Your Mission Deserves Better Protection.

× Board Liability

The Unpaid Board Member's $35,000 Problem

Here is a number that should concern every nonprofit board member in America: $35,000. That's the average cost to resolve a directors and officers liability claim against a nonprofit. And if that sounds manageable, consider this: one in ten D&O claims exceeds $100,000. The claims don't distinguish between paid executives and volunteer board members who donate their time, their expertise, and their professional reputation.

Most nonprofit board members believe they're protected by incorporation. They think the corporate structure shields their personal assets. It doesn't — at least not completely. Incorporation protects against many forms of organizational liability, but it does not eliminate personal liability for breaches of fiduciary duty.

Nonprofit directors carry three fiduciary duties. The duty of care requires exercising the same level of attention a reasonably prudent person would in similar circumstances — attending meetings, reviewing financial statements, asking questions about significant decisions. The duty of loyalty prohibits self-dealing, conflicts of interest, and using the organization's resources for personal benefit. The duty of obedience requires ensuring the organization complies with its bylaws, its stated charitable purpose, and applicable laws.

A board member who misses meetings, rubber-stamps financial reports without review, or fails to ask about a related-party transaction can be held personally liable for breach of the duty of care or loyalty. A board that allows the executive director to use restricted grant funds for unrestricted purposes violates the duty of obedience. A board that fails to file Form 990 for three consecutive years triggers automatic revocation of tax-exempt status — and the personal tax liability implications can flow to responsible persons.

And then there's the exposure most board members never consider: payroll tax liability. If your nonprofit fails to deposit or remit payroll taxes, the IRS can assess a Trust Fund Recovery Penalty against any "responsible person" — which includes board members who had authority over financial decisions. This is personal liability. It attaches to the individual, not the organization. It survives bankruptcy.

Charitable immunity once provided a broad shield. Today, most states have eliminated or severely limited charitable immunity statutes. The Federal Volunteer Protection Act provides some protection for volunteers, but only against ordinary negligence — not gross negligence, not willful misconduct, and not actions taken outside the scope of the volunteer's responsibilities. It's a narrow shield, and relying on it is a gamble.

D&O insurance exists to close this gap. A properly structured nonprofit D&O policy provides three layers of protection: Side A covers individual directors and officers when the organization cannot or will not indemnify them (the most critical layer for unpaid board members). Side B reimburses the organization when it does indemnify its directors. Side C (entity coverage) protects the organization itself for claims brought directly against it.

The problem is that most nonprofits either don't carry D&O coverage at all, carry inadequate limits, or have policies with exclusions that gut the protection when it matters most. Employment practices claims — which account for 95% of nonprofit D&O claims — may be excluded or sublimited. IRS compliance claims may trigger a regulatory exclusion. Prior acts may not be covered if the retroactive date was set incorrectly.

At PFTN, we structure D&O programs specifically for nonprofit boards. We verify that Side A coverage is adequate to protect personal assets. We ensure employment practices are covered — not excluded. We review retroactive dates, prior knowledge exclusions, and regulatory defense provisions. Because the people who volunteer to lead your organization shouldn't have to risk their homes to do it.

× Abuse Coverage

The SAM Coverage Crisis No One Is Solving

The sexual abuse and molestation (SAM) insurance market is broken. Not stressed. Not hardening. Broken.

Here are the numbers: 87.5% of insurance brokers report that carriers are restricting coverage or reducing limits for improper sexual conduct insurance — up from 77% just five years ago. 70.5% of brokers report that carriers are non-renewing entire classes of nonprofit organizations regardless of claims history. California alone has seen abuse insurance premiums climb from $114 million in 2019 to $490 million in 2025, driven by extended statutes of limitations that opened decades-old claims. The Boy Scouts of America compensation fund exceeded $7 billion.

For youth-serving nonprofits, religious institutions, residential programs, camps, and any organization that works with vulnerable populations, these aren't abstract market statistics. They're the reality of your next renewal.

