The Real Cost of Managing Compliance Internally
In this Ironwood Registrations podcast episode, hosts A and B dissect the hidden and often overlooked costs of handling charitable solicitation and multistate fundraising compliance within a nonprofit’s own staff. They begin by debunking the illusion that a zero line‑item for compliance means no expense, explaining that the “patchwork” approach—where finance, development, executive leadership, and office staff each touch a single compliance task—creates friction, miscommunication, and legal risk. The conversation distinguishes direct costs (fees, postage) from hidden costs, coining the “context‑switching tax” (the mental and time cost of staff shifting from fundraising to bureaucratic troubleshooting) and quantifying opportunity cost (e.g., a development director losing $2,000 in potential donations by spending four hours on paperwork). They illustrate how compliance complexity grows exponentially as nonprofits expand across states, citing differing requirements in Florida, New York, and California, and the need to track varied renewal dates and portal specifications. The hosts warn of the “bus factor” risk, where a single person (the fictional “Sarah”) holds critical knowledge, making the organization vulnerable to turnover. After outlining the dangers, they outline three conditions under which internal compliance can succeed: limited scope (small revenue, few states), clear responsibility assignments, and documented procedures. They provide a practical self‑audit for leaders—three questions about staff time spent coordinating, predictability of deadlines, and whether compliance interrupts fundraising. Finally, they reframe compliance from a chore to essential infrastructure, likening it to IT support, and argue that the true cost of compliance is a tax on mission execution time. Listeners are urged to evaluate their own processes and consider professional compliance support when the hidden costs outweigh the apparent savings.
Chapters
Welcome to the Nonprofit Compliance Brief, where we explain charitable solicitation and multistate fundraising requirements in clear, practical terms for nonprofit leaders and finance teams. This podcast is produced by Ironwood Registrations.
Glad to be here for this one.
Yeah, today we are going to perform a bit of an exorcism, I think.
An exorcism. I like that.
Yeah, well, we need to cast out a very specific demon that haunts, I mean, almost every nonprofit boardroom I've ever stepped foot in.
Oh, I know exactly which one you mean.
Right. It's the demon of, we can just handle it in-house.
Yep.
So for today's deep dive, we are looking at the real, actual, messy costs of managing compliance internally. And I want to start by just being the skeptic here.
Please do.
Because if I'm a CFO, or maybe an executive director, and I'm looking at my budget for the year, And I see a line item for outsourcing compliance versus a line item of literally zero because I just asked my development coordinator to do it.
Right.
That zero looks pretty good to me. I mean, why shouldn't I just keep that money for the mission?
Well, that is the million-dollar question, sometimes literally. The problem with that zero on the spreadsheet is that it's a lie.
A lie.
It's a comforting fiction. When organizations look at their compliance costs, They have this really bad habit of only counting the checks they write to the state agencies.
Oh, I see. Like the actual filing fee.
Exactly. They say, oh, it's $50 for this state, maybe $25 for that one. But the checks are the easy part.
Right.
The checks are just the admission ticket. The actual cost is the friction. It's the distraction and the lost revenue that happens while your team is, you know, just trying to figure out where to actually send that check.
The friction. I like that word. It implies heat, like things are grinding gears.
Very much so.
But let's get specific. Let's get specific here because I want to make sure we don't just talk in broad strokes today.
Sure.
When we say internal compliance, what does that actually look like in the wild? Because in my experience, it's rarely a neat, tidy little department.
Oh, it's almost never a department. In the industry, we actually call it the patchwork approach.
Patchwork?
Yeah. And honestly, patchwork makes it sound way cozier than it actually is. It's usually more of a frantic game of hot potato.
How so?
Well, you have these compliance obligations trickling in. Maybe you started fundraising in just a couple neighboring states. So it didn't feel big enough to justify hiring a dedicated compliance officer.
Makes sense.
So you just split the work up.
Right. So you give the financial piece to the finance director, obviously.
Sure. Finance cuts the checks. They provide the 990. But then who handles the governance documents?
Ah.
That usually goes to the executive director or maybe the board secretary.
OK.
And who is actually triggering the requirement by soliciting the donors in the first place?
That'd be the development team.
Exactly. And then who is opening the mail when the state sends a rejection letter because the font size on the form was wrong?
Let me guess, the office manager.
Bingo. That's the office manager.
Okay, so you've got, what, 4 different departments touching one single compliance action?
Yep.
That sounds like a total recipe for a communication breakdown.
It absolutely is. It's a decentralized mess. And here is why it's so dangerous. It works fine when you are small.
