Your Mission Deserves Better Protection.

× Casualty

Excess and Umbrella Liability for Nonprofits in 2026

Most nonprofit leaders think about liability limits once a year, at renewal, and then rarely again. That is precisely the habit the 2026 casualty environment is built to punish. A single auto loss, a single abuse allegation, a single event gone wrong can now generate a demand that dwarfs the primary policy a board approved without a second glance. The question is no longer whether your general liability limit is adequate for an ordinary claim—it is whether anything stands behind that limit when the claim is extraordinary.

That is the work an excess or umbrella policy does. It sits above your underlying coverages and lends its limit when they are exhausted. In practice, a nonprofit umbrella typically drops over three towers at once: your commercial general liability, your business auto liability, and your employer's liability under workers' compensation. When a jury returns a number your primary carrier cannot reach, the umbrella is what separates a difficult year from a dissolved mission. It does not replace the underlying coverage—it extends it, and that distinction governs everything about how the policy should be built.

Why the pressure is building. The severity driving limits higher in 2026 is not imagined. Marathon Strategies found that corporate nuclear verdicts—awards of $10 million or more—reached a record $25.6 billion across 190 cases in 2025, a 40.7% jump over the prior year, with 40 "thermonuclear" verdicts exceeding $100 million apiece. Since 2020, the count of such verdicts has grown 476%. The forces behind those numbers are familiar to anyone reading the trade press: social inflation, jury pools increasingly inclined to punish institutions rather than merely compensate plaintiffs, and third-party litigation funding that bankrolls cases toward larger outcomes. Willis Towers Watson notes that tort costs are now growing at 8.7% a year, outpacing the broader economy.

Nonprofits are not spectators to this trend—they are squarely inside it. The exposures that feed a nonprofit umbrella are the very activities that define the work: volunteers and clients behind the wheel, premises open to the public, events that gather crowds, and, where it can still be purchased, abuse and molestation coverage. Gallagher's 2026 sector update reports nonprofit auto rates climbing 7% to 15%, with some claims exceeding $20 million in severity, and abuse coverage so constrained that fewer than five standard admitted carriers remain willing to write it for foster care and adoption providers. The umbrella is where these scattered exposures converge into a single, consequential limit.

Following-form versus standalone. Here the structure matters as much as the number. Most excess policies are "following form"—they adopt the terms, conditions, and exclusions of the underlying policy they sit over. That is clean and coherent, but it carries a hidden consequence: an exclusion buried in your primary general liability flows straight up into the excess. If abuse is sublimited or excluded below, following form does not cure it above. A standalone umbrella, by contrast, is its own contract with its own terms, which can broaden coverage—or, read carelessly, narrow it in ways the underlying never did. Neither is categorically better. What matters is that someone with fiduciary discipline reads both documents against each other and surfaces the gaps before a claim does.

The temptation, when it comes to the limit itself, is to default to a round number—a million, then another million stacked on top—because round numbers feel like decisions. They are not. An adequate limit is benchmarked, not guessed. It should be set against the organization's asset base and endowment, the scope and visibility of its mission, the size and use of its vehicle fleet, and the verdicts peer organizations in your jurisdiction and sector have actually faced. A social-service agency transporting vulnerable clients carries a different severity profile than a grantmaking foundation with no fleet, and their limits should look nothing alike. The right number uncovers your true exposure rather than flattering your budget.

The market itself is sending mixed signals, which makes the exercise both harder and more necessary. CRC's Q2 2026 excess and umbrella index shows rate increases decelerating to roughly 6% to 11%, down from the low-to-mid teens a year earlier, as fresh capacity competes for clean accounts. Yet capacity above the first $10 million remains genuinely scarce—RPS notes the lead layer now often takes multiple carriers to assemble what was once a single policy—and challenged classes, which many nonprofits are, see slower relief and tighter terms. Softer pricing is not the same as abundant coverage. The runway is open for well-documented, well-governed organizations; it narrows sharply for those who arrive at renewal with an incomplete story.

That story is the leverage. At Peoples First Tennessee, we build it through our 4-Step Strategic Process—Strategic Discovery to illuminate the mission and its real exposures, Risk Assessment to benchmark the limit against assets and peer verdicts, Solution Design to structure the tower and reconcile following-form against standalone, and Ongoing Optimization to keep the program aligned as the organization and the market both move. The limit above your limits is not a line item. It is the ownership you take of your mission's survival.

Sources: Nuclear Verdicts Against Companies Hit Record High in 2025, Topping $25.6 Billion; Nuclear Verdicts Go Boom, Increase 40.7% in 2025; Nonprofit Insurers Ease Some Rates While Abuse, Auto and Casualty Costs Keep Climbing; Insurance Marketplace Realities 2026 – Casualty; Excess + Umbrella REDY Index Q2 2026; US casualty market stabilizing after nearly five years of post-pandemic disruption – RPS

— Ryan Mefford, President & Risk Advisor

× Management Liability

Nonprofit Directors and Officers Coverage During Financial Distress in 2026

The policy is tested hardest when the money runs short. Most nonprofit boards buy directors and officers coverage to protect against the familiar exposures — an employment claim, a governance dispute, an allegation of mismanagement. Those exposures are real. But the moment a D&O policy is tested hardest is the one boards plan for least: when the organization itself runs out of money. In 2026, with funding pressure building across the sector, that is no longer a remote scenario.

The pressure is structural. Business bankruptcy filings reached 23,043 in the twelve months ending June 30, 2025, a 4.5 percent year-over-year increase that pushed total filings above even pandemic-era levels. Chapter 11 reorganizations ran to 8,408 filings, 11 percent higher than in 2020. The drivers named by analysts — higher interest rates, tightened credit, refinancing obstacles, and reduced government spending — fall hard on nonprofits, which often operate on thin reserves and depend on grants and government contracts that can be cut or delayed with little warning. An organization that loses a major funding stream mid-year does not have the luxury of a slow adjustment. It faces a solvency question, and the board faces a liability question at the same moment.

Distress does not simply mean less money — it is a different legal environment. As an organization approaches insolvency, the fiduciary duties of its directors begin to shift toward creditors, not only the mission and its donors. Decisions that were ordinary governance in a healthy year — which vendors to pay, whether to keep operating, how to wind down a program — become potential claims: breach of fiduciary duty, deepening insolvency, preferential payments, misrepresentation to lenders. Creditors, former employees, and bankruptcy trustees all become potential claimants. The claims rise exactly when the organization has the fewest resources to defend its leaders.

Here is the trap inside a standard policy. A standard D&O policy — a combined Side A, B, and C program — insures both the individual directors and the organization. In a bankruptcy, that creates a conflict. Because the policy also covers the entity, its proceeds can be treated as property of the bankruptcy estate, subject to the automatic stay under Section 362 of the Bankruptcy Code. The practical effect is severe: the directors who most need the policy to fund their defense may be blocked from reaching it, or forced to litigate for access, precisely when the claims are landing.

Side A coverage is the answer, and it is different in kind. A dedicated Side A policy covers only the individuals, not the entity, when the organization cannot or will not indemnify them. Because it does not insure the organization, its proceeds are far less likely to be pulled into the bankruptcy estate. Courts have reinforced the distinction — in the 2025 In re First Brands Group proceedings, a court was willing to lift the automatic stay for Side A access while restricting access to the combined policy. For a nonprofit board, the lesson is direct: in the scenario that matters most, Side A limits may be the only limits a director can actually reach.

A distress-ready program is built while the organization is healthy. Coverage bought under distress is coverage bought on the worst possible terms. A distress-ready D&O program carries adequate Side A limits, often through a dedicated Side A difference-in-conditions policy that sits above the main program and responds when the underlying coverage is unavailable. It is read for the insured-versus-insured exclusion and the bankruptcy and insolvency exclusions that some policies carry — provisions that can quietly gut coverage in exactly the scenario where it is needed. And it is paired with the governance discipline — documented board minutes, conflict management, financial oversight — that keeps the underwriter willing to renew.

