A clearer starting point.

Policies & procedures

Required or conditionally required

Public disclosure. Follow IRC §6104 procedures for public inspection and copies of covered exemption materials and annual returns, subject to applicable exceptions. Copies generally are due immediately for in-person requests and within 30 days for written requests; qualifying online availability can satisfy copying obligations, not eliminate inspection duties. See IRS Public Disclosure Requirements.

Federal-award financial procedures. Recipients and subrecipients subject to 2 CFR Part 200 need effective financial controls, written payment procedures under §200.305 and written allowable-cost procedures under Subpart E. Section 200.303 also requires reasonable cybersecurity and protected-information safeguards, not necessarily a standalone cybersecurity policy. See 2 CFR §§200.302–200.305.

Federal-award procurement. Covered recipients and subrecipients need documented procurement procedures and written conflict standards addressing real or apparent conflicts, exclusion of conflicted decision-makers, contractor gifts and disciplinary consequences. Qualifying parent, affiliate or subsidiary relationships also trigger written organizational-conflict standards under 2 CFR §200.318.

Federal-award compensation. Employee compensation charged to an award must conform to an established written policy applied consistently to federal and nonfederal activities and have appropriate supporting records. See 2 CFR §200.430.

Employment protections and notices. Title VII, ADA and GINA generally cover private employers with at least 15 employees; ADEA generally begins at 20. Covered charities must follow applicable nondiscrimination and accommodation duties and display the applicable EEOC notice; this is not a universal handbook mandate. See EEOC coverage guidance, ADA guidance and the EEOC poster.

Minimum-wage notice. Employers with employees covered by the FLSA must display its notice conspicuously; nonprofit status alone does not determine coverage. See the DOL FLSA poster requirements.

FMLA administration. Private employers generally become covered at 50 employees for 20 workweeks in the current or preceding calendar year; elementary and secondary schools have separate coverage regardless of size. Employee eligibility ordinarily requires 12 months’ employment, 1,250 service hours and 50 employees within 75 miles. Covered employers must post the general notice and, if they have eligible employees, include it in existing handbooks or leave materials, or provide it to new hires if none exist; triggered eligibility, rights-and-responsibilities and designation notices generally follow five-business-day rules. See DOL coverage and 29 CFR §825.300 notice guidance.

Emergency action plans. When another OSHA standard requires a plan, §1910.38 requires reporting, evacuation, critical-operation, employee-accounting, rescue/medical and contact procedures, employee review and evacuation-assistance training. Keep the plan written and available at the workplace; employers with 10 or fewer employees may communicate it orally. See OSHA’s emergency action plan standard.

Recommended best practices

Governance and financial controls. Boards should use annual interest disclosures, transaction-specific recusal, disinterested approval and minutes; compensation review should use independent reviewers, comparable data and contemporaneous documentation. Treasurers should document spending limits, reimbursement evidence, separate payment approval from reconciliation, and arrange independent review when staffing is limited. See IRS governance guidance.

Complaints and records. For directors, staff and volunteers, establish confidential reporting routes outside implicated supervisory lines, nonretaliation protections and investigation responsibility. Adopt record-category retention periods, secure disposal and preservation holds for litigation or investigations; Form 990 governance questions alone do not mandate written policies. See IRS governance guidance.

Personnel conduct. Give employees, supervisors and volunteers clear harassment, reporting, accommodation-request, confidentiality and escalation procedures, supported by onboarding. See EEOC practical guidance.

Data handling. Organizations handling donor, employee or volunteer information should minimize collection, restrict access, use multifactor authentication, protect backups and assign incident-response responsibility. NIST cybersecurity basics supplies practical recommendations, not a universal legal mandate.

Scope and limitations

Coverage. Federal baseline for 501(c)(3) public charities using supplied research through November 9, 2026. State/local formation and solicitation, private foundations, Form 990-T, detailed schedules, payroll filings and specialized operations require separate review; no future-effective change is established here.

