January 23, 2025 - When it comes to establishing best practices for not-for-profit organizations, there are many issues you’ll want to look at and be certain to address. In the second article in our Governance Best Practices for Not-for-Profit Organizations Series, we examine why it’s important to have a good document retention and destruction policy in place. Please watch for additional articles in our series, coming soon, which cover topics such as: crafting a mission statement, executive compensation, the purpose of a governing body, conflicts of interest, and establishing a whistleblower policy.

The federal Sarbanes-Oxley legislation imposes criminal liability on not-for-profits (NFPs) and other organizations for the destruction of records with the intent to obstruct a federal investigation. However, it would be unrealistic to expect an organization to retain every document it receives or generates in perpetuity. Aside from that, NFPs may commonly find themselves in possession of extremely sensitive data ranging from a donor’s credit card information to a student’s financial aid application with excerpts from a personal tax filing. Proper document management procedures are essential to avoid potential leaks of information that could harm an NFP’s reputation or violate the law. Adopting a document retention policy ensures that staff and volunteers follow consistent guidance about document retention and that document destruction/deletion becomes a routine business practice of the organization.

The policy should identify the responsibilities of staff, volunteers, board members, and others for maintaining and documenting the retention, storage, and destruction of the organization’s documents and records. An effective policy will outline which documents must be kept permanently and which documents should be destroyed after the lapse of set periods of time. In developing the policy, consideration should be given to laws impacting the retention of certain types of documents such as payroll matters, tax filings, and documents involving minors.

It is important that the policy will apply not only to paper documents but also digital files, so those responsible for overseeing the NFP’s information technology systems should be involved in developing and implementing the process for protecting and managing electronic files in accordance with the policy. For example, when electronic data is being destroyed, it is critical to choose a deletion method that ensures data cannot be recovered. Simple methods of deletion often leave traces of the file after the process has been completed – a business-grade deletion tool should be used to ensure that data is permanently deleted and cannot be recovered.

An NFP’s Form 990 asks whether the organization had a written document retention and destruction policy during the tax year. To answer ”Yes,“ the organization’s governing body must have adopted the policy no later than the last day of the tax year. No further descriptions regarding the policy are required.

While it is important to remember that a document retention and destruction policy is not required by the IRS to obtain or maintain exempt status, an NFP that has adopted such a policy is putting its best foot forward in the eyes of its many stakeholders. If you work with an NFP in an oversight capacity, be sure to take some time each year to review the policies that are currently in place, consider updating them as your organization matures, and if any of these policies are not in place, consider adding them.

If you have any questions, please reach out to your Citrin Cooperman advisor. Our Not-For-Profit Industry Practice will work with your organization to ensure the best policies and procedures are in place to support future growth and success.

An important note on governance issues

Not-for-profit organizations (NFPs) face scrutiny from a multitude of perspectives – the Internal Revenue Service (IRS), the legislature, watchdog organizations, donors, news media, and the states in which they operate. Because the annual information return (Form 990) filed by most NFPs is readily available on the internet, these stakeholders have easy access to data about an organization’s operations which they can use to make judgements about it. The first line of defense is the establishment of good governance practices which are regularly followed.

Although the federal tax laws do not require the adoption of any particular policies or procedures, it is essential for an NFP to carefully consider which governance practices are most appropriate to enable the organization to operate in an effective and compliant manner. Additionally, since the Form 990 discloses information about a number of governance-related items, not only have they become the de facto best practices for NFPs, there will be many data points from which readers of the form can draw conclusions about the organization.

Therefore, it is not only crucial for an NFP to establish good governance practices, it must also prepare its Form 990 while disclosing these practices effectively. This series explores the key governance areas disclosed in the Form 990 and highlights important considerations for not-for-profit organizations.