This is the work PFTN brings to a nonprofit board. Strategic Discovery surfaces the organization's real funding concentration and the exposures a disruption would create. Risk Assessment quantifies what an insolvency scenario would mean for the directors personally and whether the current program would actually respond. Solution Design structures the Side A limits, the exclusionary language, and the program architecture so the coverage holds when the entity cannot indemnify. Ongoing Optimization revisits the program as the funding environment and the board both change.

No board wants to plan for the day the money runs short. But the directors who serve a mission deserve to know their personal exposure has been considered before that day arrives, not after. A grant can be cut, a contract can lapse, a reserve can thin faster than anyone projected — and none of those events should be the moment a board first learns how its own D&O program behaves in insolvency. The strongest governance decision a board can make in a hard funding year is a quiet one: confirm, while the organization is still sound, that the coverage protecting its own members would survive the organization's worst moment. That confirmation is not pessimism. It is the same fiduciary care the board already owes the mission, turned for a moment toward the people who carry it.

Sources: Willis Towers Watson — D&O Insurance and Distressed Risk: Is Your Program Bankruptcy Ready? (January 2026); The Baldwin Group — 2026 Nonprofit Mid-Year State of the Market; insura.ai — D&O Insurance for Nonprofits 2026: Board Liability Protection; Heffernan Insurance Brokers — Navigating Directors and Officers Insurance for Nonprofit Boards; The Coyle Group — What Nonprofit D&O Insurance Covers

— Ryan Mefford, President & Risk Advisor

× Commercial Auto

Owned-Vehicle and Fleet Coverage for Nonprofits That Transport Clients in 2026

For a nonprofit that moves people, the vehicle is the mission. A van that carries seniors to dialysis, a bus that brings children to an after-school program, a car a caseworker drives to a client’s home — these are not overhead. They are the service. And the commercial auto policy behind them is, in 2026, the single hardest coverage in a nonprofit’s insurance program to renew on acceptable terms.

Commercial auto stands apart from the rest of the market, and it has for years. While property rates eased and much of the casualty market flattened through 2026, commercial auto kept rising — up roughly 5.8 percent in the first quarter, the largest increase of any major property-casualty line. The reason is not a bad year but a bad decade: AM Best has identified commercial auto as one of the worst-performing property-casualty segments over the past ten years, with the industry posting net underwriting losses exceeding five billion dollars in both 2023 and 2024. A nonprofit renewing its fleet coverage is not being singled out; it is standing in a line the whole market has struggled to price.

What drives the loss is severity, not frequency — the cost of the serious claim, not the number of fender-benders. Social inflation and nuclear verdicts have pushed auto bodily-injury awards far past what medical and economic damages alone would support. A California family recovered $52.1 million after a truck collision; a Utah family was awarded $81 million following a fatal pedestrian crash. A nonprofit’s van is not exempt from that math. Put an organization’s name on the door of a vehicle involved in a catastrophic injury, and the same forces that reordered trucking budgets arrive at the nonprofit’s renewal.

The exposure is compounded by whom nonprofits carry. Transporting vulnerable passengers — children, the elderly, people with disabilities — raises both the severity of a potential injury and the sympathy a jury brings to it. That is not a reason to stop providing the service; it is a reason to insure it deliberately, because the gap between a well-structured auto program and a thin one is measured in exactly these claims.

The structural gaps cluster in two places. The first is the difference between owned and non-owned vehicles. A business auto policy covers what the organization owns, but much of a nonprofit’s driving happens in vehicles it does not own — a volunteer using a personal car to deliver meals, a staff member running an errand in their own vehicle. That is hired-and-non-owned auto exposure, and it is answered by a specific endorsement that many nonprofit policies omit. When a volunteer causes a serious crash, their personal auto limits are exhausted first, and the organization is pulled in for the balance — the exact scenario non-owned coverage exists to fund. A program that never added the endorsement discovers the gap at the worst possible moment.

The second gap is limit adequacy on the vehicles the organization does own. Many nonprofits still carry primary auto limits set for a prior decade’s verdict environment, with little or no umbrella above them. A combined single limit — one pooled amount for bodily injury and property damage — removes the internal sublimits that let a large loss pierce a split-limit policy, and a properly sized umbrella extends the runway above the primary layer to meet the severity the current environment actually produces. The limit that looked generous when it was purchased can be a fraction of the verdict a single serious passenger-injury claim now generates.

The encouraging part is how much a nonprofit governs. Underwriters no longer treat safety technology as optional; telematics and dash cameras earn premium credit and, more importantly, convert a plaintiff’s narrative of a careless organization into a documented record of a careful one — footage that can exonerate a driver in the first days after a crash, before a funded plaintiff’s account hardens. Motor-vehicle-record checks on every driver, including volunteers, a written vehicle-use and driver-qualification policy applied without exception, documented trip logs, and a maintenance schedule are the least glamorous controls in the program and the first documents opposing counsel will demand. A disciplined driver file is leverage; a thin one is an invitation.

This is precisely the work our 4-Step Strategic Process brings into the light. Strategic Discovery maps every way the organization moves people and property — owned vehicles, volunteer cars, staff errands — and the drivers behind each. Risk Assessment tests the hired-and-non-owned endorsement, the owned-auto limits, and the umbrella against the severity a serious passenger claim would produce. Solution Design closes the non-owned gap and sizes the limit architecture to the verdict environment rather than to habit. Ongoing Optimization keeps the driver files, telematics, and policies current as the fleet and the volunteer roster change. A nonprofit that moves people cannot make the road safe on its own — but it can decide, in advance, whether a single crash becomes a claim it survives or a loss that ends the mission.

Sources: AM Best (via Heffernan Insurance) — The Impact of Nuclear Verdicts on Transportation; Christensen Group — Why Commercial Auto Insurance Is Rising; Winter-Dent & Company — What Is Actually Driving Commercial Auto Rate Increases; Beancount — Commercial Insurance Rates in 2026; Insurance Information Institute — Social Inflation and Commercial Auto; Grit Insurance — Why Commercial Auto Insurance Keeps Going Up.

— Ryan Mefford, President & Risk Advisor

× Board Liability

The Unpaid Board Member's $35,000 Problem

Here is a number that should concern every nonprofit board member in America: $35,000. That's the average cost to resolve a directors and officers liability claim against a nonprofit. And if that sounds manageable, consider this: one in ten D&O claims exceeds $100,000. The claims don't distinguish between paid executives and volunteer board members who donate their time, their expertise, and their professional reputation.

Most nonprofit board members believe they're protected by incorporation. They think the corporate structure shields their personal assets. It doesn't — at least not completely. Incorporation protects against many forms of organizational liability, but it does not eliminate personal liability for breaches of fiduciary duty.

Nonprofit directors carry three fiduciary duties. The duty of care requires exercising the same level of attention a reasonably prudent person would in similar circumstances — attending meetings, reviewing financial statements, asking questions about significant decisions. The duty of loyalty prohibits self-dealing, conflicts of interest, and using the organization's resources for personal benefit. The duty of obedience requires ensuring the organization complies with its bylaws, its stated charitable purpose, and applicable laws.

A board member who misses meetings, rubber-stamps financial reports without review, or fails to ask about a related-party transaction can be held personally liable for breach of the duty of care or loyalty. A board that allows the executive director to use restricted grant funds for unrestricted purposes violates the duty of obedience. A board that fails to file Form 990 for three consecutive years triggers automatic revocation of tax-exempt status — and the personal tax liability implications can flow to responsible persons.

And then there's the exposure most board members never consider: payroll tax liability. If your nonprofit fails to deposit or remit payroll taxes, the IRS can assess a Trust Fund Recovery Penalty against any "responsible person" — which includes board members who had authority over financial decisions. This is personal liability. It attaches to the individual, not the organization. It survives bankruptcy.

Charitable immunity once provided a broad shield. Today, most states have eliminated or severely limited charitable immunity statutes. The Federal Volunteer Protection Act provides some protection for volunteers, but only against ordinary negligence — not gross negligence, not willful misconduct, and not actions taken outside the scope of the volunteer's responsibilities. It's a narrow shield, and relying on it is a gamble.

