Transcript
Welcome to the nonprofit compliance brief, where we explain charitable solicitation and multi-state fundraising requirements in clear, practical terms for nonprofit leaders and finance teams. This podcast is produced by Ironwood Registrations. It is It's really great to be here today. Yeah, I want to start off with a scenario that I think Well, I know, it keeps a lot of executive directors and board treasurers awake at night. >> Oh, yeah, there's plenty of those. >> Right. It's this gap between feeling financially secure and actually having to prove it to the rest of the world. Because you know the feeling, you've got your QuickBooks totally reconciled, every single receipt is in its correct folder, and you know for an absolute fact that you haven't stolen a dime. You know, you're honest. Exactly. You are an honest person, but then you realize that the state government, they don't know you at all. To them, you aren't this this passionate, mission-driven leader. You're literally just a tax ID number that's asking their residents for money. That is the perfect setup for this, because there is There's just this massive disconnect between your internal confidence and external validation. Yeah. >> Internally, you know the money is safe. But externally, that honesty has to be translated into a very specific format that a stranger, uh specifically a regulator or maybe a major donor, can actually trust without ever having to meet you face-to-face. And that translation process is expensive. Which is the tension we're unpacking today. We're doing a deep dive into the three tiers of financial reporting. So, that's the compilation, the review, and the audit. >> Right. And our goal here isn't just to spit out textbook definitions. I mean, anyone can just go Google what an audit is. >> Exactly. We want to identify the actual triggers. When do you, as a growing nonprofit, actually need to spend the hard-earned money to move up that ladder? Because getting this wrong usually ends in one of two pretty bad ways. >> Yeah, you either waste thousands of dollars on an audit you didn't actually need. >> Which hurts. >> It hurts a lot. Or you get slapped with hefty fines for failing to file one that you did need. And I think there's a third risk there, too, which is just missed opportunity. If you treat financial reporting as just, you know, homework that the state gives you, you're missing the strategic piece. It's really about permission. It's about unlocking that next level of fundraising. >> Precisely. So, let's get right into the mechanics of this hierarchy. Because it is a ladder, and you generally start right at the bottom with a compilation. Okay, so looking at the technical definitions for a compilation, it's described as having no assurance. Which, I got to be honest, that sounds completely useless. If I'm paying a CPA good money, why am I getting absolutely no assurance? >> sound like a terrible deal when you phrase it exactly like that. But you have to think of a compilation as essentially professional formatting. >> Professional formatting. >> Right. When you're a really small organization, maybe you're entirely volunteer-run, or you just have one or two part-time staff members, your internal records might be Well, they might be a bit messy. >> Like a shoe box of receipts. Exactly, the shoe box. You've got bank statements over here, donor logs in a spreadsheet over there. A compilation is simply where you hand all that raw data to an accountant, and they organize it into generally accepted accounting principles, or GAAP. So, they're basically just translating your shoe box into a language that a bank or a board member can actually read and understand. >> Right. But, and this is the critical part to remember, they are not fact-checking you. Oh, okay. >> tell the accountant, "Hey, we have $50,000 in specialized equipment," they just write down $50,000 in equipment. They do not drive out to your office to see if the equipment is actually sitting in the room. They just take your word for it. >> Totally. They don't call the bank to see if the cash is actually in the account. >> So, it's essentially a selfie. You're holding the camera, you're taking the picture, and the CPA is really just putting a nice little frame around it. That is a phenomenal way to put it. Yes, it's a selfie. It relies completely on management's integrity. And for a startup nonprofit, that is usually enough for this state. But obviously, as you get bigger, a selfie stops being acceptable proof of your financial health. A stranger is going to want more than that. Exactly. Which brings us to the next step. Right. So, let's say we grow. We aren't just doing local bake sales anymore, we're landing grants, we're crossing state lines with our campaigns. We hit that midsize tier. This is where the financial review comes in. How is a review actually different from just a slightly better-formatted compilation? So, this is the first significant jump in compliance. A review offers what the industry calls limited assurance. The accountant isn't just typing in your numbers blindly anymore. They're now performing what we call analytical procedures. And see, analytical procedures is one of those classic accounting terms that just immediately glazes people's eyes over. What does that actually look like in practice for the listener? >> Fair enough. Think of it as a sanity check on the relationships between your numbers. Let's say your donor revenue doubled from last year, but your fundraising expenses stayed exactly the same. Which would be amazing. It would be a miracle. But to an accountant, that looks weird. It's an anomaly. So, in a review, the CPA is required to sit down and ask you, "Hey, how did you manage to raise twice as much money without spending a single extra dollar on ads or events?" So, they're actively looking for things that just don't smell right. >> Exactly. They're looking at trends, they're looking at ratios year over year. They still aren't verifying every single tiny transaction, but they are looking at the whole forest to make sure the trees are planted in logical places. Like if you say you have massive cash reserves sitting there, but you're reporting zero interest income. Right. They are absolutely going to ask you why that is. But they still aren't calling the bank directly to check the balance. Generally, no. In a review, they are mostly querying management. They're asking you to explain the anomalies. They aren't going behind your back to verify your answers with third parties just yet. Which naturally brings us to the big one. The A word. The audit. This is the