A clearer starting point.

Policies & procedures

Required or conditionally required

Public disclosure. Follow IRC §6104 procedures for public inspection and copies of covered exemption materials and annual returns, subject to applicable exceptions. Copies generally are due immediately for in-person requests and within 30 days for written requests; qualifying online availability can satisfy copying obligations, not eliminate inspection duties. See IRS Public Disclosure Requirements.

Federal-award financial procedures. Recipients and subrecipients subject to 2 CFR Part 200 need effective financial controls, written payment procedures under §200.305 and written allowable-cost procedures under Subpart E. Section 200.303 also requires reasonable cybersecurity and protected-information safeguards, not necessarily a standalone cybersecurity policy. See 2 CFR §§200.302–200.305.

Federal-award procurement. Covered recipients and subrecipients need documented procurement procedures and written conflict standards addressing real or apparent conflicts, exclusion of conflicted decision-makers, contractor gifts and disciplinary consequences. Qualifying parent, affiliate or subsidiary relationships also trigger written organizational-conflict standards under 2 CFR §200.318.

Federal-award compensation. Employee compensation charged to an award must conform to an established written policy applied consistently to federal and nonfederal activities and have appropriate supporting records. See 2 CFR §200.430.

Employment protections and notices. Title VII, ADA and GINA generally cover private employers with at least 15 employees; ADEA generally begins at 20. Covered charities must follow applicable nondiscrimination and accommodation duties and display the applicable EEOC notice; this is not a universal handbook mandate. See EEOC coverage guidance, ADA guidance and the EEOC poster.

Minimum-wage notice. Employers with employees covered by the FLSA must display its notice conspicuously; nonprofit status alone does not determine coverage. See the DOL FLSA poster requirements.

FMLA administration. Private employers generally become covered at 50 employees for 20 workweeks in the current or preceding calendar year; elementary and secondary schools have separate coverage regardless of size. Employee eligibility ordinarily requires 12 months’ employment, 1,250 service hours and 50 employees within 75 miles. Covered employers must post the general notice and, if they have eligible employees, include it in existing handbooks or leave materials, or provide it to new hires if none exist; triggered eligibility, rights-and-responsibilities and designation notices generally follow five-business-day rules. See DOL coverage and 29 CFR §825.300 notice guidance.

Emergency action plans. When another OSHA standard requires a plan, §1910.38 requires reporting, evacuation, critical-operation, employee-accounting, rescue/medical and contact procedures, employee review and evacuation-assistance training. Keep the plan written and available at the workplace; employers with 10 or fewer employees may communicate it orally. See OSHA’s emergency action plan standard.

Recommended best practices

Governance and financial controls. Boards should use annual interest disclosures, transaction-specific recusal, disinterested approval and minutes; compensation review should use independent reviewers, comparable data and contemporaneous documentation. Treasurers should document spending limits, reimbursement evidence, separate payment approval from reconciliation, and arrange independent review when staffing is limited. See IRS governance guidance.

Complaints and records. For directors, staff and volunteers, establish confidential reporting routes outside implicated supervisory lines, nonretaliation protections and investigation responsibility. Adopt record-category retention periods, secure disposal and preservation holds for litigation or investigations; Form 990 governance questions alone do not mandate written policies. See IRS governance guidance.

Personnel conduct. Give employees, supervisors and volunteers clear harassment, reporting, accommodation-request, confidentiality and escalation procedures, supported by onboarding. See EEOC practical guidance.

Data handling. Organizations handling donor, employee or volunteer information should minimize collection, restrict access, use multifactor authentication, protect backups and assign incident-response responsibility. NIST cybersecurity basics supplies practical recommendations, not a universal legal mandate.

Scope and limitations

Coverage. Federal baseline for 501(c)(3) public charities using supplied research through November 9, 2026. State/local formation and solicitation, private foundations, Form 990-T, detailed schedules, payroll filings and specialized operations require separate review; no future-effective change is established here.

Policies & procedures

Required or conditionally required

Employment records and complaints. Employers covered by Colorado’s Anti-Discrimination Act must preserve personnel and employment records for at least five years after the later of creation or receipt, the relevant personnel action, or final disposition of a discrimination charge or related action. C.R.S. § 24-34-408 also requires a repository of oral and written discrimination complaints recording the date, complainant unless anonymous, alleged perpetrator, and substance; these are recordkeeping duties administered by the Colorado Civil Rights Division, not a blanket written-policy mandate. See the signed POWR Act.

Paid sick leave. Colorado employers, regardless of size and subject to statutory exceptions, must administer HFWA leave, generally accruing one hour per 30 hours worked up to 48 hours annually. Provide individual written information and a workplace notice explaining leave rights, retaliation protection, and complaint rights; employers requiring reasonable notice for foreseeable leave must communicate those procedures through a written policy. CDLE administers C.R.S. §§ 8-13.3-403, -408 and -409; see HFWA guidance.

FAMLI notices. Employers participating in the state FAMLI program must post the official Program Notice, give it individually at hire, and provide it again within five days after learning of a potentially qualifying event. These are notice duties under C.R.S. § 8-13.3-511, not a requirement to create a handbook policy; follow the FAMLI Division’s May 2026 employer instructions (secondary context).

Pregnancy accommodations. Employers covered by C.R.S. § 24-34-402.3 must give new employees written notice of accommodation rights and post it conspicuously. Upon an applicant’s or employee’s request, engage in a timely, good-faith interactive process and provide reasonable accommodation absent undue hardship; see the enacted law and Civil Rights Commission rules.

Personal-information disposal and security. Charities maintaining documents containing Colorado residents’ statutory personal identifying information must adopt a written disposal policy requiring destruction when no longer needed, unless retention is legally required, so information becomes unreadable or indecipherable. C.R.S. §§ 6-1-713 and -713.5 also require reasonable security and appropriate service-provider safeguards, subject to qualifying regulated-entity alternatives explained in the Attorney General’s guidance.

Breach response. Under C.R.S. § 6-1-716, investigate suspected breaches promptly and apply notification requirements, generally including affected residents within 30 days after determining a breach occurred and the Attorney General when at least 500 Colorado residents are affected. This is a required response process, not an express standalone written-plan mandate; consult the Attorney General’s breach guidance.

Privacy procedures. Nonprofits meeting Colorado Privacy Act coverage criteria need privacy disclosures, consumer-rights procedures, sensitive-data consent, and applicable risk assessments under C.R.S. §§ 6-1-1303–1309. Assess coverage using the Attorney General’s CPA guidance; nonprofit status alone does not establish exemption.

Minors’ online data. Separate provisions apply without ordinary volume or revenue thresholds to controllers offering online services to consumers they actually know, or willfully disregard, are minors. C.R.S. §§ 6-1-1308.5 and -1309.5 require reasonable care, specified consent controls, and documented assessment, review, and mitigation where heightened risk exists; see SB24-041.

Recommended best practices

Complaint handling. Employers should establish accessible reporting channels, prompt investigations, corrective action, and supervisor training coordinated with the complaint repository. Prevention and response programs also matter to the supervisor-harassment affirmative defense described in the POWR Act.

Data-handling workflow. Charities handling donor, client, employee, or volunteer information should inventory sensitive data, restrict access, train users, review vendors, coordinate disposal with retention duties, and rehearse breach response. See the Attorney General’s Data Security Best Practices.

Scope and limitations

Coverage. This Colorado reference uses supplied research through November 9, 2026. Federal filings and policies, payroll accounts, local requirements, foreign qualification, property-tax exemptions, and specialized programs require separate review; entity-specific deadlines control.