D&O insurance exists to close this gap. A properly structured nonprofit D&O policy provides three layers of protection: Side A covers individual directors and officers when the organization cannot or will not indemnify them (the most critical layer for unpaid board members). Side B reimburses the organization when it does indemnify its directors. Side C (entity coverage) protects the organization itself for claims brought directly against it.

The problem is that most nonprofits either don't carry D&O coverage at all, carry inadequate limits, or have policies with exclusions that gut the protection when it matters most. Employment practices claims — which account for 95% of nonprofit D&O claims — may be excluded or sublimited. IRS compliance claims may trigger a regulatory exclusion. Prior acts may not be covered if the retroactive date was set incorrectly.

At PFTN, we structure D&O programs specifically for nonprofit boards. We verify that Side A coverage is adequate to protect personal assets. We ensure employment practices are covered — not excluded. We review retroactive dates, prior knowledge exclusions, and regulatory defense provisions. Because the people who volunteer to lead your organization shouldn't have to risk their homes to do it.

× Abuse Coverage

The SAM Coverage Crisis No One Is Solving

The sexual abuse and molestation (SAM) insurance market is broken. Not stressed. Not hardening. Broken.

Here are the numbers: 87.5% of insurance brokers report that carriers are restricting coverage or reducing limits for improper sexual conduct insurance — up from 77% just five years ago. 70.5% of brokers report that carriers are non-renewing entire classes of nonprofit organizations regardless of claims history. California alone has seen abuse insurance premiums climb from $114 million in 2019 to $490 million in 2025, driven by extended statutes of limitations that opened decades-old claims. The Boy Scouts of America compensation fund exceeded $7 billion.

For youth-serving nonprofits, religious institutions, residential programs, camps, and any organization that works with vulnerable populations, these aren't abstract market statistics. They're the reality of your next renewal.

The crisis has two dimensions. The first is availability: carriers are leaving the market entirely for high-risk classes. Residential child welfare agencies, overnight camps, and organizations with any history of abuse claims — even decades old — face genuine coverage gaps. Some organizations are being forced into the excess and surplus lines market, where coverage is more expensive and terms are less favorable. Others are going without coverage entirely, which is an existential risk for organizations serving minors.

The second dimension is underwriting requirements. 94% of carriers now require defined abuse prevention practices before they'll issue a quote — up from 82% three years ago. 88% require formal monitoring and supervision policies. Carriers want to see background checks on every person with access to vulnerable populations. They want two-adult rules prohibiting one-on-one unsupervised contact with minors. They want documented training programs, clear reporting procedures, and — increasingly — third-party accreditation from organizations like Praesidium or Stewards Trust.

These requirements aren't unreasonable. They're the minimum standard of care for organizations working with children and vulnerable adults. But they represent a significant operational and financial investment that many smaller nonprofits struggle to implement, especially when they're already operating on thin margins.

The retroactive date issue compounds the problem. SAM policies typically have a retroactive date — a cutoff before which abuse allegations are not covered. If your organization has been operating for 30 years but your current policy has a retroactive date of five years ago, any abuse alleged to have occurred before that date falls into an uninsured gap. Extended reporting period riders can address some of this exposure, but they're expensive and increasingly difficult to obtain. For organizations with legacy exposure — and in an era of extended statutes of limitations, that's most of them — the retroactive date is the single most important provision in the policy.

At PFTN, we specialize in navigating the SAM market for nonprofits. We know which carriers are still writing coverage for each risk class. We understand the underwriting requirements and help organizations implement the prevention programs that make them insurable. We fight for retroactive dates that reflect your actual operating history, not the carrier's convenience. And we structure programs that coordinate SAM coverage with your general liability and umbrella policies to eliminate gaps between layers.

This market isn't going to fix itself. The claims environment that created the crisis isn't going away. The only path forward is a broker who understands the market, knows the carriers, and is willing to do the work that generalists won't.

× Financial Crime

The Embezzlement Epidemic Hiding in Plain Sight

One-sixth of all occupational fraud cases in the United States involve nonprofit organizations. The median loss is $76,000 — for religious and social service organizations, it's even higher at $85,000 or more. One-third of nonprofit fraud cases go undetected for more than two years. And in more than half of cases, the organization recovers nothing.

The typical nonprofit embezzler doesn't fit the profile most board members imagine. It's not a new hire with a criminal record. It's a trusted, long-tenured employee — someone who's been with the organization for years, who has gradually accumulated access to accounts, who processes donations, writes checks, reconciles bank statements, and handles payroll. The trust is earned over time, and the theft follows the trust.

Nonprofits are particularly vulnerable for structural reasons. Many operate with small administrative staffs where segregation of duties is impractical — the same person who opens the mail, records the donations, deposits the checks, and reconciles the bank statement. Board oversight of financial operations is often minimal. Audits, when they occur, may not include fraud-specific procedures. And the culture of trust that makes nonprofits effective at serving their missions also makes them susceptible to internal theft.

The schemes are remarkably consistent. Check tampering — writing unauthorized checks or altering payee information. Billing fraud — creating fictitious vendors and submitting invoices. Expense reimbursement fraud — inflating or fabricating business expenses. Payroll fraud — creating ghost employees or inflating hours. Skimming — taking cash donations before they're recorded. Each of these can operate undetected for years when internal controls are weak and board financial oversight is passive.

Employee dishonesty coverage — also called crime insurance or fidelity coverage — exists specifically for this exposure. A properly structured crime policy covers loss from employee theft, forgery, computer fraud, and funds transfer fraud. It can include coverage for volunteer dishonesty (critical for organizations where volunteers handle money), social engineering fraud (when someone is tricked into wiring funds to a fraudulent account), and third-party coverage for theft by contractors or service providers.

The problem is that many nonprofits either don't carry crime coverage at all, carry inadequate limits (a $25,000 policy against a $76,000 median loss), or have policies that exclude the specific schemes most commonly used to steal from nonprofits. Some policies exclude loss discovered more than a year after the theft occurred — which is useless when one-third of fraud goes undetected for over two years.

At PFTN, we build crime programs with limits calibrated to your actual financial throughput, discovery period provisions that reflect reality, and coverage that extends to volunteers and the specific fraud schemes nonprofits face. We also advise on the internal controls that reduce your exposure in the first place — because the best crime insurance is the one you never need to use.

× Volunteer Risk

Your Volunteers Aren't Covered the Way You Think

Most nonprofit leaders believe their volunteers are "covered" by the organization's insurance. It's a reasonable assumption — and it's wrong in at least three important ways.

Gap #1: Workers' compensation doesn't cover volunteers. In most states, workers' compensation insurance applies only to employees — people who receive monetary compensation for their labor. Volunteers, by definition, are not employees. If a volunteer is injured while serving your organization — a slip in the kitchen, a fall while building a Habitat house, a back injury moving furniture for an event — your workers' compensation policy doesn't respond. The volunteer has no wage replacement benefits, no medical coverage through your policy, and no clear path to recovery beyond suing your organization under general liability.

Volunteer accident medical insurance fills this gap. It provides medical expense coverage for volunteer injuries regardless of fault — typically with limits of $25,000 to $100,000 per occurrence. It's inexpensive (often $2–$5 per volunteer annually) and prevents the scenario where an injured volunteer's only option is a liability lawsuit against the organization they were trying to help.

Gap #2: Volunteer drivers create auto liability exposure. When volunteers use their personal vehicles for organizational purposes — delivering meals, transporting clients, driving to an event — they create hired and non-owned auto liability exposure for the nonprofit. If the volunteer causes an accident while on organizational business, the injured party can (and will) sue both the volunteer and the organization. Your nonprofit's general liability policy typically excludes auto-related claims. The volunteer's personal auto policy may have exclusions for commercial or organizational use. Without a hired and non-owned auto endorsement on your nonprofit's auto or liability policy, you have a gap.