The crisis has two dimensions. The first is availability: carriers are leaving the market entirely for high-risk classes. Residential child welfare agencies, overnight camps, and organizations with any history of abuse claims — even decades old — face genuine coverage gaps. Some organizations are being forced into the excess and surplus lines market, where coverage is more expensive and terms are less favorable. Others are going without coverage entirely, which is an existential risk for organizations serving minors.

The second dimension is underwriting requirements. 94% of carriers now require defined abuse prevention practices before they'll issue a quote — up from 82% three years ago. 88% require formal monitoring and supervision policies. Carriers want to see background checks on every person with access to vulnerable populations. They want two-adult rules prohibiting one-on-one unsupervised contact with minors. They want documented training programs, clear reporting procedures, and — increasingly — third-party accreditation from organizations like Praesidium or Stewards Trust.

These requirements aren't unreasonable. They're the minimum standard of care for organizations working with children and vulnerable adults. But they represent a significant operational and financial investment that many smaller nonprofits struggle to implement, especially when they're already operating on thin margins.

The retroactive date issue compounds the problem. SAM policies typically have a retroactive date — a cutoff before which abuse allegations are not covered. If your organization has been operating for 30 years but your current policy has a retroactive date of five years ago, any abuse alleged to have occurred before that date falls into an uninsured gap. Extended reporting period riders can address some of this exposure, but they're expensive and increasingly difficult to obtain. For organizations with legacy exposure — and in an era of extended statutes of limitations, that's most of them — the retroactive date is the single most important provision in the policy.

At PFTN, we specialize in navigating the SAM market for nonprofits. We know which carriers are still writing coverage for each risk class. We understand the underwriting requirements and help organizations implement the prevention programs that make them insurable. We fight for retroactive dates that reflect your actual operating history, not the carrier's convenience. And we structure programs that coordinate SAM coverage with your general liability and umbrella policies to eliminate gaps between layers.

This market isn't going to fix itself. The claims environment that created the crisis isn't going away. The only path forward is a broker who understands the market, knows the carriers, and is willing to do the work that generalists won't.

× Financial Crime

The Embezzlement Epidemic Hiding in Plain Sight

One-sixth of all occupational fraud cases in the United States involve nonprofit organizations. The median loss is $76,000 — for religious and social service organizations, it's even higher at $85,000 or more. One-third of nonprofit fraud cases go undetected for more than two years. And in more than half of cases, the organization recovers nothing.

The typical nonprofit embezzler doesn't fit the profile most board members imagine. It's not a new hire with a criminal record. It's a trusted, long-tenured employee — someone who's been with the organization for years, who has gradually accumulated access to accounts, who processes donations, writes checks, reconciles bank statements, and handles payroll. The trust is earned over time, and the theft follows the trust.

Nonprofits are particularly vulnerable for structural reasons. Many operate with small administrative staffs where segregation of duties is impractical — the same person who opens the mail, records the donations, deposits the checks, and reconciles the bank statement. Board oversight of financial operations is often minimal. Audits, when they occur, may not include fraud-specific procedures. And the culture of trust that makes nonprofits effective at serving their missions also makes them susceptible to internal theft.

The schemes are remarkably consistent. Check tampering — writing unauthorized checks or altering payee information. Billing fraud — creating fictitious vendors and submitting invoices. Expense reimbursement fraud — inflating or fabricating business expenses. Payroll fraud — creating ghost employees or inflating hours. Skimming — taking cash donations before they're recorded. Each of these can operate undetected for years when internal controls are weak and board financial oversight is passive.

Employee dishonesty coverage — also called crime insurance or fidelity coverage — exists specifically for this exposure. A properly structured crime policy covers loss from employee theft, forgery, computer fraud, and funds transfer fraud. It can include coverage for volunteer dishonesty (critical for organizations where volunteers handle money), social engineering fraud (when someone is tricked into wiring funds to a fraudulent account), and third-party coverage for theft by contractors or service providers.

