What Auditors and Grantmakers Look For First

Welcome to the Nonprofit Compliance Brief, where we explain charitable solicitation and multistate fundraising requirements in clear, practical terms for nonprofit leaders and finance teams. This podcast is produced by Ironwood Registrations.

It is, uh, it's really great to be here today to dig into this.

Yeah, I'm excited. I have to be honest with you though. Um, when I look at the sheer volume of paperwork required to run a nonprofit today, mm-hmm, I mean, the IRS filings, state registrations, the audit prep, it feels incredibly overwhelming.

Oh, absolutely. It's a mountain.

Right. And we usually start these deep dives talking about the mission, the heart of the organization, the why behind the actual work. But today, I wanted to do something a little different. I want to flip the script entirely.

OK, I like that.

I want to look at the organization from the outside in, like through the eyes of an outsider.

That is probably the most valuable shift a leader can make. Because the reality is when an auditor or a major grantmaker looks at your organization, they aren't starting with your mission statement. They aren't looking at the photos of the people you've helped on your website, which seems—

I mean, that seems almost cynical, doesn't it? The whole point is the work. Why would they just ignore the work?

Well, they aren't ignoring it permanently. They're just ignoring it initially. Think of it this way. If you were buying a used car, The seller can tell you all about, you know, the amazing road trips they took.

Yeah.

And how comfortable the seats are. Sure.

Yeah.

But before you hand over thousands in cash, you're gonna pop the hood.

Yeah.

You're gonna check the transmission.

You wanna know if it actually runs.

Exactly.

Mm-hmm.

Because if the engine block is cracked, it literally doesn't matter how nice those road trips were. Okay.

I love that. So in this analogy, the mission is the road trip and the compliance documents, the filings, That's the engine block.

That's the engine block. Before a funder asks, you know, is this organization changing the world? They ask a much colder, much more clinical question. They ask, is this organization safe?

Safe. That's a, that's a really interesting word choice. Usually when we talk about safety, we're thinking about, I don't know, physical safety or maybe data security. What does safety mean to a forensic auditor or a grantmaker?

It means predictability. It means structural integrity. They're basically doing a 30-second scan to see if the vehicle is sound.

Just 30 seconds.

Sometimes even less.

Yeah.

If the structural elements, so we're talking the bylaws, the filing history, the board minutes, if those look chaotic, they immediately assume the financial management is chaotic too.

Wow. So it's essentially a proxy for competence.

Precisely. Chaos in the filing cabinet implies chaos in the bank account.

Yeah.

And that is a risk they just aren't willing to take no matter how incredible your mission is.

Okay, let's walk through this 30-second scan then. If I'm an auditor or a foundation reviewer, what is the very first thing I'm looking for?

You're looking for the bus test.

The bus test. Okay. That sounds a little morbid.

It is a bit morbid, but it's the industry standard for stability. They're asking if the founder or the executive director got hit by a bus tomorrow, would the organization survive?

Oh, I see.

Or is the entire structure just a cult of personality wrapped in a 501 status?

Right, right. So they're looking for evidence that the institution actually exists independently of the person running it.

Right. And you prove that through documented decision-making. So if an auditor walks in and asks, how is this budget approved? And your answer is, oh, Steve just decided it.

You failed the test.

You've completely failed the test. They wanna see minutes, they wanna see a paper trail. If that trail doesn't exist, you are instantly a high-risk applicant.

So maybe you get a small one-time donation, but you're definitely not getting that multi-year, six-figure funding that actually builds longevity.

Exactly. You're cut off from the big leagues.

Okay, so structure comes first, but eventually they do have to look at the money. And this is where I think a lot of folks listening, especially the finance teams, might feel pretty confident. They know they have money in the bank. They know they're solvent. Is that enough?

Solvency is the bare minimum.

Just the minimum.

Yeah. What the external reviewer is really looking for is your financial story. And specifically, they want to see consistency in that story across different documents.

Let's drill down into that because consistency sounds simple in theory, But in accounting, it's rarely simple.

It is rarely simple. So here's the most common trap we see. You have your IRS Form 990, right? That's the public face of the nonprofit. Everyone can go online and see it, right? Then you have your audited financial statements. A sophisticated reviewer, like a grant officer at a large foundation, is going to pull both of those documents, right? And they're going to put them side by side on their desk.

And they expect the numbers to match perfectly.

Ideally, yes. Yeah, but often they don't. And there are valid reasons for that, right?