The 15-passenger van is the sharpest edge of this exposure. These vehicles have a documented rollover risk that the NHTSA has issued warnings about. Nonprofits that transport clients, youth groups, or congregants in 15-passenger vans face a catastrophic liability exposure that requires specific attention — driver qualification, vehicle maintenance, passenger limits, and adequate insurance limits.

Gap #3: Volunteers can sue you like employees. The Federal Volunteer Protection Act provides limited liability protection for individual volunteers — not for the organization. And employment discrimination laws apply to volunteers in many contexts. A volunteer who is terminated from their role after reporting harassment can bring a retaliation claim. A volunteer who is denied opportunities based on age, race, or disability can bring a discrimination claim. Your EPLI policy needs to explicitly cover volunteer claims — and many standard forms don't.

The volunteer workforce is what makes the nonprofit sector extraordinary. Millions of people showing up to serve, without pay, because they believe in the mission. Your insurance program should honor that service by actually protecting the people who provide it.

× The Commodity Trap

Good Enough

The insurance industry has become a race to the bottom. Cheaper quotes. Faster binding. Less thinking. The brokers who win are the ones who process the most volume with the least friction. And the clients? They get what the system is optimized to produce: good enough.

Good enough coverage. Good enough service. Good enough until it isn't — until a claim lands and the gaps reveal themselves, and everyone discovers that "good enough" was actually "not nearly enough."

For nonprofits, the stakes are higher than most organizations realize. Your board members are personally exposed. Your volunteers are partially covered at best. Your donor data is a breach waiting to happen. Your youth programs sit at the intersection of the hardest insurance market in a generation. And your budget — always tight, always constrained — creates pressure to accept whatever the broker brings back, because asking questions costs time and time costs money you don't have.

This is the commodity trap, and it is perfectly designed to produce the worst possible outcome for mission-driven organizations. The broker treats your renewal like a transaction. The carrier treats your account like a number. And your organization — the one that exists to serve the vulnerable, to feed the hungry, to house the homeless, to educate the underserved — gets the same generic business insurance template that every other small entity receives.

But when you build an agency that treats advisory work as craft — when you approach each nonprofit's risk profile as unique, when you read the bylaws and understand the mission and walk the facilities — something different emerges. You see the exposures that the template misses. You ask the questions that the transaction skips. You build a program that doesn't just satisfy the "do we have insurance?" checkbox but actually protects the people and the purpose behind the organization.

At PFTN, we believe that the organizations doing the most important work in our communities deserve more than "good enough." They deserve insurance that is as intentional as their mission. And that starts with a broker who refuses to treat their protection as a commodity.

× Cyber Risk

Your Donor Database Is a Breach Waiting to Happen

Your donor management system contains exactly the information identity thieves are looking for: full names, home addresses, email addresses, phone numbers, employer information, donation history, and — if you process online gifts — payment card data. Some systems also store bank account numbers for recurring ACH donations. For healthcare nonprofits, add protected health information. For educational organizations, add student records covered by FERPA.

This data has value on the dark web. And most nonprofits protect it with the cybersecurity posture of a small retail shop — basic passwords, no multi-factor authentication, unpatched software, shared admin credentials, and IT managed by whoever on staff "knows computers."

When — not if — a breach occurs, the costs cascade immediately. Forensic investigation to determine the scope of the compromise: $200,000 to $500,000 for a significant breach. Legal counsel specializing in data breach notification: $100,000 to $300,000. Notification to affected individuals under 50 different state laws (each with its own timeline, content requirements, and penalties): $150,000 to $400,000. Credit monitoring services for affected donors: $100,000 to $250,000. Call center to handle donor inquiries: $50,000 to $150,000.

For a breach affecting 50,000 donor records — not an unreasonable number for a mid-sized nonprofit with a 20-year history — total first-party costs can reach $600,000 to $1.6 million. That's before any regulatory fines, class action litigation, or the immeasurable cost of donor trust destruction.

The average cost per breached record, according to IBM's annual study, is $165. A nonprofit with 10,000 donor records faces a potential breach cost of $1.65 million. The average annual cyber insurance premium for a nonprofit? Approximately $1,740.

Cyber insurance covers what happens after the breach: forensic investigation, breach counsel, notification, credit monitoring, regulatory defense, business interruption while systems are restored, and crisis communications. Some policies also cover ransomware payments (with appropriate OFAC screening), social engineering fraud, and funds transfer fraud — the latter being particularly relevant for nonprofits that process wire transfers for large gifts or grant disbursements.

The gap most nonprofits don't see: their donor management platform (Bloomerang, DonorPerfect, Salesforce Nonprofit Cloud, etc.) has its own cyber exposure. If the platform provider suffers a breach that compromises your donor data, your organization still has notification obligations — but your standard cyber policy may not cover "dependent business interruption" from a third-party vendor breach without specific endorsement.

At PFTN, we build cyber programs sized to your actual data footprint — not a generic small business template. We match coverage triggers to the specific threats nonprofits face: donor database breaches, business email compromise targeting finance staff, ransomware attacks on underfunded IT infrastructure, and social engineering fraud exploiting the trust-based culture that makes nonprofits work. Because the data your donors entrusted to you deserves protection that matches the trust they placed in your mission.

× IRS Compliance

Three Years and You're Gone

The Pension Protection Act of 2006 added a provision that most nonprofit leaders have never heard of but should fear: automatic revocation of tax-exempt status for failure to file Form 990 for three consecutive years. Not a warning. Not a penalty. Automatic revocation.

Since this provision took effect, the IRS has revoked the tax-exempt status of hundreds of thousands of organizations. Many of them didn't even know they had a filing requirement. Small nonprofits with gross receipts under $50,000 are required to file the e-Postcard (Form 990-N) — a simple electronic filing that takes minutes. But if nobody files it for three consecutive years, the result is identical to what happens to a $50 million foundation that misses its Form 990 deadline: automatic revocation.

The consequences of revocation cascade through every aspect of the organization's operations. Donations made after revocation are no longer tax-deductible for the donor — which means donors may stop giving entirely. Grants from foundations and government agencies typically require active tax-exempt status as a condition of funding — which means grant revenue stops. State charitable solicitation registrations may be suspended. And the organization itself may be subject to federal income tax on any income earned after revocation.

Reinstatement is possible but expensive. The organization must file Form 1023 or 1023-EZ (the original application for tax-exempt status), pay the applicable filing fee, and demonstrate that the failure was due to reasonable cause. Legal fees for reinstatement typically range from $5,000 to $20,000 depending on complexity. The IRS backlog for processing reinstatement applications can stretch to 6-12 months. During that period, the organization operates without confirmed tax-exempt status — a limbo that affects every donor relationship, every grant application, and every public solicitation.

No insurance policy covers the cost of losing your tax-exempt status. D&O insurance may cover defense costs if a board member is sued for the oversight failure that led to revocation, but it won't cover the lost donations, the withdrawn grants, or the legal fees to file for reinstatement. This is pure prevention territory.

The board's duty of obedience requires compliance with applicable laws — and IRS filing requirements are about as fundamental as it gets. At PFTN, we don't just build insurance programs. We help nonprofit boards understand the compliance landscape that determines whether their organization continues to exist. Because some risks can't be insured. They can only be prevented.

× Risk as Culture

When Insurance Becomes a Discipline

A captive insurance company puts the insured in the driver's seat. That's the standard elevator pitch, and it's true as far as it goes. But it doesn't go far enough — because the real transformation isn't financial. It's cultural.

When your organization funds its own first layer of risk, every person in the building has skin in the game. The program director isn't managing safety because the insurer requires it — they're managing safety because every claim comes directly out of the captive that their organization owns. The volunteer coordinator isn't screening volunteers because the policy demands it — they're screening because the cost of failure is internal, not abstract.

That shift in mindset changes everything. It changes how people think about facility safety. It changes how they supervise programs. It changes how they screen employees and volunteers. It changes how they respond to incidents. The risk isn't abstract anymore. It's owned.

