Nonprofit Compliance Guide: What Finance and Development Teams Need to Know

Compliance is a commitment to donor trust and funding. 

Nonprofit compliance highlights your organization’s commitment to being a good steward of donated funds through internal practices and financial safeguards.  

We’ll explore the foundations of nonprofit governance, how nonprofits can implement day-to-day controls, the reports and filings your organization needs, and how to increase your organization’s overall audit readiness. 

Building Your Compliance Foundation  

Compliance starts with governance: board oversight, established policies, and clearly defined roles throughout an organization. When it comes to donated funds, your organization needs to ensure safeguards are in place.    

Internal controls highlight a commitment to compliance and lay the foundation for your policies. Common internal controls include:  

• Segregation of duties: A process where duties are separated throughout a team to ensure no one person has complete access to your financials  

• Approval workflows: A multi-step approval process where financial data is double-checked before moving on  

• Audit trails: An internal system log that logs what changes were made to your finances, along with the user and workstation on which the changes were made. 

Sample Nonprofit Internal Controls Policy  

A written policy turns internal controls from good intentions into a standard everyone follows. At a minimum, your policy should include these elements: 

• Approval thresholds: Dollar amounts that trigger extra sign-off. For example, purchases over $500 need a supervisor’s approval, and anything over $5,000 needs board or executive director approval.  

• Dual signatures: Two authorized signers are required for checks or fund transfers above a set amount, so no single person can move money without the other’s approval.  

• Reconciliation cadence: A set schedule (monthly, at a minimum) for reconciling bank accounts and financial statements, with a named owner responsible for it. 

These internal control policies provide your organization and auditors with a clear paper trail showing that donated funds are handled with care.  

Staying Compliant Day-to-Day with Operational Controls  

With your policies defined, your team needs the right daily habits, reporting, automation, and data protection to keep that foundation solid as donations come in. 

Financial Reporting and Budgeting 

Financial reporting gives your organization real-time visibility into its financial health. Fund reporting, specifically, shows where every dollar goes and how it supports mission delivery, keeping your team and external stakeholders informed and ready for your annual audit. 

Your budget works alongside these reports. It’s a living document, adjusted throughout the year to reflect where your organization actually stands. Together, reporting and budgeting form the public-facing record of your organization’s health. 

Automation 

Automation is the second lever. Reducing manual data entry reduces the errors that come with it, and fewer errors mean cleaner records for your team, your board, and your auditors.  

Data Protection 

Every operational control should be built around data privacy. Alongside stewarding donated funds, your organization holds sensitive donor and financial data, and that data deserves the same rigor.  

Organizations that manage sensitive health information should also be mindful of HIPAA requirements when handling that data. A breach involving protected health information carries its own reporting and liability obligations, in addition to standard data security practices. 

Nonprofit Compliance Checklist 

Governance and daily habits set the stage, but compliance ultimately comes down to specifics: the reports you file, the records you keep, and the rules you follow. Here’s what you need to have covered:  

Audit preparation 

• Audits help nonprofits: demonstrate they’re good financial stewards, manage their operations efficiently, and provide board members and leadership with accurate financial data to make informed decisions.  

• In general, your organization needs to keep its financial statements organized and easy to retrieve. The audit process is a partnership between your organization and an auditor. Working together, you’ll give access to your finances to the auditor as they prepare their final report. 

Grant reporting 

• Grants come with specific funding requirements, stipulated conditions, and deadlines for using the funding.  

• Fund accounting software makes it easy to apply these prerequisites to grants to demonstrate compliance and proper use. 

Internal controls 

• Ensure your organization has policies that it regularly reviews around segregation of duties and transaction authorization. 

Tax compliance & Form 990 

• One of the most common compliance practices is tax compliance. Your 501(c)3 status is tied to accurate and timely tax filing, with requirements to uphold your tax-exempt status. 

GAAP for nonprofits 

• Nonprofits and government agencies must follow GAAP (Generally Accepted Accounting Principles)  

• The Financial Accounting Standards Board (FASB) sets these principles and updates them as needed. By sticking to GAAP, nonprofits can ensure financial information is reported effectively, transparently, and efficiently. 

• Nonprofits must file specific financial statements, including a Statement of Financial Position, Statement of Activities, Statement of Cash Flows, and Statement of Functional Expenses. 

Restricted vs. unrestricted funds 

• Ensure your organization accurately tracks both restricted and unrestricted funds.  

• While unrestricted funds are open to general use, restricted funds are subject to guidelines and policies that must be applied to spending. Fund accounting software makes it easy to track fund spending and ensure your organization meets compliance requirements. 

Donor data protection  

• As a steward of sensitive information, your organization should establish and regularly revisit data privacy practices, establish access controls, and develop retention policies to reference.  

• As important as safeguarding information is, it’s equally important to have policies for discarding private information that’s no longer needed. 

Preparing for Audits and Ongoing Review 

 Your annual audit is where everything above gets tested.  Your auditor wants to help your organization succeed. They’re looking for: documented policies, consistent processes, and records that hold up under scrutiny. 

Auditors typically review: 

• Whether segregation of duties and approval workflows are followed in practice, not just written down 

• Bank and account reconciliations completed on schedule 

• Supporting documentation for grants, restricted funds, and major transactions 

• Consistency between your financial statements and the records behind them 

The stronger your internal controls and the cleaner your day-to-day records, the shorter and smoother this process becomes. Organizations that reconcile monthly, automate data entry, and keep clear documentation typically have a smoother audit process.  

An audit isn’t just a compliance requirement; it’s a planning tool. The same data that satisfies your auditor, spending patterns, fund usage, and control gaps, shows your board and finance team where to tighten processes or adjust strategy for the year ahead. Treating your audit as an input to planning, rather than a box to check, is what turns compliance from a defensive necessity into a lasting advantage. 

Using Technology to Simplify Compliance 

The right accounting platform handles much of this work for you. MIP Accounting, by Momentive Software, has built-in audit trails, segregation of duties, and approval workflows, so the safeguards your organization needs are standard. Real-time reporting keeps your team audit-ready year-round and not scrambling to reconstruct records after the fact.  

MIP provides robust access controls, audit trails, and security processes that help safeguard sensitive data, including supporting the administrative, technical, and accountability requirements associated with HIPAA. 

Frequently Asked Questions