Because of the different accounting rules.

Exactly. The audit is usually prepared according to GAAP, Generally Accepted Accounting Principles. But the 990 is a tax document. They have totally different rules for things like recognizing the value of donated services or multi-year pledges.

So if the numbers don't match, the auditor doesn't just automatically assume fraud.

Not immediately, no. But, and this is the critical part, there has to be a reconciliation. In the Form 990, specifically on Schedule D, there's a section literally designed to explain the difference between the audit and the tax return.

Okay, and if that section is blank?

If the numbers are different and that section is blank, massive red flag. It tells the reviewer one of two things: either you're actively hiding something, or you simply don't understand your own books well enough to explain the difference.

That feels a little harsh, honestly. I mean, small nonprofits rely on volunteer treasurers or part-time bookkeepers all the time. Is it really fair to expect that level of forensic alignment from them?

Look, fair or not, it's the standard you're being judged against. You are competing for limited funds against organizations that do have that alignment.

That's a good point.

If I'm a grant officer and I see a discrepancy with no explanation, I'm not thinking, oh, they're just a scrappy startup. I'm thinking, I can't trust the financial report they're going to send me in 6 months.

So the takeaway for everyone listening is that the explanation is just as important as the math itself.

Context is king. You have to control the narrative. And this applies to your expenses too. We hear a lot about program service ratios.

Oh right, the overhead myth. Everyone wants to claim that 100% of every dollar goes directly to the cause.

Which is physically impossible.

Right.

Honestly, if I see a Form 990 that claims 95 or 100% program efficiency and $0 for management or fundraising, I am immediately suspicious.

Really? See, I would have thought that was the gold standard.

It's the too good to be true standard. Look, if you're running a $2 million organization, you have administrative costs, you have insurance, you have the executive director's salary.

Which counts as management, not program.

Exactly. You have the audit fee itself. If you allocate all of that to program expenses, You are technically lying on a federal form.

So they're just looking for realism.

They're looking for honesty.

Yeah.

They want to see that you're allocating costs functionally. Like if you host a huge gala, that is a fundraising expense, right? If you claim it was an educational event just to hide the fundraising cost, an auditor is going to catch that immediately. And once they catch one lie, they question every single other number.

Okay, let's pivot to the people actually overseeing all of this. The board of directors. Governance is such a buzzword right now, but how does an outsider actually audit a board? I mean, they aren't in the room where it happens.

They look for independence. And this is a very specific IRS definition. They're checking for independent voting members.

Meaning these are board members who aren't getting paid.

They aren't on the payroll. And critically, they aren't related to anyone who is. We see this all the time in smaller organizations. I call it the family plan. The husband is the executive director, the wife is the board chair, and the brother-in-law is the treasurer.

Yeah, that sounds a lot more like a private family business than a public charity.

That is exactly how the IRS sees it. It's a private fiefdom. There's no one there to say no. If the executive director wants a massive raise, who approves it? His wife.

Right. Or if he wants to hire his own consulting firm for a side project, who actually vets that?

Nobody. Hmm. Which leads directly into the policy documents. This is why the conflict of interest policy is so heavily scrutinized.

Why is that one specific piece of paper so incredibly important?

Because it's the ultimate litmus test for self-dealing. On the Form 990, there's a specific question that asks, "Do you have a written conflict of interest policy?" And right next to it, the follow-up: "Did you regularly and consistently monitor and enforce compliance with the policy?" So it's not enough to just have the policy sitting in a binder on a dusty shelf? No, you have to prove you actually used it. An auditor will often sit down and say, "Okay, show me the signed disclosure forms from the board members for this current year." And if you can't? If you checked "yes" on that tax return but you can't produce those signed forms when asked, you have effectively falsified a federal filing.

Wow. That is a serious, serious exposure for something that just feels like routine paperwork.

It is. But think about the risk from the funder's side. If a grantmaker is about to wire you $1 million, they need absolute certainty it's not going to be funneled into a board member's construction company without a rigorous competitive bid process. The conflict of interest policy is their shield against that.

That makes total sense. Now, I want to move to what I call the hygiene factor. This is the stuff that always makes nonprofit leaders just roll their eyes. State registrations, corporate good standing, all the red tape.

The unglamorous stuff that actually keeps the doors open.

But does it really? I mean, let's be real. Does a donor in California actually check if a New York nonprofit is officially registered to solicit in Sacramento before they click donate?