For nonprofits managing complex, multi-program exposures — organizations operating shelters, youth programs, counseling services, food distribution, and community events all under one umbrella — a captive structure creates a feedback loop that traditional insurance never provides. When your claims experience directly affects your captive's profitability, and that profitability flows back to your organization as program funding, the incentive to prevent losses becomes visceral.

Group captives allow smaller nonprofits to participate in captive structures that would be economically impractical on their own. By pooling with other mission-driven organizations with similar risk profiles, individual nonprofits gain access to captive economics — underwriting profit, investment income, and actuarial control of reserves — while sharing the administrative infrastructure.

PFTN was the first firm in the Tennessee marketplace to introduce captive insurance solutions. We've designed and implemented every structure — group captives, cell captives, single-parent programs — for organizations across the spectrum, including nonprofits operating in complex, multi-program environments.

The real case for a captive isn't the premium savings or the investment income or the underwriting profit. It's the culture it creates. When your organization owns its risk, your people own it too. And for mission-driven organizations — organizations that exist because of culture, because of purpose, because of the belief that something matters enough to build an institution around it — that ownership is the most natural fit there is.

× Nonprofit Risk

The Volunteer File the SAM Underwriter Is Now Reading

The hardest line on most nonprofit insurance programs in 2026 is not the line most boards are watching. Directors and officers gets the headline. Cyber gets the news cycle. Property gets the renewal scrutiny.

Sexual abuse and molestation coverage — SAM — is where the actual market crisis is unfolding, and most missions are the last to see it.

Reported sexual abuse offenses increased more than 50 percent between 2020 and 2024 in the published government statistical data. Carriers responded the way carriers always respond to a frequency-and-severity event of that scale. Several standard markets exited the SAM line. Specialty and surplus-line carriers stepped in. Premiums on entry-level placements now run $2,000 to $5,000 minimum, and the underwriting requirement has tightened every quarter for three years.

Carriers are no longer asking for the application. They are asking for the file.

Background checks deeper than a single criminal-history pull. Reference checks, employment verification, behavior-based interview questions, refresh cadence. A one-time background check at intake is documentation. A continuous re-screening program is risk management.

A written code of conduct, signed by every staff member and volunteer, on file. Not a policy in the handbook. A signed acknowledgment, dated, on every individual file, with the prohibited conduct enumerated specifically. The mission that operates on a "we all know what is expected" culture is the mission that does not have the signed acknowledgment when the deposition asks for it.

Documented training, on a regular cadence, for every role with access to vulnerable populations. Annual at minimum. Role-specific. Tracked. Carriers are now embedding training resources into the SAM placement — and pricing the renewal against the documented completion rate.

Two-deep supervision and physical-environment controls. Open-door rules. Multi-adult ratios. No-isolation policies. Documented response protocols if a complaint comes in. Camera coverage where appropriate.

A complaint and response protocol that runs all the way through. Intake, investigation, mandatory-reporter compliance, board notification, and a documented retention policy on the complete file.

The mission of a faith-based organization, a youth-services nonprofit, a residential program, a foster care or shelter operator, an arts education program — every one of those missions exists to serve people who are, by definition, in some position of trust toward the staff and volunteers around them. The protection of that trust is the work, not just the insurance.

PFTN's approach to nonprofit risk was built for this kind of moment. Strategic Discovery starts with mission, program portfolio, populations served, and the actual operational reality of how volunteers and staff interact with those populations. Risk Assessment quantifies SAM form quality (not just SAM limits), retention period adequacy, training and screening documentation, complaint protocol enforcement, and the gap between what the mission actually does and what the underwriting file shows. Solution Design pairs the SAM placement with the D&O, the EPLI, the abuse-prevention training resources, and the practice infrastructure to keep the file current.

A signed code of conduct does not protect a child. A signed code of conduct, a trained staff, an enforced two-deep policy, a documented complaint protocol, and a real screening cadence — together — protect a child.

The mission deserves the discipline, not the autopilot.

× Data Privacy

The Donor-List Breach Is Now a Regulatory Event

The nonprofit donor list used to be the most jealously guarded document in the building. In 2026 it is the most regulated. Multiple state privacy laws, an active U.S. Supreme Court ruling on donor confidentiality, accelerating state attorney general enforcement, and the first wave of state data-breach notification laws that explicitly include nonprofits have moved the donor list from a fundraising asset into a regulatory exposure.

The federal headline is the U.S. Supreme Court's unanimous April 29, 2026 opinion in First Choice Women's Resource Centers, Inc. v. Davenport. The Court held that a nonprofit suffered an injury to its First Amendment right of association when a state attorney general subpoenaed donor identities — and that the nonprofit could challenge the subpoena immediately in federal court, rather than waiting through the state's enforcement process.

The default nonprofit assumption — that 501(c)(3) status carries an implicit privacy-law carve-out — was always wrong, and is now demonstrably wrong. Multiple state privacy laws cover nonprofits explicitly or by operational scope. Oregon AG enforcement of its state privacy law began July 1, 2026. The Oregon AG is no longer required to provide controllers with notice and opportunity to cure as of January 1, 2026 — meaning the AG can proceed directly to enforcement, including civil investigative demands and lawsuits.

Oklahoma's new nonprofit-applicable data breach notification law requires nonprofit notification to the state attorney general within sixty days when a breach affects 500 or more Oklahoma residents. The nonprofit that maintains donor data on residents in multiple states is now operating inside a fifty-jurisdiction notification regime with different timelines, thresholds, and content requirements in each.

The First Choice Women's Resource Centers ruling made the nonprofit's own donor-confidentiality policy — the data retention rules, the access controls, the response protocol for government demands — into a board governance artifact that the nonprofit's D&O underwriter is now going to ask about.

A nonprofit cyber policy that responds to ransomware encryption but does not respond to state AG notification, regulatory fine and penalty exposure, multistate breach counsel, donor credit monitoring, and First Amendment counsel — is a policy that was written for the 2022 environment.

Most nonprofit donor-data breaches in 2025 traced back to volunteer access, departing employee credentials, or contractor portals — not external attackers. The 2026 cyber underwriter is asking about access-revocation timeline for departing volunteers, MFA enforcement on donor management platforms, and the third-party vendor footprint that touches donor records.

PFTN's nonprofit approach treats the donor list the way the regulator treats it. Strategic Discovery surfaces the donor management platform, the data retention policy, the volunteer access protocol, the multistate footprint, and the government-demand response procedure. Risk Assessment quantifies the state-by-state notification exposure. Solution Design pairs the cyber tower with D&O and EPL programs. Ongoing Optimization keeps the policy current as the state privacy patchwork develops.

The donor list used to be a fundraising asset. In 2026 it is a regulatory event waiting to happen. The shift starts with one conversation — and preferably before the next state AG letter arrives.

— Ryan Mefford, President & Risk Advisor

× Governance

The Board Minute That Decided the D&O Claim

The nonprofit director who reads a D&O claim file for the first time always asks the same question. Where is the board minute that documents the decision? The defense attorney asks it. The carrier's coverage counsel asks it. The state attorney general's office asks it. The plaintiff's deposition outline asks it. By the time those four parties have asked the question, the answer has already decided the claim.

The 2026 nonprofit D&O environment has tightened in three measurable directions at once. Employment-related claims now make up roughly 60 percent of nonprofit D&O triggers — wrongful termination, discrimination, harassment, and constructive discharge. Legal defense costs alone routinely cross $100,000 before a case is resolved on the merits. The U.S. Supreme Court's April 29, 2026 unanimous opinion in First Choice Women's Resource Centers, Inc. v. Davenport has altered how state AG offices approach nonprofit governance investigations.

The contemporaneous documentation standard is not aspirational. It is contractual. The IRS Form 990 itself asks whether the organization has contemporaneous documentation of board and committee meeting minutes — and defines "contemporaneous" as the later of the next meeting or sixty days after the date of the meeting. The carrier's coverage attorney reads the Form 990 answer first. A "no" answer is a flag on the D&O file before the first claim ever lands.