Right.
If you are a local animal shelter and you're only soliciting in your home county, that all-hands-on-deck method is great. It's agile.
Sure, you can just yell across the hall to each other.
Exactly. But as soon as you cross state lines, that informality becomes a massive liability. It turns into a game of telephone.
Oh, I can see that.
The finance director thinks development renewed the license. Development thinks the office manager mailed the form. The office manager thinks the board secretary has the password.
And nobody actually did it.
Right. And suddenly you're operating illegally in 3 states.
And nobody knows until the nasty letter shows up in the mail.
Exactly.
But I want to push back on the cost aspect for a second. Because even if it's messy, isn't it still technically cheaper than paying an outside firm? I mean, we're talking about staff salaries here.
Right.
Those people are on the payroll anyway. The money is already spent.
Are they, though? I mean, yes, they are getting a paycheck, but let's look at what you are actually paying for. We have to distinguish between direct costs and hidden costs.
Okay, break that down for me.
Direct costs are the easy ones. Postage, filing fees, notary fees. Everyone tracks those. But the hidden costs, that's the iceberg beneath the surface. That's where the budget bleeds out.
Give me the gritty details. What are we missing on the P&L statement?
Well, the biggest one is what I call the context-switching tax.
Context-switching tax?
Yeah. Let's say you have a high-level development director. Their actual job is to secure major gifts.
Right. They need to be out talking to people.
Exactly. Now, if they have to stop what they're doing to figure out why the Pennsylvania portal is randomly rejecting their PDF upload—
Which happens all the time.
All the time. It's not just the 30 minutes they spend fighting with a clunky website. It's the mental energy required to shift gears from persuasive relationship building to bureaucratic troubleshooting.
That's a huge shift. I mean, it's practically left brain versus right brain.
Precisely. And the research required is non-trivial. State requirements aren't static. They change constantly.
Right.
So you're paying your highly skilled fundraising talent to essentially act as a paralegal. They have to read the statutes, understand the exemptions, track the deadlines.
Which is not what they were hired to do.
Not at all. And speaking of deadlines, they're all different. It's not like the IRS where everything is just due on the 15th of the month. Every state has its own unique rhythm.
So someone has to actually maintain that calendar.
Someone has to maintain it. And if you miss one—
What happens?
You spend hours fixing it. I've seen finance directors, people whose time is worth hundreds of dollars an hour, sitting on hold with a state agency for 45 minutes because a check got applied to the wrong account number.
Oh.
If you calculate the hourly rate of that finance director, that 45-minute phone call Just cost the nonprofit $300.
That's painful to think about. But I want to pivot to something even more expensive. We touched on it briefly, but I really want to hammer this home for the listener.
Opportunity cost.
Yes, opportunity cost.
Yeah.
Because I feel like this is the thing that makes board members' eyes totally glaze over, but it's actually the most tangible loss in this whole scenario.
It absolutely is.
Ugh.
And we really need to stop treating opportunity cost like it's some abstract economic concept. In the nonprofit world, it is literally money left on the table.
Let's put a number on it. Give us a concrete example.
Okay. Let's go back to that development director.
Okay.
Let's say their fundraising target for the year implies that every hour of their active work is worth, let's say conservatively, $500 to the organization.
$500 an hour. Okay. That sounds pretty reasonable for a good major gift officer.
Right. Now imagine they spend 4 hours on a random Tuesday afternoon wrestling with state registrations.
Just doing paperwork.
Scanning bylaws, finding the list of board members, updating home addresses on state portals. That is 4 hours of lost revenue generation.
So you didn't just pay their salary for 4 hours.
No, you lost $2,000 in potential donations.
Because they weren't making the calls. They weren't having coffee with the donor who was ready to write a check.
Exactly. And honestly, it's worse than that. It creates this friction in the overall fundraising strategy itself.
What do you mean?
Well, I've seen organizations hesitate to expand a successful campaign into a new state simply because the staff is terrified of the paperwork.
Really?
Yes. They literally shrink their mission footprint because they don't have the administrative bandwidth to handle the compliance.
That is tragic. Shrinking your impact to fit your paperwork capacity.
It happens all the time.
That phrase should be on a poster in every nonprofit office as a warning. Shrinking your impact to fit your paperwork capacity.
I mean, I'd have to print that poster.
You really should. But let me play the skeptical finance person again here for a second. We're talking about growth, right?
Right.
Most people assume that growth fixes this problem.
Right.
The old more money, more resources mindset. If we double our revenue, we can just hire an admin assistant to do all this, right? Why doesn't it just scale linearly?
