymore.

That's a great analogy. When you're small, you can steer a speedboat with quick, informal decisions. Hey, can two of us sign this check? Works fine. Right.

When you become an ocean liner, you need protocols. As organizations mature, boards and stakeholders expect stronger governance processes.

So we're moving to formal policies. Conflict of interest policies, whistleblower policies, document retention.

Exactly. And this is a fascinating psychological shift for the leadership. Compliance stops being just administrative maintenance, like paying the electric bill, and becomes organizational risk management. You're actively putting systems in place to prevent fraud, mismanagement, or even the appearance of mismanagement.

That phrase risk management, it sounds so corporate, but for a nonprofit, isn't that actually about protecting the mission?

It is the only way to protect the mission long-term. If you lose your 501 status or your reputation because you lacked governance, The mission dies. You can't feed the hungry if your bank accounts are frozen by the Attorney General.

Speaking of reputation, I want to pivot to the fourth driver here. Visibility. The spotlight effect. We all want our cause to be famous. We want the viral video. We want the celebrity endorsement. But the research suggests there is a tax on that visibility. There really is. Larger nonprofits attract attention, and not just from donors who want to give. You have grantmakers, watchdog organizations, and journalists who who are actively reviewing your operations.

Who are we talking about here? Who is actually digging through the filings? Is it just the IRS?

It's almost never the IRS, actually. Huh. You have the formal watchdogs like Charity Navigator, Candid, which used to be GuideStar and CharityWatch. They scrape the data from your IRS Form 990. Then you have the informal watchdogs.

Like who?

Investigative journalists or even just people online who are skeptical of where donations are going.

And what are they looking for?

Inconsistencies. They're looking at your Form 990, which is a completely public document. Anyone can download it. Does the mission description on the tax form match what you're saying on Instagram? Are you reporting high fundraising expenses but claiming 100% of donations go to the field?

Oh, that's a big one.

Right. Are you paying your board members when you said you weren't?

And if they find a mismatch?

That is the risk of success. With increased visibility, a typo on a 990 for a million-dollar organization raises a lot more eyebrows than it does for a $10,000 organization. Unintentional errors can start to look like negligence or malfeasance if the spotlight is bright enough.

So at this stage, accuracy isn't just about avoiding a fine. It's about maintaining trust.

Trust is the currency of the nonprofit sector.

Yeah.

If you devalue it, you go bankrupt, regardless of how much cash is actually in the bank.

So we've mapped out this journey. We go from the garage to the national stage. But the transition is rarely smooth. The research talks about common growing pains— what usually breaks when a nonprofit grows faster than its back office.

The struggle is very real here. We see a few common symptoms of this growth-related compliance stress. The first is that deadlines start multiplying way faster than expected. As we discussed, you used to have one renewal date, now you have 40, and they're all completely different.

That sounds like a logistical nightmare if you aren't prepared.

It is. And that leads to the second pain point, which I see constantly: reliance on outdated tracking systems.

Let me guess, the spreadsheet of doom.

The spreadsheet of doom. Usually one massive color-coded Excel file that lives on one person's laptop. It works for 3 states. It maybe works for 10. It does not work for 41 states plus the IRS plus local jurisdictions.

I can picture it. Red means late. Yellow means pending, green means good, but then someone accidentally deletes a row or the person with the password goes on vacation.

Exactly. It's a fragile system. It is a recipe for missed deadlines and data entry errors. And then there's the human element. Who is actually supposed to be doing this?

That's the third point in the notes, unclear ownership. This is a classic Stage 2 problem. Does compliance sit with finance, development, legal?

You see it all the time. The development director says, I just raise the money. I don't file tax forms. The CFO says, I just track the spending. I don't know where the donors actually live. Legal might not even exist in-house, so it just falls into the void.

And the result is reactive responses to regulator inquiries. You're always on the back foot apologizing and paying late fees rather than looking ahead.

It's interesting how the sources frame these. They don't call them regulatory difficulties. They call them operational scaling issues.

Because that's what they are. The regulations didn't change to trick you. Your operation scaled and your systems just didn't scale with it.

Exactly.

So let's talk solutions. We have scared everyone sufficiently about the risks of growing. How do the successful organizations handle this? How do they double their revenue without drowning in paperwork?

There is a playbook for this. Mm-hmm. And it really comes down to being proactive rather than reactive. The first step is to centralize compliance tracking. You have to get it out of the individual inboxes and off the local hard drives. It needs to be a centralized function, ideally using software designed for this, not just a static spreadsheet.

A single source of truth? Right.

Second, you have to align compliance with financial planning and development. This is crucial. If development is planning a major fundraising push in Q4 targeting donors in New York and Florida, compliance needs to know about that in Q2.

So they can get the registrations in place before the ask is actually made.

Exactly. They can't be the last to know. Compliance should be in the room when the strategic plan is being built, not just when the mail is being opened.

And here's a theme I want to really emphasize because it appears again and again in the data. Compliance tends to expand alongside fundraising growth, and organizations that review requirements periodically avoid most problems.

Yes, that is the golden rule. This is the health check concept. Sitting down, maybe quarterly, maybe biannually, and asking the hard questions. Where are we fundraising now? Where do we plan to go? Are our registrations active? Has our revenue pushed us into an audit requirement in California?

It sounds simple, but that rhythm prevents the surprise letters from the Attorney General.

It does. And it forces that internal ownership we talked about. Someone has to own the answers to those questions. It doesn't matter if it's the CFO or the development director, but it has to be someone's specific job description.

Compliance systems have to evolve alongside the organizational structure. You wouldn't run a 50-person payroll with a notebook and a calculator. You shouldn't run national compliance that way either.

That is the perfect comparison.

I want to close this out by looking at the mindset again. We started by saying growth creates risk, but the expert notes offer a really nice reframing of this. They suggest viewing compliance as a growth indicator.

I love this perspective. It changes the energy around the work. Increasing compliance expectations are fundamentally a sign of success.

Oh, so—

Think about it. Why do you have to do an audit? Because you have substantial revenue. Why do you have to register in 20 states? Because you have expanded donor trust and a broader impact. These hurdles are evidence of your organizational maturity.

So instead of grumbling about the paperwork, we should see it as a badge of honor.

In a way, yes. It means you've made it. You are a significant entity. When approached proactively, compliance supports stability rather than limiting growth. It is the infrastructure that allows you to keep growing safely.

It really is about reframing the narrative. Compliance isn't the red tape holding you back. It's the safety harness that lets you climb higher.

That is beautifully put. If we connect this to the bigger picture, compliance risk changes not because nonprofits are doing something wrong, but because growth brings greater responsibility.

And visibility.

And visibility. Organizations that anticipate these transitions early often find that compliance becomes predictable. It becomes manageable. And that allows them to focus on what matters: the mission.

I think that is the perfect place to leave it. It's a journey from informal and local to structured and national. And if you respect the process, the process protects you.

Absolutely.

Here's a thought I want to leave you with, something to mull over. We talked a lot about how regulations react to your growth, but as the nonprofit sector becomes more digital and more global, we're seeing hints of a new era. Do you think we'll see a future where the regulations actually get ahead of the growth, where digital platforms and payment processors automatically enforce compliance before you can even send that first tweet or collect that first dollar? It's something to consider as you build your digital strategy. The machines might start checking your paperwork before the humans do.

That's a fascinating thought. You can find additional compliance guides and visual resources at ironwoodregistration.com. Thanks for listening.