A clearer starting point.

Policies & procedures

Required or conditionally required

Public disclosure. Follow IRC §6104 procedures for public inspection and copies of covered exemption materials and annual returns, subject to applicable exceptions. Copies generally are due immediately for in-person requests and within 30 days for written requests; qualifying online availability can satisfy copying obligations, not eliminate inspection duties. See IRS Public Disclosure Requirements.

Federal-award financial procedures. Recipients and subrecipients subject to 2 CFR Part 200 need effective financial controls, written payment procedures under §200.305 and written allowable-cost procedures under Subpart E. Section 200.303 also requires reasonable cybersecurity and protected-information safeguards, not necessarily a standalone cybersecurity policy. See 2 CFR §§200.302–200.305.

Federal-award procurement. Covered recipients and subrecipients need documented procurement procedures and written conflict standards addressing real or apparent conflicts, exclusion of conflicted decision-makers, contractor gifts and disciplinary consequences. Qualifying parent, affiliate or subsidiary relationships also trigger written organizational-conflict standards under 2 CFR §200.318.

Federal-award compensation. Employee compensation charged to an award must conform to an established written policy applied consistently to federal and nonfederal activities and have appropriate supporting records. See 2 CFR §200.430.

Employment protections and notices. Title VII, ADA and GINA generally cover private employers with at least 15 employees; ADEA generally begins at 20. Covered charities must follow applicable nondiscrimination and accommodation duties and display the applicable EEOC notice; this is not a universal handbook mandate. See EEOC coverage guidance, ADA guidance and the EEOC poster.

Minimum-wage notice. Employers with employees covered by the FLSA must display its notice conspicuously; nonprofit status alone does not determine coverage. See the DOL FLSA poster requirements.

FMLA administration. Private employers generally become covered at 50 employees for 20 workweeks in the current or preceding calendar year; elementary and secondary schools have separate coverage regardless of size. Employee eligibility ordinarily requires 12 months’ employment, 1,250 service hours and 50 employees within 75 miles. Covered employers must post the general notice and, if they have eligible employees, include it in existing handbooks or leave materials, or provide it to new hires if none exist; triggered eligibility, rights-and-responsibilities and designation notices generally follow five-business-day rules. See DOL coverage and 29 CFR §825.300 notice guidance.

Emergency action plans. When another OSHA standard requires a plan, §1910.38 requires reporting, evacuation, critical-operation, employee-accounting, rescue/medical and contact procedures, employee review and evacuation-assistance training. Keep the plan written and available at the workplace; employers with 10 or fewer employees may communicate it orally. See OSHA’s emergency action plan standard.

Recommended best practices

Governance and financial controls. Boards should use annual interest disclosures, transaction-specific recusal, disinterested approval and minutes; compensation review should use independent reviewers, comparable data and contemporaneous documentation. Treasurers should document spending limits, reimbursement evidence, separate payment approval from reconciliation, and arrange independent review when staffing is limited. See IRS governance guidance.

Complaints and records. For directors, staff and volunteers, establish confidential reporting routes outside implicated supervisory lines, nonretaliation protections and investigation responsibility. Adopt record-category retention periods, secure disposal and preservation holds for litigation or investigations; Form 990 governance questions alone do not mandate written policies. See IRS governance guidance.

Personnel conduct. Give employees, supervisors and volunteers clear harassment, reporting, accommodation-request, confidentiality and escalation procedures, supported by onboarding. See EEOC practical guidance.

Data handling. Organizations handling donor, employee or volunteer information should minimize collection, restrict access, use multifactor authentication, protect backups and assign incident-response responsibility. NIST cybersecurity basics supplies practical recommendations, not a universal legal mandate.

Scope and limitations

Coverage. Federal baseline for 501(c)(3) public charities using supplied research through November 9, 2026. State/local formation and solicitation, private foundations, Form 990-T, detailed schedules, payroll filings and specialized operations require separate review; no future-effective change is established here.