The problem is that many nonprofits either don't carry crime coverage at all, carry inadequate limits (a $25,000 policy against a $76,000 median loss), or have policies that exclude the specific schemes most commonly used to steal from nonprofits. Some policies exclude loss discovered more than a year after the theft occurred — which is useless when one-third of fraud goes undetected for over two years.

At PFTN, we build crime programs with limits calibrated to your actual financial throughput, discovery period provisions that reflect reality, and coverage that extends to volunteers and the specific fraud schemes nonprofits face. We also advise on the internal controls that reduce your exposure in the first place — because the best crime insurance is the one you never need to use.

× Volunteer Risk

Your Volunteers Aren't Covered the Way You Think

Most nonprofit leaders believe their volunteers are "covered" by the organization's insurance. It's a reasonable assumption — and it's wrong in at least three important ways.

Gap #1: Workers' compensation doesn't cover volunteers. In most states, workers' compensation insurance applies only to employees — people who receive monetary compensation for their labor. Volunteers, by definition, are not employees. If a volunteer is injured while serving your organization — a slip in the kitchen, a fall while building a Habitat house, a back injury moving furniture for an event — your workers' compensation policy doesn't respond. The volunteer has no wage replacement benefits, no medical coverage through your policy, and no clear path to recovery beyond suing your organization under general liability.

Volunteer accident medical insurance fills this gap. It provides medical expense coverage for volunteer injuries regardless of fault — typically with limits of $25,000 to $100,000 per occurrence. It's inexpensive (often $2–$5 per volunteer annually) and prevents the scenario where an injured volunteer's only option is a liability lawsuit against the organization they were trying to help.

Gap #2: Volunteer drivers create auto liability exposure. When volunteers use their personal vehicles for organizational purposes — delivering meals, transporting clients, driving to an event — they create hired and non-owned auto liability exposure for the nonprofit. If the volunteer causes an accident while on organizational business, the injured party can (and will) sue both the volunteer and the organization. Your nonprofit's general liability policy typically excludes auto-related claims. The volunteer's personal auto policy may have exclusions for commercial or organizational use. Without a hired and non-owned auto endorsement on your nonprofit's auto or liability policy, you have a gap.

The 15-passenger van is the sharpest edge of this exposure. These vehicles have a documented rollover risk that the NHTSA has issued warnings about. Nonprofits that transport clients, youth groups, or congregants in 15-passenger vans face a catastrophic liability exposure that requires specific attention — driver qualification, vehicle maintenance, passenger limits, and adequate insurance limits.

Gap #3: Volunteers can sue you like employees. The Federal Volunteer Protection Act provides limited liability protection for individual volunteers — not for the organization. And employment discrimination laws apply to volunteers in many contexts. A volunteer who is terminated from their role after reporting harassment can bring a retaliation claim. A volunteer who is denied opportunities based on age, race, or disability can bring a discrimination claim. Your EPLI policy needs to explicitly cover volunteer claims — and many standard forms don't.

The volunteer workforce is what makes the nonprofit sector extraordinary. Millions of people showing up to serve, without pay, because they believe in the mission. Your insurance program should honor that service by actually protecting the people who provide it.

× The Commodity Trap

Good Enough

The insurance industry has become a race to the bottom. Cheaper quotes. Faster binding. Less thinking. The brokers who win are the ones who process the most volume with the least friction. And the clients? They get what the system is optimized to produce: good enough.

Good enough coverage. Good enough service. Good enough until it isn't — until a claim lands and the gaps reveal themselves, and everyone discovers that "good enough" was actually "not nearly enough."

For nonprofits, the stakes are higher than most organizations realize. Your board members are personally exposed. Your volunteers are partially covered at best. Your donor data is a breach waiting to happen. Your youth programs sit at the intersection of the hardest insurance market in a generation. And your budget — always tight, always constrained — creates pressure to accept whatever the broker brings back, because asking questions costs time and time costs money you don't have.