Policies & procedures

Required or conditionally required

Earned paid sick time. Covered nonprofit employers must administer accrual of one hour per 30 hours worked, with annual accrual/use limits of 24 hours below 15 employees and 40 hours at 15 or more. Count full-time, part-time and temporary workers; the larger threshold applies when employment reaches 15 for part of a day in 20 weeks in the current or preceding year. Apply carryover and permitted-use rules, including family care, specified public-health closures and qualifying violence-related absences. The Industrial Commission of Arizona (ICA) administers A.R.S. §§ 23-371, 23-372 and 23-373.

Written sick-time notification procedure. Employers requiring notice for unforeseeable absences must first give employees a written notification policy before denying leave for noncompliance. Requests may be oral or electronic; replacement workers cannot be required, and reasonable documentation may be requested only for three or more consecutive workdays. See A.R.S. § 23-373.

Employee notices and records. Covered employers must provide hiring notices covering sick-time entitlement, uses, nonretaliation, complaint rights and ICA contacts in English, Spanish and additional ICA-designated languages, and post required workplace notices. Pay statements must show available sick time, year-to-date use and sick-time pay; preserve daily hours, wages and sick-time payment records for four years and provide required access. See A.R.S. § 23-375 and § 23-364.

Employment protections. Arizona Civil Rights Act coverage generally begins at 15 employees for each working day in 20 weeks in the current or preceding year; sexual-harassment and related retaliation coverage begins at one employee. Covered employers must avoid prohibited discrimination and provide applicable reasonable accommodations, subject to statutory exceptions; these are conduct duties, not a general written-handbook mandate. The Attorney General’s Civil Rights Division administers A.R.S. § 41-1461 and § 41-1463.

Corporate records and inspection. Preserve board/member minutes, written actions and board-committee actions permanently; maintain accounting records and applicable membership lists. Keep articles, bylaws, member-related resolutions, three years of member minutes and communications, current director/officer lists and the latest annual report at an authorized location. Member inspection generally requires six months’ membership and five business days’ written notice; additional records require a proper purpose, and religious corporations may restrict access through governing documents. These are recordkeeping duties, not a written-policy mandate. See A.R.S. § 10-11601 and § 10-11602.

Interested-person transaction policy. Unless exempt, boards must adopt a policy covering interested-person property transactions, loans and compensation. The financial trigger requires both prior-year net book assets of at least $10 million and gross receipts/revenues of at least $2 million; member-only, religious, governmental and licensed-service-corporation exceptions also require review. See A.R.S. § 10-3864.

Data-breach response. Charities conducting business in Arizona and handling covered computerized personal information must promptly investigate security incidents. Owners/licensees generally must notify affected Arizona residents within 45 days after determining a breach; notice to more than 1,000 individuals also triggers notices to nationwide credit-reporting agencies, the Attorney General and Arizona Department of Homeland Security. Custodians must promptly notify and cooperate with owners; apply statutory content, delivery, delay and exemption rules. This is a response-process duty, not necessarily a written-policy mandate. See A.R.S. § 18-551 and § 18-552.

Paper-record disposal. Before knowingly disposing of paper records combining a name with a complete covered identifier, redact or destroy them. Specified federally regulated entities are exempt; the Attorney General and county attorneys enforce A.R.S. § 44-7601.

Recommended best practices

Conflicts and financial controls. Even exempt boards should document annual interest disclosures, recusals, independent transaction approvals and compensation decisions. Finance staff should use approval limits, separated payment/bookkeeping roles and monthly reconciliation reviews. These support, rather than expand, Arizona’s conflict-policy and accounting-record requirements.

Retention and incident workflows. Assign a records custodian, retention schedule, secure-disposal process and holds for investigations or litigation. Organizations handling personal information should designate incident-response responsibility and maintain a notification checklist supporting corporate-record, disposal and breach-response duties.

Complaint channels. Give staff and volunteers confidential reporting options, an alternate recipient outside the supervisory chain, investigation responsibilities and nonretaliation protections. These practices support Arizona’s employment protections.

Scope and limitations

Coverage. Arizona state-level reference using research supplied through November 9, 2026. Federal requirements, local licensing, payroll accounts, property-tax exemptions and specialized programs are excluded; Arizona has no blanket nonprofit transaction privilege tax exemption, so taxable activities need separate review.