Policies & procedures

Required or conditionally required

Harassment prevention policy. Employers with five or more employees must develop and distribute a written policy under 2 CCR §11023 (secondary context), enforced by the Civil Rights Department. Cover protected characteristics; prohibited coworker, supervisor and third-party misconduct; reporting outside the immediate supervisor; supervisor reporting duties; timely, impartial investigations; appropriate confidentiality; corrective action; and nonretaliation. Follow distribution and applicable translation requirements.

Harassment training. Employers with five or more employees must provide California supervisors two hours and nonsupervisors one hour every two years, generally within six months of hire or promotion; temporary and seasonal workers have special timing rules. Government Code §12950.1 and 2 CCR §11024 (secondary context) govern training and require documentation retention for at least two years.

Injury and Illness Prevention Program. Employers must maintain an effective written IIPP under Cal/OSHA’s 8 CCR §3203. Cover responsible personnel, safe-work compliance, communication without reprisal, hazard inspections and correction, incident investigation, training and employee access; inspection and training records generally require one-year retention, subject to specified exceptions.

Workplace violence prevention. Covered employers must maintain a written plan, violent-incident log, and initial and annual training under Labor Code §6401.9. Address responsible administrators, employee participation, reporting without retaliation, emergency response, hazard evaluation and correction, and investigations. Exemptions include qualifying employee-chosen remote locations and workplaces with fewer than ten employees present that are inaccessible to the public and satisfy IIPP requirements; size alone is insufficient. See Cal/OSHA guidance.

Lactation policy. Labor Code §1034 requires employers to implement a policy explaining accommodation rights, requests, employer responses and complaints to the Labor Commissioner. Include it in a handbook or other available policies, distribute it at hire and upon parental-leave inquiry or request, and respond in writing when compliant breaks or space cannot be provided. See Labor Commissioner guidance.

Workplace-rights notices. Under SB 294, employers must provide the prescribed Workplace Know Your Rights notice annually by February 1 and upon hire. Establish emergency-contact designation and arrest-or-detention notification procedures, including notification in the circumstances specified by the law; this is a notice and procedure duty, not a general handbook mandate. See the Labor Commissioner’s 2026 instructions.

Corporate records and inspection. Public benefit corporations must maintain adequate, correct accounting records, minutes of member, board and board-committee proceedings, and applicable membership records under Corporations Code §6320. Directors have inspection rights at reasonable times under §6334; these are recordkeeping and access duties, not standalone written-policy mandates.

Executive compensation approval. Charities subject to Government Code §12586(g) must obtain board or authorized-committee review and approval of CEO/president and CFO/treasurer compensation for reasonableness at hiring, renewal or extension, and modification, subject to the organization-wide-increase exception. This is an approval duty; see the Attorney General’s Nonprofit Integrity Act guidance.

Recommended best practices

Conflicts and financial controls. Charity boards should document disclosures, recusals and related-party approvals, payment limits, independent bank reconciliations and restricted-fund tracking. These practices support fiduciary compliance without making every written policy mandatory; see the Attorney General’s Guide for Charities.

Complaints and investigations. Provide employees and volunteers clear reporting routes, an independent alternative when management is implicated, and nonretaliation protections. Use interviews, relevant records and documented findings without promising absolute confidentiality; see the CRD Harassment Prevention Guide.

Data incident readiness. Charities handling donor, employee or client information should assign response responsibility and maintain a notification checklist. Nonprofit status does not eliminate all privacy obligations; distinguish the Attorney General’s CCPA guidance from its breach-reporting guidance.

Scope and limitations

Coverage. This November 9, 2026 reference covers core California public-charity filings and selected state policies. Federal requirements, local permits, payroll filings, property-tax exemptions and specialized operations are deferred, not deemed inapplicable. Recheck forthcoming workplace-violence standards using Cal/OSHA’s update.