This is the commodity trap, and it is perfectly designed to produce the worst possible outcome for mission-driven organizations. The broker treats your renewal like a transaction. The carrier treats your account like a number. And your organization — the one that exists to serve the vulnerable, to feed the hungry, to house the homeless, to educate the underserved — gets the same generic business insurance template that every other small entity receives.

But when you build an agency that treats advisory work as craft — when you approach each nonprofit's risk profile as unique, when you read the bylaws and understand the mission and walk the facilities — something different emerges. You see the exposures that the template misses. You ask the questions that the transaction skips. You build a program that doesn't just satisfy the "do we have insurance?" checkbox but actually protects the people and the purpose behind the organization.

At PFTN, we believe that the organizations doing the most important work in our communities deserve more than "good enough." They deserve insurance that is as intentional as their mission. And that starts with a broker who refuses to treat their protection as a commodity.

× Cyber Risk

Your Donor Database Is a Breach Waiting to Happen

Your donor management system contains exactly the information identity thieves are looking for: full names, home addresses, email addresses, phone numbers, employer information, donation history, and — if you process online gifts — payment card data. Some systems also store bank account numbers for recurring ACH donations. For healthcare nonprofits, add protected health information. For educational organizations, add student records covered by FERPA.

This data has value on the dark web. And most nonprofits protect it with the cybersecurity posture of a small retail shop — basic passwords, no multi-factor authentication, unpatched software, shared admin credentials, and IT managed by whoever on staff "knows computers."

When — not if — a breach occurs, the costs cascade immediately. Forensic investigation to determine the scope of the compromise: $200,000 to $500,000 for a significant breach. Legal counsel specializing in data breach notification: $100,000 to $300,000. Notification to affected individuals under 50 different state laws (each with its own timeline, content requirements, and penalties): $150,000 to $400,000. Credit monitoring services for affected donors: $100,000 to $250,000. Call center to handle donor inquiries: $50,000 to $150,000.

For a breach affecting 50,000 donor records — not an unreasonable number for a mid-sized nonprofit with a 20-year history — total first-party costs can reach $600,000 to $1.6 million. That's before any regulatory fines, class action litigation, or the immeasurable cost of donor trust destruction.

The average cost per breached record, according to IBM's annual study, is $165. A nonprofit with 10,000 donor records faces a potential breach cost of $1.65 million. The average annual cyber insurance premium for a nonprofit? Approximately $1,740.

Cyber insurance covers what happens after the breach: forensic investigation, breach counsel, notification, credit monitoring, regulatory defense, business interruption while systems are restored, and crisis communications. Some policies also cover ransomware payments (with appropriate OFAC screening), social engineering fraud, and funds transfer fraud — the latter being particularly relevant for nonprofits that process wire transfers for large gifts or grant disbursements.

The gap most nonprofits don't see: their donor management platform (Bloomerang, DonorPerfect, Salesforce Nonprofit Cloud, etc.) has its own cyber exposure. If the platform provider suffers a breach that compromises your donor data, your organization still has notification obligations — but your standard cyber policy may not cover "dependent business interruption" from a third-party vendor breach without specific endorsement.

At PFTN, we build cyber programs sized to your actual data footprint — not a generic small business template. We match coverage triggers to the specific threats nonprofits face: donor database breaches, business email compromise targeting finance staff, ransomware attacks on underfunded IT infrastructure, and social engineering fraud exploiting the trust-based culture that makes nonprofits work. Because the data your donors entrusted to you deserves protection that matches the trust they placed in your mission.

× IRS Compliance

Three Years and You're Gone

The Pension Protection Act of 2006 added a provision that most nonprofit leaders have never heard of but should fear: automatic revocation of tax-exempt status for failure to file Form 990 for three consecutive years. Not a warning. Not a penalty. Automatic revocation.