The defense attorney will tell you that the strongest exhibits in a contested D&O claim are the board minutes that document a deliberate process — including any directors who dissented or abstained. The presence of a recorded dissent demonstrates a real deliberation. The absence of a dissent record on a unanimous-by-default minute is what plaintiffs use to argue rubber-stamp governance.

The nonprofit employment claim that triggers a D&O notice — termination, harassment investigation, executive compensation dispute — almost always traces back to a board or committee discussion that either did not happen, did not get recorded, or got summarized to the point where the file no longer reflects the deliberation. The defense in an employment-related D&O claim is the file. The exposure is the absence of the file.

The board's responsibility to document a defensible position on data retention, donor confidentiality, and response to government subpoenas is now part of the governance hygiene the next D&O underwriter will be reading against.

PFTN's nonprofit approach starts with the file. Strategic Discovery reviews the board calendar, the minute-taking cadence, the dissent-and-abstention practice, the executive session protocol, and the conflict-of-interest log. Risk Assessment quantifies the employment claim density and the volunteer governance overlap. Solution Design pairs the D&O tower with employment practices liability, fiduciary liability, and cyber liability. Ongoing Optimization keeps the governance file current.

The board minute that decided the D&O claim was written months before the claim landed. The shift starts with one conversation — and preferably before the next board meeting.

— Ryan Mefford, President & Risk Advisor

× International Programs

Foreign Liability Coverage for 2026 Nonprofit International Programs

A Knoxville nonprofit that sends a team abroad — a medical mission, a disaster-relief deployment, a partner clinic or school overseas — tends to assume the insurance program that protects it at home travels with the mission. For the most part, it does not. The general liability, auto, and workers compensation policies that answer a claim in Tennessee define their reach in ways that quietly stop at the water’s edge, and the volunteer injured in the field, the van rented on an unfamiliar road, or the staffer detained at a border can fall into a gap no one saw until the claim was filed.

The standard commercial general liability form reaches overseas only in narrow circumstances — a product manufactured in the United States, a suit arising from an executive’s occasional business travel — but it was never built for sustained work on foreign soil. IRMI draws the line plainly: a domestic policy contemplates incidental overseas exposure, while a permanent location, a recurring program, or an ongoing project abroad calls for a dedicated foreign liability policy. A nonprofit running a clinic in Honduras or a teaching partnership in Kenya has crossed from incidental to operational — and the policy language has not crossed with it.

A foreign package policy — often written as an international or global casualty program — bundles the exposures the domestic program leaves bare. Foreign commercial general liability answers bodily-injury and property claims arising from operations abroad. Foreign voluntary workers compensation responds when staff or volunteers are hurt overseas, where a U.S. state policy does not reach. Foreign hired and non-owned auto liability covers the vehicles a team drives in-country. And business travel accident coverage protects the people who carry the work. Each answers a question the domestic policy answers only at home.

The workers compensation gap is the one that surprises boards most. A Tennessee comp policy responds to injuries in Tennessee; an employee or volunteer hurt in the field overseas may find that nothing in the domestic program responds at all. Foreign voluntary compensation fills that void, extending the benefits an injured worker would have received at home and coordinating with local law and local medical systems. And where the overseas work touches a U.S. government contract, the Defense Base Act imposes its own workers compensation requirement by federal statute — a reminder that “overseas” is not one exposure but several, each with its own trigger.

The exposure that makes headlines is the one to people. Kidnap, ransom, and extortion coverage exists precisely because a mission that places staff in unstable regions places them in harm’s way — and the indemnity is only half of it. Carriers such as Chubb pair the coverage with crisis-response consultants who manage the event itself, which for most organizations is the part they could never handle alone. Detention, political evacuation, a serious medical emergency far from adequate care: these are low-frequency, high-consequence risks, and a board’s duty of care to its people does not pause at the border.

Here is the pattern that catches capable, well-run organizations. The declarations page looks complete, the premium is paid, and everyone assumes the coverage follows the mission as a matter of course. It does not follow automatically — it follows deliberately, through a foreign program arranged before the team departs rather than discovered after a claim is denied for want of territory. The Nonprofit Risk Management Center’s long-standing counsel — contemplate coverage against what the organization actually does, not against what it assumes it has — is exactly the discipline international work demands.

Cost discipline matters here too, but not the way a renewal spreadsheet suggests. A foreign package is rarely the largest line in a nonprofit budget; the expensive outcome is the uninsured claim, the evacuation funded from reserves, the program-year’s grant consumed by a single incident abroad. The intentional move is to price the protection deliberately against the real itinerary, not to discover its absence in the middle of a crisis nine time zones away.

This is the work of PFTN’s 4-Step Strategic Process. Strategic Discovery maps where your people actually go, what they do there, and which vehicles, facilities, and partners the mission relies on abroad. Risk Assessment measures those exposures against the territory limits and exclusions buried in your current program. Solution Design builds a foreign package — liability, voluntary compensation, auto, travel accident, and kidnap-ransom response — sized to the real work. Ongoing Optimization keeps the coverage current as programs open, partners change, and the map of where you serve continues to widen.

A nonprofit that sends its people into the world to do good should send them protected. Illuminating where the domestic policy ends, and carrying the coverage across the border with the mission, turns an overlooked gap into deliberate stewardship of the people who carry the work.

Sources: IRMI — Foreign Liability Coverage; Chubb — Global Casualty Insurance for U.S. Organizations (International Advantage); Chubb — International Travel Programs; IRMI — Kidnap and Ransom Insurance; Chubb — Kidnap/Ransom and Extortion Insurance; Nonprofit Risk Management Center — Contemplating Coverage: Insurance for Nonprofits

— Ryan Mefford, President & Risk Advisor

× Excess & Umbrella

Umbrella and Excess Liability Limits for Nonprofits in 2026

Most nonprofit boards think about liability limits once a year, at renewal, and mostly in terms of premium. The more useful question is rarely asked: if the worst plausible event happened tomorrow — a van carrying program participants in a highway crash, a serious injury at a fundraiser, an allegation that names the organization — would the limits actually stand between the mission and the balance sheet? For many nonprofits the honest answer is no, and the coverage designed to change that answer is the one they understand least: umbrella and excess liability.

Start with what the coverage is. An umbrella policy sits above a nonprofit’s primary layers — general liability, commercial auto, and often employer’s liability — and provides additional limit once a primary policy is exhausted. A true umbrella can also drop down to cover some claims the primary excludes; an excess policy, by contrast, follows the primary form exactly and simply adds limit on top. The distinction matters, because a board that believes it bought broad umbrella protection may actually hold a narrower excess follow-form policy that inherits every gap in the underlying coverage.

The exposures that pierce primary limits are not exotic. Auto liability is the most common — a nonprofit that transports clients, seniors, or youth is one serious crash away from a claim that exhausts a standard commercial auto limit and reaches into the umbrella. The fifteen-passenger van common in nonprofit transport carries its own well-documented rollover profile, and underwriters weigh it heavily. Special events, facilities open to the public, and abuse allegations are the others. Social inflation — the steady rise in jury awards and settlement values driven by litigation funding and shifting juror attitudes — has pushed severity upward across exactly these lines, which is precisely why the layer above the primary has become less optional.

That same severity trend is reshaping how the excess market prices and underwrites. Carriers have grown cautious about auto-heavy and abuse-exposed risks, and a nonprofit with a fleet of vans or a youth-serving program can find the excess layer scrutinized far more closely than its premium history would suggest. Underwriters now ask about driver screening, vehicle maintenance, abuse-prevention protocols, and event safety before they will put up limit — and a thin or disorganized submission can mean a higher attachment point, a lower available limit, or a decline.

The most consequential and least visible risk in the structure is the coverage gap between layers. An umbrella responds only over specific scheduled underlying policies, at specific required underlying limits. If the primary auto limit sits below what the umbrella requires, or a line the umbrella assumes — employer’s liability, hired and non-owned auto — is missing or underinsured beneath it, a gap opens exactly where a large claim travels. The organization discovers it when the primary is exhausted and the umbrella, reading its own schedule, declines to attach.

