The worst nightmare for most nonprofit board members is a complaint that sparks an investigation of misconduct at the organization. The ember may have been burning for some time before the board becomes aware, or may be a sudden wind driven catastrophe that started with one person’s bad or inept act. No matter the source, how can the board best surround the organization with a defensible space? And, once battling the heat of the disaster, what to do? This article discusses best practices in board policies that help to identify issues early, respond early, and minimize the toll of an investigation. 

Complaints and allegations can arise through whistleblower hotlines or web portals, or by direct communication to someone within an organization, including the board of directors or trustees. In most states, regulators maintain their own complaint website or hotline that is open 24/7. Developing a robust internal auditing or investigating track record will aid in receiving complaints in-house, rather than via a call to the regulator. Cultivating employee confidence that the organization takes allegations seriously is an important part of good corporate governance, and can help avoid regulator entanglement, and consequent resource drain. Some nonprofits maintain undeveloped governance and accounting practices even as they grow larger. Investing in developing those practices, in part by conducting an internal investigation to pressure-test them, can be a helpful means of resource conservation down the line.

Misconduct affecting nonprofits and requiring investigation overlaps with more traditional for-profit corporate malfeasance. Financial misconduct can take various forms and can necessitate specialized forensic accounting if the scheme is complex or deeply embedded in the organization’s books. Embezzlement and direct theft can occur from a corporate account, though theft can also be of other valuable items or diversion of incoming donations or resources. Embezzlement or diversion is not limited to those with access to organizational bank or other accounts; individuals receiving gifts or even those with access to the physical premises have been involved in suspected misconduct. Billing fraud, vendor relationship improprieties, and kickback arrangements are additional forms of financial misconduct. Employees might structure vendor agreements with an off-book component, or run such agreements through other entities owned by family or friends. Expense reimbursement fraud is also within the broad bounds of reportable embezzlement. While these activities can be criminally prosecuted, the organization cannot rely on criminal authorities to identify and protect against this type of misconduct. In some states, California among them, the Attorney General’s office requires nonprofits to identify, and investigate, theft or embezzlement in connection with annual tax filings. Ignoring or simply filing an insurance claim for theft or loss is generally insufficient for charitable organizations.

Executive behavior is a less traditional but equally important category of misconduct. News stories and negative publicity about executive misconduct is not limited to the conduct itself; how an organization reacts, investigates, and addresses the concerns or allegations is very much a part of the story. The reports are, of course, individual entity and leader-specific, but include inappropriate comments or conduct in the workplace, or behavior outside of the workplace that has an effect on an executive’s leadership within the organization. While sexual harassment or misconduct is an unfortunately common subcategory, complaints regarding executive conduct in connection with political activity, discriminatory commentary or behavior, and retaliation against whistleblowers are on the rise.

When a nonprofit corporation learns of alleged misconduct, the first question is what to do and whom to call. An important first step, which can even precede calling in experts, is to preserve all possible evidentiary sources. This can mean suspending automatic deletion practices or regular document recycling or destruction cycles. A two-year deletion cycle may be reasonable in the normal course. But if an allegation arises that needs to be investigated, the regulator is less likely to view that deletion practice as defensible given that misconduct can persist for years undetected. If misconduct results in a regulatory action or civil litigation, document destruction can have severe consequences as well; it is criminalized under Sarbanes-Oxley and can lead to various adverse inferences in the civil context. The digital component of the preservation exercise extends beyond email to other forms of communication (Slack, iMessage, WhatsApp etc.) used by organizational employees. External service providers are subject to their own retention schedules, so making sure that bank statements are not being deleted is another important step. Generally an individual within the legal department, or if no such department exists then an operations or administrative leader, would quarterback this early effort. Every organization is different and has a different landscape of potentially relevant materials; whomever is running the document preservation task must be supported by employees who “know where everything lives”.

As the record preservation effort gets underway, the organization should consider engaging outside expertise in the form of legal counsel and other professionals as soon as possible, both to avoid missteps, and also to take appropriate steps to maintain confidentiality of the investigation to the extent possible. If the allegations relate to disclosures or charitable organization tax audits, that requires one set of eyes and experience. If the allegations concern management integrity, internal controls, or financial fraud, counsel with internal investigation expertise and forensic accounting relationships may be required. If the allegations pertain to hostile workplace or behavior issues, then employment counsel is a good bet.

Engaging counsel early on is critical because it is in the nonprofit’s best interest to conduct any investigation in an attorney-client privileged manner. Legal counsel typically, though not always, reports to a special committee of the board, and maintains a productive relationship with an employee contact. That specially constituted committee is responsible for overseeing any investigation into the allegations, and it may in turn report to the board as a whole. The board, as client, controls the attorney-client privilege regarding the investigation and conclusions. It can then make informed decisions regarding the allegations, findings, and associated risks to the organization with the benefit of confidential legal advice.

After the organization has constituted the board committee and engaged counsel, that counsel will undertake a scoping exercise to identify the questions to be answered by the investigation, followed by a documentary collection and review process, followed by interviews. The specific contours of which documents to review and whom to interview is naturally investigation-specific, but the special committee members should expect to be consulted regarding the investigation scope and breadth, as well as other issues such as whether to interview former employees with relevant knowledge, or whether to “kick the tires” on areas of concern to the board separate from a specific allegation under investigation. The investigation findings will typically be accompanied by remedial recommendations as well as advice on any regulatory disclosure obligations.

Not every nonprofit will experience an issue that requires investigating and remediating, but every organization should be nimble enough to move quickly and appropriately should an issue arise. Larger organizations may consider undertaking a prophylactic investigation every few years to identify any weaknesses in how money or assets are handled or to assess the employees’ views of organizational executives and leadership. Cultural investigations, which are not tied to a specific allegation and are instead designed to assess organizational functioning and suggest recommendations for improving the workplace, are also a means of strengthening the organization and reducing the risk of future liability or complaints. Understanding what types of issues counsel is seeing, how allegations arise, whom to call, and what to expect in an internal investigation is the first step in being ready to identify and address misconduct.

Finally, best management practices include having in place an appropriate insurance program to protect against these risks. And once an issue appears, it’s a good idea to check the insurance coverage to see if investigation costs are covered by the policies. 

"Internal Investigations for Nonprofits: A Means of Identifying and Addressing Misconduct Before the Regulators Come Calling,” published in Board & Administrator, June 2022, Vol. 30, Issue 10.