Since this provision took effect, the IRS has revoked the tax-exempt status of hundreds of thousands of organizations. Many of them didn't even know they had a filing requirement. Small nonprofits with gross receipts under $50,000 are required to file the e-Postcard (Form 990-N) — a simple electronic filing that takes minutes. But if nobody files it for three consecutive years, the result is identical to what happens to a $50 million foundation that misses its Form 990 deadline: automatic revocation.

The consequences of revocation cascade through every aspect of the organization's operations. Donations made after revocation are no longer tax-deductible for the donor — which means donors may stop giving entirely. Grants from foundations and government agencies typically require active tax-exempt status as a condition of funding — which means grant revenue stops. State charitable solicitation registrations may be suspended. And the organization itself may be subject to federal income tax on any income earned after revocation.

Reinstatement is possible but expensive. The organization must file Form 1023 or 1023-EZ (the original application for tax-exempt status), pay the applicable filing fee, and demonstrate that the failure was due to reasonable cause. Legal fees for reinstatement typically range from $5,000 to $20,000 depending on complexity. The IRS backlog for processing reinstatement applications can stretch to 6-12 months. During that period, the organization operates without confirmed tax-exempt status — a limbo that affects every donor relationship, every grant application, and every public solicitation.

No insurance policy covers the cost of losing your tax-exempt status. D&O insurance may cover defense costs if a board member is sued for the oversight failure that led to revocation, but it won't cover the lost donations, the withdrawn grants, or the legal fees to file for reinstatement. This is pure prevention territory.

The board's duty of obedience requires compliance with applicable laws — and IRS filing requirements are about as fundamental as it gets. At PFTN, we don't just build insurance programs. We help nonprofit boards understand the compliance landscape that determines whether their organization continues to exist. Because some risks can't be insured. They can only be prevented.

× Risk as Culture

When Insurance Becomes a Discipline

A captive insurance company puts the insured in the driver's seat. That's the standard elevator pitch, and it's true as far as it goes. But it doesn't go far enough — because the real transformation isn't financial. It's cultural.

When your organization funds its own first layer of risk, every person in the building has skin in the game. The program director isn't managing safety because the insurer requires it — they're managing safety because every claim comes directly out of the captive that their organization owns. The volunteer coordinator isn't screening volunteers because the policy demands it — they're screening because the cost of failure is internal, not abstract.

That shift in mindset changes everything. It changes how people think about facility safety. It changes how they supervise programs. It changes how they screen employees and volunteers. It changes how they respond to incidents. The risk isn't abstract anymore. It's owned.

For nonprofits managing complex, multi-program exposures — organizations operating shelters, youth programs, counseling services, food distribution, and community events all under one umbrella — a captive structure creates a feedback loop that traditional insurance never provides. When your claims experience directly affects your captive's profitability, and that profitability flows back to your organization as program funding, the incentive to prevent losses becomes visceral.

Group captives allow smaller nonprofits to participate in captive structures that would be economically impractical on their own. By pooling with other mission-driven organizations with similar risk profiles, individual nonprofits gain access to captive economics — underwriting profit, investment income, and actuarial control of reserves — while sharing the administrative infrastructure.

PFTN was the first firm in the Tennessee marketplace to introduce captive insurance solutions. We've designed and implemented every structure — group captives, cell captives, single-parent programs — for organizations across the spectrum, including nonprofits operating in complex, multi-program environments.

The real case for a captive isn't the premium savings or the investment income or the underwriting profit. It's the culture it creates. When your organization owns its risk, your people own it too. And for mission-driven organizations — organizations that exist because of culture, because of purpose, because of the belief that something matters enough to build an institution around it — that ownership is the most natural fit there is.

× Nonprofit Risk

The Volunteer File the SAM Underwriter Is Now Reading

The hardest line on most nonprofit insurance programs in 2026 is not the line most boards are watching. Directors and officers gets the headline. Cyber gets the news cycle. Property gets the renewal scrutiny.

Sexual abuse and molestation coverage — SAM — is where the actual market crisis is unfolding, and most missions are the last to see it.