Deciding how much limit to carry is not guesswork, though it is often treated that way. The reference points are the organization’s real exposures — the passenger miles driven, the size and frequency of public events, the vulnerability of the population served — read against what comparable organizations carry and what a serious claim in the current environment actually costs. A youth-serving nonprofit with a transportation program and a large annual gala does not need the same tower as a small grantmaking foundation, and setting both at a default figure leaves one exposed and the other overpaying. The right limit is the product of a deliberate calculation, not a comfort level carried forward from a prior year.

This is the work of PFTN’s 4-Step Strategic Process. Strategic Discovery maps the exposures a large claim would actually travel through — the vehicles, the events, the populations, the contracts. Risk Assessment confirms the underlying limits and lines the umbrella requires are all in place and adequate, hunting the attachment gap before a claim finds it. Solution Design sets the limit against the organization’s real severity potential and structures the tower so the layers connect without a seam. Ongoing Optimization revisits the tower as programs grow, vehicles are added, and the litigation environment shifts.

Umbrella and excess liability is the quiet layer that does nothing in an ordinary year and everything in the worst one. For a nonprofit, whose assets are held in trust for a mission rather than owned by shareholders, the case for making that layer hold is not financial caution but fiduciary duty. Illuminating where the primary limits stop, and building the excess tower to carry the mission past that point, is how a board protects the work from the single event that would otherwise define it.

Sources: Risk Placement Services — 2026 Q2 Umbrella and Excess Market Update; IMA Financial Group — Property & Casualty Markets In Focus, Q2 2026; Aon — 2026 P&C Outlook: Navigating Volatility, Unlocking Growth; Alera Group — Why Is Umbrella Liability Getting So Expensive?; Risk & Insurance — P&C Market Enters Correction Phase With Significant Rate Relief; Brown & Brown — Umbrella & Excess Liability 2026 Market Trends Report

— Ryan Mefford, President & Risk Advisor

× Property & Casualty

Event Cancellation Insurance for Nonprofit Galas and Fundraisers in 2026

Your signature gala is the financial engine of your fiscal year. For many nonprofits, a single evening — the auction, the ticketed dinner, the sponsor tables — underwrites programs for the twelve months that follow. Yet the coverage most development directors reach for protects everyone in the room except the organization itself. General liability answers for a guest who slips on the ballroom floor; liquor liability responds when alcohol service goes wrong. Neither returns a dollar of the revenue you lose when the event cannot happen at all.

That gap is what event cancellation insurance exists to fill. It is a first-party coverage — it pays you, not a third party — for the money you have already spent and the money you were counting on collecting. The Nonprofit Risk Management Center frames event continuity as a core objective precisely because an event that fails to occur can spell financial disaster for the mission behind it. The discipline here is not about the party going smoothly. It is about what happens to your budget when it does not.

There are two distinct buckets of loss. The first is non-recoverable expenses — venue rent, deposits, production costs, catering contracts, and the vendor and sponsor obligations you have already irrevocably committed. The second is lost revenue: ticket sales, sponsorships, concessions, and the auction proceeds you projected. A subtle but consequential point, illuminated in recent litigation summarized by Hunton Andrews Kurth, is that lost profit is not automatically included — it must be explicitly stated in the policy schedule to be covered. What you do not name, you do not own.

The covered perils extend well beyond a rained-out afternoon. Severe weather — blizzards, hurricanes, windstorms, wildfire smoke — sits alongside venue loss, power and utility failure, civil unrest, and the absence of a key person, the keynote or headline performer whose non-appearance guts attendance. Aon's ASAE-endorsed Showstoppers program, for instance, extends automatic coverage of up to $100,000 for a speaker's non-appearance and, notably, responds to reduced attendance at an event that proceeds as scheduled — not only to a full cancellation. Disruption, not just cataclysm, is insurable.

Here is where 2026 diverges sharply from the world before 2020. Insurers classified COVID-19 as a "known event" in January 2020, and Risk & Insurance documents how the pandemic reframed the market: prices rose 50 to 100 percent, carriers exited, and communicable-disease exclusions became standard on all-cause policies. Business Insurance reports the practical result — the buy-back endorsements that once restored pandemic coverage are not expected to be offered for the foreseeable future, and per-risk capacity contracted from the $750 million-to-$1 billion range down to $300 million to $400 million, with rates doubling, tripling, or more. The lesson is not that the market is closed. It is that you should read the exclusion rather than assume the coverage.

Weather deserves its own attention, because before the pandemic it was the market's single largest exposure — and it has only grown louder. Lockton's contingency specialists catalog a punishing run of recent losses, including a single extreme-heat cancellation that drove a $46 million loss to the contingency market. Traditional adverse-weather extensions reimburse actual, proven loss. Increasingly, though, revenue-dependent organizers layer in parametric structures — coverage that pays a pre-agreed amount when a defined trigger, such as a rainfall threshold, is reached, often within hours rather than months, and that can respond to a partial hit like a 25 percent reduction in on-site spending. For a nonprofit whose net depends on day-of ticket and bar sales, that speed is runway.

Event cancellation is underwritten, not vended. Carriers want your submission early — pricing generally runs between roughly 0.5 and 3 percent of the insured event budget, and most insurers will not bind coverage within two weeks of the event date. The coverage should be secured when the significant financial commitments are made, not when the forecast turns. The organizations that underinsure their signature event tend to do so for a quiet reason: they measure the premium against the ticket price rather than against the hole a cancellation would tear in next year's programs. That is a false economy, and it is exactly the sort of hidden exposure a disciplined review is built to surface.

Bringing that exposure into the light is fiduciary work — the board's, the executive director's, and the development team's alike. At Peoples First, we approach it through our four-step Strategic Process: Strategic Discovery to understand what your event actually funds, Risk Assessment to quantify the expenses and revenue truly at stake, Solution Design to structure the right combination of expense, revenue, weather, and non-appearance coverage, and Ongoing Optimization to keep pace as your event — and the market — evolves. The torch is only useful if you carry it into the corners you would rather not look at. Your mission has earned that scrutiny; so has the evening that funds it.

Sources: Nonprofit Risk Management Center — Managing Special Event Risks; Risk & Insurance — Event Cancellation Debacles Will Have Insurers Reframing Coverage Terms for Years to Come; Business Insurance — Event Cancellation Coverage Sees Shakeup; Lockton — Weathering the Storm: Utilising Parametric Insurance to Tackle Event Cancellation; Hunton Andrews Kurth — Event Cancellation Insurance: Don't Shake (the Issues) Off; ProLink — If Your Biggest Event Didn't Happen, Would Your Non-Profit Survive?; ASAE / Aon — Showstoppers Event Cancellation Insurance; AAFRC — What Insurance Does a Nonprofit Fundraising Event Need?

— Ryan Mefford, President & Risk Advisor

× Active Assailant Coverage

Active Assailant Insurance for Nonprofit Facilities in 2026

A shooting on your premises is a loss your general liability policy was never built to answer. For a nonprofit — a youth program, a shelter, a free clinic, a house of worship, a community center — the exposure is not abstract. These are the very settings where people gather without screening, where doors stay open by design, and where a violent event does its damage in minutes and its financial harm for years. The coverage most organizations already own responds to a slip on a wet floor. It rarely responds to a deadly-weapon attack.

The gap is structural, not accidental. Property insurance is triggered by physical damage — and a shooting can devastate a building’s occupants while leaving the structure almost untouched, which means the property policy may never engage at all. General liability, meanwhile, increasingly carries an assault-and-battery exclusion, and often firearms or intentional-act exclusions alongside it. As industry analysts note, GL and property forms were never designed to address active-assailant events. What you assumed was covered is, on close reading, carved out.

Active assailant insurance — sometimes written as active shooter or deadly-weapon coverage — exists to fill that carve-out. It is largely first-party protection, meaning it pays the organization directly for the costs an ordinary liability policy ignores. Distinguished’s Lloyd’s-backed program, for example, extends up to $20 million per location and responds to firearms, explosives, vehicles used as weapons, bladed objects, and chemical attacks. The Mahoney Group notes these policies are sold in increments as small as $1 million and up to $100 million — scaled to the exposure, not to a one-size template.