thing everyone tries to avoid because of the sheer cost and the disruption to the team. If the review is a sanity check, what is the audit? The audit is the gold standard. Because it moves entirely away from just questioning management to actually testing management. The auditor's explicit job is to verify that the financial statements are free from material misstatement. And to do that properly, they have to be skeptical. >> Skeptical meaning they don't believe a word I say. >> Skeptical meaning they require independent proof for what you say. In an audit, they perform something called positive confirmation. What's that? >> literally send a physical letter or an email to your major donors saying, "Did you really give $50,000 to this specific charity on this date?" >> Oh, wow. >> Yeah. And they will contact your bank directly to get the exact cash balance. They are entirely bypassing you to get the absolute truth. I can see why that makes finance directors sweat. That's highly intrusive. And it isn't just about catching math errors, is it? It's about control. It's heavily about control. They actively test your internal controls. They want to know, is it physically possible for the CEO to write a check to himself without anyone else on the board knowing? And if it is, if your systems are weak like that, even if you haven't actually committed any fraud, the auditor will flag in their report that you were at a high risk for fraud. So, to recap the three tiers, compilation is basically formatting, review is analyzing trends and asking questions, audit is independent third-party verification. >> You got it. Now, the million-dollar question, and I mean it literally for some of these organizations, is why. Why can't I just stay at the review level forever? If I'm fundamentally honest, why do I need to pay 15 or 20,000 dollars for an audit just to prove it to strangers? It always comes down to who is actually reading the report. You basically have four main audiences as a nonprofit. >> Okay. You have the regulators, which are the state officials overseeing charities. >> Yeah. You have grant makers, like big foundations. You have your own board of directors. And you have the general public. >> Right. >> As your organization grows, the inherent risk to the public grows with it. >> Yeah. If a tiny local charity mismanages $5,000, it's really sad, but it isn't a systemic, economy-wide issue. But if a huge charity mismanages $5 million, that is a front-page headline. That destroys trust in the entire nonprofit sector. So, the state requires the audit essentially as an insurance policy to protect public trust. Correct. And grant makers require it for strict risk management. A major foundation is not going to hand you a six-figure check if they can't be 100% certain that you have the internal controls to manage that money properly. They need that independent verification before they wire the funds. This leads us directly to the trickiest part of the data we've been looking at. We call it the state factor. Because I think a lot of leaders naturally assume this is an IRS rule. Like, "Oh, once I hit a million dollars in revenue, the IRS says I legally need an audit." And that is easily the most common myth we have to bust. The IRS actually does not require an audit for you to file your Form 990 generally. You can totally file a 990 with just a compilation. Really? So, who is forcing the issue? The audit requirements are almost entirely triggered by state charitable solicitation laws. And since we have 50 states, I'm going to assume we have 50 completely different sets of rules. You guessed it. It is an absolute patchwork. And this is exactly where the multi-state trap just snaps shut on well-meaning organizations. Walk us through that trap. How does an organization actually fall into it? Because no one tries to mess this up on purpose. >> No, they don't. So, imagine you are based in a state with a very high threshold for an audit. Or maybe your home state has no audit requirement at all for your specific size. Okay, let's say I'm raising $600,000 a year local. >> Perfect. You feel great, you're compliant, you're just paying for a review every year. But then, your team decides to run a big digital fundraising campaign for year-end. You send out thousands of emails, you run targeted Facebook ads, and you end up legally registering to solicit in a state like Mississippi or Pennsylvania. And those specific states have different rules than my home state. Much stricter rules. Suddenly, just because you are actively soliciting donors in their state, you are subject to their specific audit threshold. Wait, explain that nuance. Because if I only raise a tiny bit of money, let's say 5,000 bucks in a really strict state, do I still have to pay to audit my entire organization? Yes. And this is exactly the part that feels so unfair to people when they first hear it. >> It does sound unfair. The state basically says, "If you want the privilege of asking our residents for money, and your total overall organization is of a certain size, say you're over 500,000 or 750,000 dollars in total revenue, we demand to see a full audit of your whole organization." So, you could technically be forced to spend 20,000 dollars on a full audit simply because you registered in a state where you only raised 3,000 bucks. >> Yes. We see it happen all the time. It's the accidental audit. You upgraded your fundraising strategy to go national because the internet makes it easy, but you completely forgot to upgrade your compliance budget to match that ambition. That is a massive gotcha. It implies that before you launch that shiny end of year email blast or push that Venmo link on social media, you really need to sit down and look at the map. >> You have to. You need to forecast not just how much money you're going to raise, but geographically where you are asking for it. And there's another little detail here that catches people off guard, gross versus net. >> Oh, right, the gross versus net distinction. Some states look at gross revenue, some look at just the contributions. What is the practical difference in this context? So, total revenue includes everything. That's your program service fees, ticket sales for your gala, investment income, government contracts. Contributions are just the straight donations from the public. >> Right. Some states only care about how much you actively fundraised from donors. Other states care about the size of your total pie. Hmm. So, if you have a massive government contract or tons of program revenue, you might look really big to one state and immediately trigger an