Reported sexual abuse offenses increased more than 50 percent between 2020 and 2024 in the published government statistical data. Carriers responded the way carriers always respond to a frequency-and-severity event of that scale. Several standard markets exited the SAM line. Specialty and surplus-line carriers stepped in. Premiums on entry-level placements now run $2,000 to $5,000 minimum, and the underwriting requirement has tightened every quarter for three years.

Carriers are no longer asking for the application. They are asking for the file.

Background checks deeper than a single criminal-history pull. Reference checks, employment verification, behavior-based interview questions, refresh cadence. A one-time background check at intake is documentation. A continuous re-screening program is risk management.

A written code of conduct, signed by every staff member and volunteer, on file. Not a policy in the handbook. A signed acknowledgment, dated, on every individual file, with the prohibited conduct enumerated specifically. The mission that operates on a "we all know what is expected" culture is the mission that does not have the signed acknowledgment when the deposition asks for it.

Documented training, on a regular cadence, for every role with access to vulnerable populations. Annual at minimum. Role-specific. Tracked. Carriers are now embedding training resources into the SAM placement — and pricing the renewal against the documented completion rate.

Two-deep supervision and physical-environment controls. Open-door rules. Multi-adult ratios. No-isolation policies. Documented response protocols if a complaint comes in. Camera coverage where appropriate.

A complaint and response protocol that runs all the way through. Intake, investigation, mandatory-reporter compliance, board notification, and a documented retention policy on the complete file.

The mission of a faith-based organization, a youth-services nonprofit, a residential program, a foster care or shelter operator, an arts education program — every one of those missions exists to serve people who are, by definition, in some position of trust toward the staff and volunteers around them. The protection of that trust is the work, not just the insurance.

PFTN's approach to nonprofit risk was built for this kind of moment. Strategic Discovery starts with mission, program portfolio, populations served, and the actual operational reality of how volunteers and staff interact with those populations. Risk Assessment quantifies SAM form quality (not just SAM limits), retention period adequacy, training and screening documentation, complaint protocol enforcement, and the gap between what the mission actually does and what the underwriting file shows. Solution Design pairs the SAM placement with the D&O, the EPLI, the abuse-prevention training resources, and the practice infrastructure to keep the file current.

A signed code of conduct does not protect a child. A signed code of conduct, a trained staff, an enforced two-deep policy, a documented complaint protocol, and a real screening cadence — together — protect a child.

The mission deserves the discipline, not the autopilot.

× Data Privacy

The Donor-List Breach Is Now a Regulatory Event

The nonprofit donor list used to be the most jealously guarded document in the building. In 2026 it is the most regulated. Multiple state privacy laws, an active U.S. Supreme Court ruling on donor confidentiality, accelerating state attorney general enforcement, and the first wave of state data-breach notification laws that explicitly include nonprofits have moved the donor list from a fundraising asset into a regulatory exposure.

The federal headline is the U.S. Supreme Court's unanimous April 29, 2026 opinion in First Choice Women's Resource Centers, Inc. v. Davenport. The Court held that a nonprofit suffered an injury to its First Amendment right of association when a state attorney general subpoenaed donor identities — and that the nonprofit could challenge the subpoena immediately in federal court, rather than waiting through the state's enforcement process.

The default nonprofit assumption — that 501(c)(3) status carries an implicit privacy-law carve-out — was always wrong, and is now demonstrably wrong. Multiple state privacy laws cover nonprofits explicitly or by operational scope. Oregon AG enforcement of its state privacy law began July 1, 2026. The Oregon AG is no longer required to provide controllers with notice and opportunity to cure as of January 1, 2026 — meaning the AG can proceed directly to enforcement, including civil investigative demands and lawsuits.

Oklahoma's new nonprofit-applicable data breach notification law requires nonprofit notification to the state attorney general within sixty days when a breach affects 500 or more Oklahoma residents. The nonprofit that maintains donor data on residents in multiple states is now operating inside a fifty-jurisdiction notification regime with different timelines, thresholds, and content requirements in each.