The individual donor might not, but the foundation definitely will, and increasingly the digital platforms will. This is a massive shift in the landscape right now. Good standing is a binary switch. You are either eligible to exist or you aren't.

Can you explain good standing for anyone listening who might not know the technical implications of that?

Sure. It is a legal status with your state of incorporation. You have to file an annual report. Usually it's just a really simple update of your mailing address and your current board members, and you pay a small fee.

Like $50. Right.

But if you forget, the state administratively dissolves you. Your corporate liability shield just evaporates.

Wait, meaning you are personally liable?

Potentially, yes, the board could be personally liable. And from a funding perspective, it is an absolute disaster. Many large foundations use automated vetting systems now. They just punch in your employer identification number, and if the state database returns revoked or delinquent, the application is auto-rejected. No human being ever even reads your beautiful proposal.

That is wild. You are entirely knocked out by an algorithm because you forgot to mail a $50 filing.

Exactly. And then you add the multi-state aspect to that, the charitable solicitation registration. If you are asking for money in a state, you generally need to be registered there.

The key word there being asking. Yes.

The legal trigger is the solicitation, not the receipt of the gift. A lot of leaders think, you know, I'll register in Ohio when we finally get a big donor in Ohio.

Right. That's the common assumption.

But legally, the moment you put a Donate Now button on your website or you send an email blast to a newsletter list, that includes people living in that state, you are soliciting.

I really want to pause on this because it connects to a major theme we see all the time. We often assume that compliance is something we deal with after we grow, like we'll figure it out once we're big. But the truth is compliance tends to expand alongside fundraising growth.

That is the ultimate paradox of this sector. Success creates liability, right? Imagine you launch a campaign and it just goes viral. Suddenly you have $20 donations pouring in from all 50 states. You're celebrating. The team is popping champagne. Pain, but in the background, you have just triggered active registration requirements in 41 different jurisdictions.

So if you aren't ready for that growth, the success itself can literally crush you.

It can, because if a state attorney general sends you a formal letter demanding to know why you are soliciting unregistered residents, you face heavy fines. In extreme cases, they can legally force you to return all those contributions. It's a process called disgorgement.

Disgorgement. That is a terrifying word.

It's a nuclear option for regulators. But even short of that, the reputational damage is just fatal. If the local headlines say your nonprofit is under investigation by 3 different states for illegal fundraising, your donor trust hits absolute zero.

Yeah, nobody's giving to you after that.

Exactly. And this is the point. Organizations that review requirements periodically avoid most problems, right? They treat compliance as a hygiene habit, right? They scale their infrastructure. Before they scale their fundraising.

So hygiene isn't just about avoiding a slap on the wrist. It's about fundamental asset protection. You're building a fortress around the money you worked so hard to raise.

That is exactly the right way to look at it.

Let's look under the hood at the day-to-day operations now. The internal controls. This always sounds to me like auditor speak for trusting absolutely no one.

I wouldn't say that. It's auditor speak for Removing the opportunity for error. It's not about mistrusting your team. It's about protecting your team from temptation and protecting the organization from mistakes. The biggest concept here is segregation of duties.

Okay, break that down for us.

In a perfect world, the person who opens the mail and physically takes the check out of the envelope should not be the same person who deposits it at the bank. Yeah. And neither of them should be the person who reconciles the bank statement in the software at the end of the month.

Because if I do all 3 of those things, I can pocket the check, cook the books, and no one would ever know until the yearly audit. Right.

If you control the physical asset and the digital record of the asset, you have absolute power.

But— and I can hear our listeners shouting this at their speakers right now— what if you only have a staff of 3 people? You can't have a separate dedicated department for every single financial task.

And that is the reality for the vast majority of nonprofits. Auditors know that. They aren't expecting a grassroots group to hire a 10-person corporate finance team. Mm-hmm. But they do expect to see compensating controls.

Compensating controls. What does that actually look like in practice?

It usually involves leveraging the board. So maybe your volunteer treasurer logs into the bank account online once a month just to visually scan the images of the cleared checks.

Just having a second set of eyes.

Exactly. Or maybe you institute a policy that any outgoing check over $5,000 requires 2 physical signatures, one from the staff director and one from a board member.

So you're basically designing a system where no single person can empty the bank account without someone else noticing.

Yes, because if an auditor writes you a management letter, that's the confidential letter they send to the board after the audit is done, and they cite a material weakness in your internal controls, That is a very serious black mark.