audit, even if your actual public donations are tiny. This just feels like an absolute minefield. If I'm a listener right now, I'm thinking, "Okay, I need to be incredibly proactive about this." What is the actual strategic move here? How do we stop treating this as a massive panic moment every December? The winning strategy is to briefly decouple your fundraising brain from your compliance brain, and then intentionally reintroduce them. You simply cannot plan a major fundraising drive without calculating the associated compliance cost. It's the step up cost. >> Exactly, the step up cost. If you are hovering right under a state's audit threshold, let's say the threshold is 500,000 dollars, and you are currently projecting 490,000. >> Okay. Pushing hard to raise that extra 15,000 dollars is actually going to cost you money if it triggers a mandatory 20,000 dollar audit fee that you weren't planning for. You end up financially in the red on that specific growth. That is a wild thought. Growth can temporarily make your organization poorer if you don't plan for the back-end infrastructure cost. >> In the short term, yes, it absolutely can. But, and this is the major pivot we need to make in how we think about this, long term, intentionally staying small just to avoid paying for an audit is terrible strategy. >> Because you are artificially capping your own potential. Right. We really need to reframe the audit. Throughout this whole conversation, we've kind of been talking about it as a burden, a cost, this annoying compliance hoop you have to jump through. >> Which is how most people see it. >> True. But in the modern marketplace of philanthropy, an audit is a credential. Explain that. How does an expensive audit actually help me raise more money? Major donors, large family foundations, and big corporate sponsors are all actively looking for stability. When they see audited financial statements attached to your grant proposal, it instantly signals maturity. It sets you apart from mom and pop shops. It tells them, "We are a professional outfit. We have strict internal controls. We are a safe bet." It effectively de-risks their major donation. It's almost like the old blue check mark on social media back when that actually meant something. It verifies that you are legit. >> Exactly. And it helps your board of directors sleep at night, too. Board members have a strict fiduciary duty. If embezzlement happens on their watch, they are legally liable. An audit is their absolute best tool for ensuring management is doing things right. So, you shouldn't fight it. No, instead of fighting it, use it. Market it to your donors. Say, "We are an audited, fully transparent organization." I think we need to dive a little deeper into the actual timing of this whole process. Yeah. >> Because I feel like that is where the practical application falls apart for most teams. You mentioned positive confirmation earlier, the auditor literally waiting for your donors to write them back. That sounds incredibly slow. >> It is incredibly slow. This is not something you can just rush through at the last minute. I've seen organizations land a massive grant in late December, but the grant agreement strictly requires audited financials by January 31st. Oh, no. >> Right, if they haven't already started the audit process months ago, they are in serious trouble. >> Because the auditors are just too busy to take them on. Well, yes, auditors are completely swamped during tax season. Mhm. But even beyond their schedule, the actual process of testing your internal controls, verifying your physical assets, and sending out those confirmations and waiting for replies, that takes weeks, sometimes several months. If you are moving from a review to an audit for the very first time, you need to be actively talking to your CPA in June or July for a fiscal year that ends in December. So, you're talking 6 months out. >> At least 6 months. You need to budget for the actual fee, obviously, but you also desperately need to prepare your own staff. Right, because they have to do all the legwork. An audit takes a huge amount of time away from your finance team's daily work. They have to pull random document samples, answer endless auditor questions, and dig up invoices from 9 months ago. It is a massive resource drain. That naturally brings me back to the shoebox analogy we used at the start. If an audit is basically a forensic investigation of your books, the state of your daily records must directly impact the final cost of the audit. >> Drastically. It is a one-to-one correlation. If your records are clean, if everything is filed correctly, reconciled monthly, and well documented, the auditor can move incredibly fast. The billable hours stay low. And if it's a mess? If you hand them a messy shoebox, they have to spend hours and hours untangling it before they can even audit it. And they might even have to issue what's called a qualified opinion. >> A qualified opinion? What does that mean in plain English? It basically means the auditor puts a note on your report saying, "We audited them, but we couldn't actually verify everything because their internal records were too bad." And I imagine a qualified opinion is the exact opposite of what you want to show that major donor we were talking about. >> Definitely not what you want. You are aiming for an unqualified opinion. That is the clean bill of health you want to market. I want to quickly circle back to the multi-state trap for a second, because I feel like this is the specific area where the landscape is shifting the most rapidly for our listeners. With everyone moving to online fundraising, Venmo, PayPal, GoFundMe, it feels like physical borders matter less and less for asking for money, but they matter more than ever for compliance. That is the ultimate paradox of modern fundraising. The internet has completely erased borders for asking, but the law has aggressively reinforced borders for reporting. There is a legal concept called nexus. Nexus. >> Right. If you have a nexus in a state, which can sometimes be established just by repeatedly emailing people in that state to ask for money, you are now fully under their jurisdiction. And some states are notoriously strict about this. We mentioned Mississippi and Pennsylvania earlier. Are there other big ones that typically trip people up? New York is a huge one. Yeah. Florida, California. These are very populous, wealthy states, so naturally nonprofits want to fundraise there. Makes sense. But they also have incredibly robust consumer protection divisions. They are aggressively looking out for their res