When an auditor, a court, or an enforcement agency asks whether your board was paying attention, the answer they care about is the one you can put on the table. We hear a version of this from clients after the fact. The board did review the executive director’s salary. The staff did check the grantee against the sanctions list. The finance committee did look at the budget. But nothing was written down, so as far as the person asking is concerned it may not have happened.

In this post we explain why documentation matters in an IRS audit, a state attorney general inquiry, a federal grant dispute, or a lawsuit, and what records a nonprofit should be keeping.

A Policy Is Not Evidence

Most nonprofits have a conflict of interest policy, a whistleblower policy, and a document retention policy, because the Form 990 asks about them in Part VI. A binder of policies shows that someone wrote them. It does not show that anyone followed them.

An examiner or opposing lawyer will look for the second layer, which is proof that the policy was used. That means signed conflict of interest disclosures every year, minutes that record a director leaving the room before a vote, a log of the hotline complaints that came in and what happened to each one, and an actual record of documents being kept or destroyed on schedule. A policy that is not followed can be worse than no policy, because it lets the other side argue that the organization knew what it should do and did not do it.

Executive Compensation and the Rebuttable Presumption

The clearest example in nonprofit tax law is the excess benefit rules under Section 4958. If the board approves compensation in advance, relies on comparability data, and documents its reasoning at the time, the compensation is presumed reasonable and the IRS has to come forward with its own evidence to challenge it.

The regulations are specific about the record. Minutes must show the terms approved and the date, who was present for the discussion and who voted, the comparability data relied on and how it was obtained, and any action taken by a member with a conflict. The records must be prepared before the later of the next meeting or 60 days after the decision, and the board must review and approve them within a reasonable time after that. A smaller organization with under $1 million in gross receipts can meet the comparability requirement with data from three comparable organizations in similar communities.

If the board did everything right but the minutes say only that “compensation was discussed and approved,” the presumption is lost. That one sentence in the minutes can be the difference between a clean audit and an excise tax on the executive and the board members who approved it.

Sanctions Screening and OFAC

Nonprofits that send money or goods abroad, or that work with grantees, vendors, or partners with international ties, face a different kind of exposure. OFAC sanctions liability is strict, which means an organization can violate it without knowing. When OFAC looks at a violation, the existence of a risk-based compliance program and the records showing it was applied are among the factors that affect the outcome.

That means a screening policy is not enough. Keep a dated record of each screening, including the name checked, the list searched, the result, and who ran it. Record how potential matches were cleared. Keep it for as long as the regulations require. OFAC extended its recordkeeping period from five years to ten years under an interim final rule that took effect March 12, 2025, so a check from 2020 may still need to be producible.

This matters more now than it did a few years ago. As we wrote last month about reported efforts to target specific nonprofits, federal agencies are being directed to look closely at the financial networks around certain organizations. If your organization ever receives a letter or a subpoena, the first thing the other side will ask for is your screening and oversight records.

Federal Grants and Certifications

Organizations that take federal money sign certifications with each award, and a false certification can lead to False Claims Act exposure. The best protection is a file that shows how the organization decided it could sign. That includes who reviewed the terms, what questions they raised, what legal advice they received, and what the board or finance committee was told. The same applies to subrecipient monitoring. If you say you reviewed a subgrantee’s spending, there should be a record of what you reviewed and when.

Board Oversight

Directors have duties of care and oversight, and the main way a board shows it met them is through its minutes and the materials in the board packet. Minutes do not need to be a transcript. They should show that a quorum was present, that reports were received, that questions were asked, that outside advice was considered when appropriate, and how the board voted. Keep the financials, audit reports, and committee reports that were reviewed with the minutes so that anyone looking later can see what the board actually had in front of it.

Be careful with what happens after a problem is known. Under federal law, destroying or altering records to impede an investigation is a crime, and it applies to nonprofits and their staff. Once a dispute, audit, or inquiry is reasonably foreseeable, the normal destruction schedule should stop, and someone should be assigned to make sure it does.

Practical Steps to Show Your Work

Start by picking the five or six things your organization would least want to explain without paperwork. For most nonprofits these are executive compensation, related party transactions, foreign or sanctions-sensitive grants, federal award certifications, and restricted gifts. For each one, ask what record exists today that would show a careful decision was made.

Then set a habit. Have directors and key staff sign conflict of interest disclosures every year. Draft minutes within a few weeks of each meeting and approve them at the next one. Keep a compliance calendar and a simple log of screenings, policy reviews, and training. Store everything somewhere that does not depend on one person’s laptop or email account. Review the policies themselves at least once a year to confirm they match what the organization actually does.

Conclusion

Compliance that cannot be shown is hard to defend. The work of holding meetings, running checks, and exercising oversight is something most boards already do. The additional step is to write it down at the time, in enough detail that a stranger could follow what happened. If you would like help building a records system or reviewing the one you have, we are happy to talk.

Ellis Carter is a nonprofit lawyer with Caritas Law Group, P.C. licensed to practice in Washington and Arizona. Ellis advises nonprofit and socially responsible businesses on federal tax and fundraising regulations nationwide. Ellis also advises donors concerning major gifts. To schedule a consultation with Ellis, call 602-456-0071 or email us through our contact form. This post is for general informational purposes and does not constitute legal advice.