A clearer starting point.

Policies & procedures

Required or conditionally required

Public disclosure. Follow IRC §6104 procedures for public inspection and copies of covered exemption materials and annual returns, subject to applicable exceptions. Copies generally are due immediately for in-person requests and within 30 days for written requests; qualifying online availability can satisfy copying obligations, not eliminate inspection duties. See IRS Public Disclosure Requirements.

Federal-award financial procedures. Recipients and subrecipients subject to 2 CFR Part 200 need effective financial controls, written payment procedures under §200.305 and written allowable-cost procedures under Subpart E. Section 200.303 also requires reasonable cybersecurity and protected-information safeguards, not necessarily a standalone cybersecurity policy. See 2 CFR §§200.302–200.305.

Federal-award procurement. Covered recipients and subrecipients need documented procurement procedures and written conflict standards addressing real or apparent conflicts, exclusion of conflicted decision-makers, contractor gifts and disciplinary consequences. Qualifying parent, affiliate or subsidiary relationships also trigger written organizational-conflict standards under 2 CFR §200.318.

Federal-award compensation. Employee compensation charged to an award must conform to an established written policy applied consistently to federal and nonfederal activities and have appropriate supporting records. See 2 CFR §200.430.

Employment protections and notices. Title VII, ADA and GINA generally cover private employers with at least 15 employees; ADEA generally begins at 20. Covered charities must follow applicable nondiscrimination and accommodation duties and display the applicable EEOC notice; this is not a universal handbook mandate. See EEOC coverage guidance, ADA guidance and the EEOC poster.

Minimum-wage notice. Employers with employees covered by the FLSA must display its notice conspicuously; nonprofit status alone does not determine coverage. See the DOL FLSA poster requirements.

FMLA administration. Private employers generally become covered at 50 employees for 20 workweeks in the current or preceding calendar year; elementary and secondary schools have separate coverage regardless of size. Employee eligibility ordinarily requires 12 months’ employment, 1,250 service hours and 50 employees within 75 miles. Covered employers must post the general notice and, if they have eligible employees, include it in existing handbooks or leave materials, or provide it to new hires if none exist; triggered eligibility, rights-and-responsibilities and designation notices generally follow five-business-day rules. See DOL coverage and 29 CFR §825.300 notice guidance.

Emergency action plans. When another OSHA standard requires a plan, §1910.38 requires reporting, evacuation, critical-operation, employee-accounting, rescue/medical and contact procedures, employee review and evacuation-assistance training. Keep the plan written and available at the workplace; employers with 10 or fewer employees may communicate it orally. See OSHA’s emergency action plan standard.

Recommended best practices

Governance and financial controls. Boards should use annual interest disclosures, transaction-specific recusal, disinterested approval and minutes; compensation review should use independent reviewers, comparable data and contemporaneous documentation. Treasurers should document spending limits, reimbursement evidence, separate payment approval from reconciliation, and arrange independent review when staffing is limited. See IRS governance guidance.

Complaints and records. For directors, staff and volunteers, establish confidential reporting routes outside implicated supervisory lines, nonretaliation protections and investigation responsibility. Adopt record-category retention periods, secure disposal and preservation holds for litigation or investigations; Form 990 governance questions alone do not mandate written policies. See IRS governance guidance.

Personnel conduct. Give employees, supervisors and volunteers clear harassment, reporting, accommodation-request, confidentiality and escalation procedures, supported by onboarding. See EEOC practical guidance.

Data handling. Organizations handling donor, employee or volunteer information should minimize collection, restrict access, use multifactor authentication, protect backups and assign incident-response responsibility. NIST cybersecurity basics supplies practical recommendations, not a universal legal mandate.

Scope and limitations

Coverage. Federal baseline for 501(c)(3) public charities using supplied research through November 9, 2026. State/local formation and solicitation, private foundations, Form 990-T, detailed schedules, payroll filings and specialized operations require separate review; no future-effective change is established here.

Policies & procedures

Required or conditionally required

Corporate records and member access. Texas nonprofit corporations must maintain complete accounting records, written minutes and a current member list with addresses. Members may make written demands stating a proper purpose to examine and copy relevant records at a reasonable time and their own expense; these are recordkeeping and access duties, not a written-policy mandate, under Business Organizations Code §§22.351–22.352.

Sexual-harassment response. Employers with one or more employees must take immediate and appropriate corrective action when they know or should know employee sexual harassment is occurring. This conduct requirement, administered by the Texas Workforce Commission (TWC), does not itself mandate a written policy; see Labor Code §§21.141–21.142.

Workers’ compensation notices. Employers covered by Labor Code Chapter 406 must disclose coverage status at hire, post prescribed notices and notify employees of coverage changes, generally within 15 days after the change takes effect. Use applicable Division of Workers’ Compensation notices, including Notice 5 for noncoverage or Notice 6 for commercial coverage, with postings in English, Spanish and other languages common to employees; see §406.005 and TDI guidance.

Wages and benefit promises. For employees covered by the Texas Payday Law, deductions require a court order, legal authorization or written employee authorization for a lawful purpose. Honor written vacation, sick-leave, holiday and severance promises according to their terms; offering these benefits or adopting a handbook is not itself required by Labor Code §§61.001 and 61.018, administered by TWC.

Sensitive-information safeguards. Charities conducting business in Texas and handling sensitive personal information must maintain reasonable protective procedures, including appropriate disposal of business records containing that information. This information-based duty is not a mandate for a specifically titled written policy; see Business & Commerce Code §§521.002 and 521.052, enforced by the Attorney General.

Breach response. When §521.053’s breach trigger applies, covered organizations must notify affected individuals without unreasonable delay and within 60 days after determining a breach occurred, subject to statutory exceptions. Organizations maintaining another party’s data also have an immediate owner-notification duty; assign incident-response responsibility under §521.053, and consult the Attorney General’s reporting instructions for separate agency reporting.

Recommended best practices

Complaint channels. Employers should adopt a written harassment policy with an alternative reporting route outside the immediate supervisor, prompt investigation and documented corrective action. See TWC’s harassment guidance.

Leave rules. Employers offering paid leave should document accrual, carryover, approvals, advances and separation payouts, then check payroll against those promises. See TWC’s leave-policy guidance.

Interested transactions. Boards should require advance conflict disclosure, disinterested decision-making and documented approval grounds. This workflow supports Business Organizations Code §22.230, which does not itself mandate a written conflict policy.

Scope and limitations

Coverage. This selected Texas baseline uses supplied research through November 9, 2026. It excludes federal obligations, local permits, property-tax exemptions, detailed sales-tax duties, employer filings and specialized programs or licensing.

Privacy distinction. Qualifying nonprofits’ exemption under §541.003 does not eliminate separate Chapter 521 safeguards and breach duties.