The First Choice Women's Resource Centers ruling made the nonprofit's own donor-confidentiality policy — the data retention rules, the access controls, the response protocol for government demands — into a board governance artifact that the nonprofit's D&O underwriter is now going to ask about.

A nonprofit cyber policy that responds to ransomware encryption but does not respond to state AG notification, regulatory fine and penalty exposure, multistate breach counsel, donor credit monitoring, and First Amendment counsel — is a policy that was written for the 2022 environment.

Most nonprofit donor-data breaches in 2025 traced back to volunteer access, departing employee credentials, or contractor portals — not external attackers. The 2026 cyber underwriter is asking about access-revocation timeline for departing volunteers, MFA enforcement on donor management platforms, and the third-party vendor footprint that touches donor records.

PFTN's nonprofit approach treats the donor list the way the regulator treats it. Strategic Discovery surfaces the donor management platform, the data retention policy, the volunteer access protocol, the multistate footprint, and the government-demand response procedure. Risk Assessment quantifies the state-by-state notification exposure. Solution Design pairs the cyber tower with D&O and EPL programs. Ongoing Optimization keeps the policy current as the state privacy patchwork develops.

The donor list used to be a fundraising asset. In 2026 it is a regulatory event waiting to happen. The shift starts with one conversation — and preferably before the next state AG letter arrives.

— Ryan Mefford, President & Risk Advisor

× Governance

The Board Minute That Decided the D&O Claim

The nonprofit director who reads a D&O claim file for the first time always asks the same question. Where is the board minute that documents the decision? The defense attorney asks it. The carrier's coverage counsel asks it. The state attorney general's office asks it. The plaintiff's deposition outline asks it. By the time those four parties have asked the question, the answer has already decided the claim.

The 2026 nonprofit D&O environment has tightened in three measurable directions at once. Employment-related claims now make up roughly 60 percent of nonprofit D&O triggers — wrongful termination, discrimination, harassment, and constructive discharge. Legal defense costs alone routinely cross $100,000 before a case is resolved on the merits. The U.S. Supreme Court's April 29, 2026 unanimous opinion in First Choice Women's Resource Centers, Inc. v. Davenport has altered how state AG offices approach nonprofit governance investigations.

The contemporaneous documentation standard is not aspirational. It is contractual. The IRS Form 990 itself asks whether the organization has contemporaneous documentation of board and committee meeting minutes — and defines "contemporaneous" as the later of the next meeting or sixty days after the date of the meeting. The carrier's coverage attorney reads the Form 990 answer first. A "no" answer is a flag on the D&O file before the first claim ever lands.

The defense attorney will tell you that the strongest exhibits in a contested D&O claim are the board minutes that document a deliberate process — including any directors who dissented or abstained. The presence of a recorded dissent demonstrates a real deliberation. The absence of a dissent record on a unanimous-by-default minute is what plaintiffs use to argue rubber-stamp governance.

The nonprofit employment claim that triggers a D&O notice — termination, harassment investigation, executive compensation dispute — almost always traces back to a board or committee discussion that either did not happen, did not get recorded, or got summarized to the point where the file no longer reflects the deliberation. The defense in an employment-related D&O claim is the file. The exposure is the absence of the file.

The board's responsibility to document a defensible position on data retention, donor confidentiality, and response to government subpoenas is now part of the governance hygiene the next D&O underwriter will be reading against.

PFTN's nonprofit approach starts with the file. Strategic Discovery reviews the board calendar, the minute-taking cadence, the dissent-and-abstention practice, the executive session protocol, and the conflict-of-interest log. Risk Assessment quantifies the employment claim density and the volunteer governance overlap. Solution Design pairs the D&O tower with employment practices liability, fiduciary liability, and cyber liability. Ongoing Optimization keeps the governance file current.

The board minute that decided the D&O claim was written months before the claim landed. The shift starts with one conversation — and preferably before the next board meeting.

— Ryan Mefford, President & Risk Advisor