Ah, that is the nonlinear complexity trap.
The trap.
Yes. People think the compliance workload grows in a straight line with revenue. It doesn't. It grows exponentially.
Why is that? Is it just more forms?
It's the multiplier effect. Think about it. If you are in one state, you have one set of rules. If you expand to 10 states, you don't just have 10 times the work.
You have 10 different sets of rules.
Exactly. You have to learn 10 entirely different portals.
Give us a taste of that variety. Make us feel the pain of what that actually looks like.
Okay, let's take New York versus Florida.
Perfect.
In Florida, you need to provide a very specific breakdown of expenses, and the signature requirements are strict, but overall, it's fairly straightforward.
Okay, Florida isn't too bad.
Then you look at New York. The Char 500 form requires you to navigate their specific audit thresholds.
Right.
If you cross a certain revenue line, you suddenly need a full CPA audit or a review, and the filing fees slide based on your revenue.
So it's a moving target.
Exactly. Then you go to California. The Registry of Charitable Trusts out there is notorious for rejecting filings for the most minor errors.
Just kicking them back. Yep.
If you have a raffle, that's a separate filing. If you have a commercial co-venture, that's a separate contract you have to file.
So it's not just filling out a standard form 10 times. It's knowing that in State A, I need a notary. In State B, I need a CPA signature. And in State C, I need to upload a PDF That is strictly under 4 megabytes or the whole system crashes.
And do not forget the renewal dates.
Oh, right.
Some states base it on your fiscal year end.
Yeah.
Some are based on the anniversary of when you first registered. Some are just totally arbitrary dates set by the state legislature.
That sounds impossible to track manually.
If you were managing this internally with a simple spreadsheet, the complexity just explodes. You aren't just printing 10 copies of the same letter. You are actively managing 10 distinct legal relationships.
And that leads to mistakes. Which naturally brings us to the scary part of this deep dive. We have to talk about risk.
The fun stuff.
Right. And I don't mean the risk of a $50 late fee. I mean the risk of the bus factor.
Ah, yes. The bus factor is morbid, but every risk manager knows it.
Explain it for anyone who hasn't heard the term.
It's simply how many key people in your organization can get hit by a bus before your entire operation grinds to a halt.
And in internal compliance systems—
That number is almost always one.
It's always Sarah, isn't it? Sarah knows the passwords. Sarah knows which state accepts the digital signature.
It is always Sarah. And reliance on that institutional knowledge is a ticking time bomb.
Because Sarah might leave.
Right. When compliance lives in someone's head instead of documented system, you are incredibly vulnerable. I can't tell you how many times I've seen a full-blown panic attack in an organization because the one person who knew how to renew the charitable solicitation licenses Gave their 2 weeks' notice.
And then they leave. And what happens on the Monday after they're gone?
Silence.
Silence.
And then terror. Because all the renewal notices aren't going to the main organizational inbox. They were going to Sarah's personal work email.
Oh, no.
Or worse, she set up the state portal accounts using her own personal cell phone for the 2-factor authentication.
So now you can't even log in to pay the fee.
Exactly. You're locked out.
That's a total nightmare. You're locked out of your own legal standing because of an authentication text message Going to a phone that's now sitting on a beach in Cabo.
You're laughing, but it happens. The new person comes in and essentially has to play forensic accountant.
I can only imagine.
They have to spend weeks digging through old server files, calling state agencies, who, by the way, will not just give you the password because you asked nicely.
Right, you have to prove you actually represent the charity.
You have to prove who you are. The cost of turnover here isn't just the recruitment fee for a new hire. It's the cost of recreating the entire compliance infrastructure for them.
Because it never really existed in the first place. It was just Sarah.
Exactly. It was just Sarah.
It's amazing how fragile these internal systems are. We tend to think of compliance as this sturdy, rigid, legal thing, but in reality, it's often held together by sticky notes and one person's memory.
And that continuity challenge is the real killer. It creates this vicious cycle where you are constantly cleaning up messes from 6 months ago instead of planning for your campaign 6 months from now.
Okay, I'm sufficiently terrified.
Okay.
But I wanna pull back for just a second because we have to be fair. Is it always a disaster?
No.
Because I know there are listeners out there right now thinking, hey, we do this internally and we're totally fine. Are they deluding themselves or is there an actual time and place for it?
They aren't necessarily deluding themselves. We need to be balanced here. Internal management isn't inherently evil.
Good.
There are absolutely conditions for success.