Material weakness. That really sounds like a term structural engineers use right before a bridge collapses.

It's the exact same idea.

Yeah.

It means your financial data might be perfectly correct right now, today, but your system is so weak that it's just pure luck that it's correct. The bridge could collapse at any moment.

Let's summarize some of this scary stuff. We've talked about structural integrity, financial alignment, governance, hygiene controls. If I'm an auditor scanning a file, what are the flashing red lights that make me just want I want to pack up my briefcase and walk away immediately.

Number 1 is loans to officers.

Wait, the nonprofit lending money to the staff? Yes.

It happens way more than you'd think. A founder needs cash for a personal emergency, so they borrow it from the nonprofit's general fund. This has to be explicitly disclosed on Schedule L of the Form 990.

And I assume that looks terrible to an outside reviewer.

It looks like a personal piggy bank.

Yeah.

It completely destroys the concept of public benefit. For most major grantmakers, that is an immediate do not fund.

Yeah, I can see why. What else is a major red flag?

Unexplained rapid growth.

Really? Growth is a red flag.

It goes back to the car analogy. If you are driving a little Honda Civic and you suddenly strap a jet engine to the roof, the car is going to shake itself apart.

Right.

If I see a nonprofit where revenue tripled in a single year, but their administrative costs stayed flat or even went down, I know something is actively breaking behind the scenes.

Because the infrastructure hasn't grown to support the weight of all that new money.

Exactly. You haven't hired more accountants. You haven't upgraded your database software. You are just forcing a massive volume of cash through a very weak old pipe. It is going to burst.

So how do we fix this? We've laid out a lot of potential landmines here. How does a leader stop being viewed as risky and start looking like a blue-chip investment to these funders?

You have to operationalize the review process. You simply can't You cannot wait for the independent auditor to tell you that your systems are weak.

So you basically audit yourself first.

Essentially, yes. Sit down once a year, get the finance team, development, and leadership in the same room, and compare your documents. Ask yourselves, does the 990 actually match the audit? Does the state registration list the current board members, or is it 3 years out of date?

Are the conflict of interest forms actually signed? Right. It sounds like a lot of proactive work.

It is work. But here is the golden rule of compliance. If you catch the error, it's a correction. If the auditor catches the error, it's a finding.

Oh, wow.

A finding ends up in your permanent record. A correction is just evidence of good management.

Let me repeat that. If you catch it, it's a correction. If the auditor catches it, it's a finding. That is an incredibly powerful distinction. It shifts all the power back to the nonprofit.

It does. And it completely changes the organizational mindset. You stop viewing compliance this heavy burden, you know, the eat your vegetables part of the job, and you start viewing it as a competitive advantage.

A competitive advantage.

Absolutely. The modern donor landscape is changing rapidly. Donors are data-driven now. They look at Charity Navigator. They look at Candid profiles. When they see a Platinum Transparency seal or they see an unqualified audit opinion—

Just to clarify for everyone listening, in auditor speak, an unqualified opinion actually means perfect. Right.

Yes. It's very confusing terminology, but yes, unqualified means without reservation. It means your books are clean. When a sophisticated donor sees that, they feel smart about their investment. You are actively lowering the psychological barrier to giving.

So you can actually market your boring back-end stability.

You should market it. Saying, we are Gold Star compliant, we have had clean audits for 10 years running, that is a pitch that deeply appeals to high-net-worth individuals who understand business risks. It turns the skeleton of the organization into a major selling point.

And that skeleton is what allows the mission to actually walk and run.

Precisely. Because you can't change the world if you're stuck in tax court.

That is the bottom line right there. You cannot change the world if you are stuck in tax court.

That's it.

This has been an incredibly dense but really, really necessary conversation. We have covered a massive amount of ground today. But before we wrap up, I want to leave you, our listeners, with a challenge, a bit of a thought experiment based on everything we've unpacked today.

Let's hear it.

Imagine a stranger. Someone who knows absolutely nothing about your passion, your late nights, or the tears you've shed for your cause. They walk into your office and they don't talk to you. They don't look at your beautiful program photos. They just pick up your documentation, the 990, the audit, the policy binder, the paper trail, right? Would that stranger see a stable, organized machine ready for investment, or would they see a chaotic mystery? Because in the world of major funding, the documentation speaks louder than the pitch.

That is the ultimate test.

If you found this discussion helpful, you can find additional compliance guides and visual resources at ironwoodregistrations.com. Thanks for listening.