What the coverage actually reaches is broader than most boards expect. It funds business interruption when a facility must close — loss of income, payroll, and rent, in some forms up to twelve months. It pays for demolition and reconstruction, and for the security upgrades that follow a tragedy: panic buttons, protective glass, additional guards. Critically for a mission-driven organization, it covers the human aftermath — medical expenses, psychiatric treatment and counseling for staff and program participants, funeral costs, and the crisis-management and public-relations fees that determine whether an organization’s reputation survives the week. Much of this responds even to the credible threat of an attack, not only to shots fired.

The frequency numbers deserve a clear-eyed reading rather than either alarm or dismissal. The FBI designated 24 active shooter incidents in 2024 across 19 states — a 50 percent decrease from the 48 recorded in 2023. That is genuine improvement. Yet the same reporting shows 223 incidents from 2020 through 2024, a 70 percent increase over the prior five-year period, and the FBI’s categories still include houses of worship among the settings struck. Across 2018 through 2022, the Bureau counted 211 incidents that killed 429 people and wounded 774. The trend line is bending down; the tail risk has not gone away.

The financial tail is what makes this a governance question rather than a line item. A single event can generate liability verdicts, uninsured rebuilding, and years of lost program revenue — the district that rebuilt Sandy Hook Elementary spent roughly $50 million, and the settlement following the 2017 Las Vegas attack reached $800 million. Harvard research cited by carriers estimates that firearm injuries cost private employers an estimated $535 million each year in lost revenue and productivity. For a nonprofit operating on restricted grants and a thin reserve, an uncovered event of that character is not a setback. It is an extinction event.

Two cautions belong in any honest review. First, these policies carry conditions — minimum victim thresholds before coverage attaches, and common exclusions for domestic violence and for certified terrorism, which a separate TRIA-backed placement addresses. Second, the market rewards preparation: underwriters have tightened terms since 2020 in response to higher claim frequency and larger verdicts, and they price organizations that can show threat-assessment plans, drills, and physical-security discipline more favorably. Demand, for its part, keeps climbing — one carrier reports roughly 25 percent year-over-year growth, making active assailant one of the fastest-growing lines in crisis management. The coverage is available; the question is whether your submission tells the story an underwriter needs.

That is precisely the work a disciplined process is built to surface. At Peoples First, we bring this exposure into the light through our four-step Strategic Process — Strategic Discovery to map where and how your people gather, Risk Assessment to quantify what a violent event would actually cost your mission, Solution Design to structure first-party limits and sublimits against those numbers, and Ongoing Optimization to keep pace as your programs and the market both move. The torch is only useful if you carry it into the corners you would rather not examine. This is one of them — and the organizations that look now own the answer before they need it.

Sources: FBI — 2024 Active Shooter Incidents in the United States Report; Distinguished — Active Assailant Insurance: A Guide for Brokers; The Mahoney Group — Demand Rising for Active Shooter Insurance Coverage; Omnilert — Active Assailant Insurance: Coverage, Costs and Risk Reduction; Founder Shield — Active Shooter Coverage: What Is It and Who Should Consider; WTW — TRIA, Standalone Terrorism and Active Assailant Coverage; Marsh — Active Assailant Coverage.

— Ryan Mefford, President & Risk Advisor

× Management Liability

Media and Personal Injury Liability for Nonprofit Advocacy and Communications in 2026

Most nonprofit leaders picture liability as something physical — a slip on the sidewalk, a fender bender in the program van, a volunteer who trips carrying boxes. Those exposures are real, but they are not the ones a mission-driven organization generates most often. The modern nonprofit is, functionally, a publisher. It runs a website, sends newsletters, campaigns for policy change, names names in advocacy, and turns dozens of staff and volunteers loose on social media in its name. Every one of those acts is speech — and speech, not the sidewalk, is where reputational and financial injury increasingly begins.

Your commercial general liability policy anticipates part of this. Coverage A responds to bodily injury and property damage; Coverage B — personal and advertising injury — responds to a narrower, more modern set of harms. The standard ISO form enumerates seven offenses: false arrest or detention; malicious prosecution; wrongful eviction or invasion of privacy relating to a dwelling; oral or written publication that libels or slanders a person or organization; publication that violates a person’s right of privacy; use of another’s advertising idea in your advertisement; and infringement of another’s copyright, trade dress, or slogan in your advertisement. Read that list against what your communications team actually does and the overlap is immediate — a blog post that accuses a bad-acting landlord, an appeal that borrows a photograph, a campaign that echoes a rival organization’s tagline.

The value of Coverage B is that it triggers on the duty to defend, which is broad. A single plausible allegation of disparagement can obligate your carrier to defend an entire suit, even where the core claim would otherwise fall outside the policy. That is leverage worth understanding. The danger is assuming that breadth is the whole story — because the exclusions are where the coverage quietly narrows.

Three gaps deserve particular attention. First, standard Coverage B reaches intellectual property only inside advertising — copyright, trade dress, and slogan in your advertisement. Patent and trademark infringement, and copyright disputes outside that advertising context — the newsletter, the research report, the reposted video — are typically excluded or unaddressed. Second, most forms carry a media and internet-type business exclusion: where publishing or content is understood to be your business rather than incidental to it, Coverage B can be stripped of the very offenses you most need. A nonprofit newsroom, a policy institute, a content-heavy advocacy group can find itself outside the coverage it assumed it held. Third, Coverage B excludes knowing violations — material published with knowledge of its falsity, or infringement committed willfully. The protection is built for the honest mistake, not the deliberate act.

This is where a dedicated media or multimedia liability policy earns its place. Where communications are central to the mission — where you investigate, publish, curate, or campaign at scale — a purpose-built media form closes the gaps CGL leaves open: broader intellectual property, content beyond advertising, and defense costs sized to the exposure rather than incidental to it. The question is rarely whether Coverage B exists; it almost always does. The question is whether it was designed for an organization that merely advertises, or for one that publishes.

The exposure also lives at the seams between policies, and those seams are easy to miss. A defamation claim aimed at the board or executive director for organizational statements can implicate directors and officers liability, not general liability — the two coverages must be read together, not in isolation. A privacy claim arising from a donor photo, a client story, or a data incident can straddle media liability and cyber, and a poorly coordinated program leaves the loss falling into the gap between them. The discipline is not buying more policies; it is mapping which policy answers which allegation before the allegation arrives.

Insurance, though, is the backstop — not the first line. The organizations that surface this exposure early manage it through controls, not only coverage. That means a real social media policy that governs staff and volunteers rather than assuming their good judgment; a clearance habit for images, music, and quotations before publication rather than after a demand letter; an approval path for advocacy content that names or characterizes others; and clear ownership of who speaks for the organization online. These are not constraints on the mission — they are what protect it.

At Peoples First Tennessee, this terrain is precisely what our four-step strategic process is built to work. Strategic Discovery surfaces how your organization actually communicates — the channels, the volunteers, the content. Risk Assessment illuminates where Coverage B ends and where media, cyber, and D&O must carry the load. Solution Design crafts the program to fit the way you publish, not a generic template. And Ongoing Optimization keeps that program current as your voice, your platforms, and your reach evolve. The aim is straightforward: to give a mission that depends on being heard the confidence to speak.

Sources: Nonprofit Risk Management Center — 5 Steps to Effectively Managing Social Media Risk; Nonprofits Insurance Alliance — Understanding Nonprofit Insurance Coverages; IPWatchdog — How Commercial General Liability Policies’ ’Coverage B’ Can Help Mitigate IP Losses; Thomson Reuters Practical Law — Commercial General Liability Insurance Policies: Personal and Advertising Injury Coverage (Coverage B); Crane Agency — When Words Cost Millions: Media Liability Insurance in the Digital Age; Skyward Insurance — Media Liability Insurance is Crucial for Non-Media Organizations; Cerini & Associates — Insurance Outlook for the Non-Profit Sector in 2026

— Ryan Mefford, President & Risk Advisor