Okay, what are those conditions? When do you give a nonprofit a pass on keeping it in-house?
First is the scope. If you are a relatively small organization, maybe $500,000 in revenue, operating in only 2 or maybe 3 states, you can absolutely handle this in-house.
If you are organized.
If you are organized. If the volume is low, the complexity is generally manageable.
And I assume organized means a little more than just a pile of manila folders on a desk.
Right. The second condition is absolute clarity of responsibility. It cannot be that Patrick we talked about earlier.
Right.
It has to be, Dave, this is your job. If it's vague, it will fail.
That makes sense.
And third is documentation. You need a physical or digital manual. If Dave gets hit by that bus, can someone else open the book and immediately know how to file the Maryland renewal?
So it's not in Dave's head.
Exactly. If the answer is yes, then internal management can work.
So it's really about sustainability. You have to look at your system objectively and ask, does this survive the people running it?
Precisely. Leaders need to conduct what I call a self-audit. And I don't mean a financial audit. I mean a hard operational reality check.
I like that. So if I'm a leader listening to this right now, what 3 questions should I ask my team tomorrow morning to figure out if we're drifting into the danger zone?
OK, question 1, how much staff time is actually devoted to coordination?
Coordination?
Yes. Not doing the actual work, but talking about the work. If your finance director and development director are having weekly meetings just to sync up on state filings, that is a huge red flag. That is incredibly expensive meeting time.
Okay, that's a good one. What's question 2?
Question 2, are our deadlines predictable or are we reactive?
Reactive meaning everything is a crisis.
Right. If every filing feels like a fire drill, like, oh my gosh, this is due tomorrow, somebody FedEx it overnight. Your system is broken. Compliance should be boring.
Boring is good.
It should be incredibly predictable. If it's exciting, you're doing it wrong.
If compliance is exciting, you're doing it wrong. I love that.
It's true.
And the third question.
Does compliance interrupt fundraising? This is the big one.
The ultimate test.
Yes. If you have ever delayed a campaign, paused an email solicitation, or held back on a grant application because you simply weren't sure if you were registered in that specific jurisdiction, then your internal system is actively costing you more than any external firm ever would.
That hits hard. It really brings us back to that infrastructure idea. We need to completely shift the mindset from compliance being this chore like taking out the trash to compliance being infrastructure.
That is exactly the shift. Think about it like IT support. When you are tiny, you just fix your own computer, right?
Sure, you reboot the router yourself.
But eventually, you realize that if the server goes down, the entire business stops. So, you invest in professional IT support, not because you suddenly love computers, but because you need reliability.
You can't afford the downtime.
Exactly. Compliance is exactly the same. As you mature as an organization, the goal naturally shifts from spending the least amount of money possible to ensuring the highest level of reliability.
You want to build the house on a concrete slab, not on mud. Because if the foundation cracks, it really doesn't matter how nice the curtains in the living room are.
That's it. Perfectly. Investing in structured systems, whether you build a really robust, dedicated internal department, which is expensive, by the way, or you partner with a specialist, it's all about reducing organizational strain. It's about predictability.
It's about clearing the decks so you can do the actual work. Yes.
The primary goal is to minimize the tax on your organizational focus. You want your leadership team looking forward at the mission, at the strategy, at the long-term impact.
Not staring at a screen trying to fix a PDF.
Exactly. Yeah. You don't want them looking backward at a rejected form from the state of Mississippi.
So to wrap this up, what's the ultimate takeaway for the listener today? We've covered the chaos of the patchwork approach, the hidden context-switching costs, the massive opportunity cost of lost donations, and of course, the terror of the Sarah scenario.
The main takeaway is that the real cost of compliance It's not the checks? It's not the checks. It's a tax on your ability to execute your mission. When you look at it that way, the decision becomes so much clearer. You stop looking for the cheapest option, and you start looking for the option that gives you your time back.
Because time is the one resource we really can't fundraise for.
Well, exactly. Once it's gone, it's gone.
I wanna leave the listeners with a final provocative thought to chew on today. Next week, Walk past your development director's office. If you see them squinting at a spreadsheet of state renewal dates instead of being on the phone with a donor, ask yourself, is that really free labor, or is that the most expensive administrative assistant you've ever hired?
That's a sobering thought.
It certainly is. If you found this discussion helpful, you can find additional compliance guides and visual resources at ironwoodregistrations.com. Thanks for listening.
More from Steve
Which States Have the Most Complex Charitable Solicitation Registration Requirements?
What Specialized Compliance Firms Actually Do | Nonprofit Multi-State Compliance