A clearer starting point.

Policies & procedures

Required or conditionally required

Public disclosure. Follow IRC §6104 procedures for public inspection and copies of covered exemption materials and annual returns, subject to applicable exceptions. Copies generally are due immediately for in-person requests and within 30 days for written requests; qualifying online availability can satisfy copying obligations, not eliminate inspection duties. See IRS Public Disclosure Requirements.

Federal-award financial procedures. Recipients and subrecipients subject to 2 CFR Part 200 need effective financial controls, written payment procedures under §200.305 and written allowable-cost procedures under Subpart E. Section 200.303 also requires reasonable cybersecurity and protected-information safeguards, not necessarily a standalone cybersecurity policy. See 2 CFR §§200.302–200.305.

Federal-award procurement. Covered recipients and subrecipients need documented procurement procedures and written conflict standards addressing real or apparent conflicts, exclusion of conflicted decision-makers, contractor gifts and disciplinary consequences. Qualifying parent, affiliate or subsidiary relationships also trigger written organizational-conflict standards under 2 CFR §200.318.

Federal-award compensation. Employee compensation charged to an award must conform to an established written policy applied consistently to federal and nonfederal activities and have appropriate supporting records. See 2 CFR §200.430.

Employment protections and notices. Title VII, ADA and GINA generally cover private employers with at least 15 employees; ADEA generally begins at 20. Covered charities must follow applicable nondiscrimination and accommodation duties and display the applicable EEOC notice; this is not a universal handbook mandate. See EEOC coverage guidance, ADA guidance and the EEOC poster.

Minimum-wage notice. Employers with employees covered by the FLSA must display its notice conspicuously; nonprofit status alone does not determine coverage. See the DOL FLSA poster requirements.

FMLA administration. Private employers generally become covered at 50 employees for 20 workweeks in the current or preceding calendar year; elementary and secondary schools have separate coverage regardless of size. Employee eligibility ordinarily requires 12 months’ employment, 1,250 service hours and 50 employees within 75 miles. Covered employers must post the general notice and, if they have eligible employees, include it in existing handbooks or leave materials, or provide it to new hires if none exist; triggered eligibility, rights-and-responsibilities and designation notices generally follow five-business-day rules. See DOL coverage and 29 CFR §825.300 notice guidance.

Emergency action plans. When another OSHA standard requires a plan, §1910.38 requires reporting, evacuation, critical-operation, employee-accounting, rescue/medical and contact procedures, employee review and evacuation-assistance training. Keep the plan written and available at the workplace; employers with 10 or fewer employees may communicate it orally. See OSHA’s emergency action plan standard.

Recommended best practices

Governance and financial controls. Boards should use annual interest disclosures, transaction-specific recusal, disinterested approval and minutes; compensation review should use independent reviewers, comparable data and contemporaneous documentation. Treasurers should document spending limits, reimbursement evidence, separate payment approval from reconciliation, and arrange independent review when staffing is limited. See IRS governance guidance.

Complaints and records. For directors, staff and volunteers, establish confidential reporting routes outside implicated supervisory lines, nonretaliation protections and investigation responsibility. Adopt record-category retention periods, secure disposal and preservation holds for litigation or investigations; Form 990 governance questions alone do not mandate written policies. See IRS governance guidance.

Personnel conduct. Give employees, supervisors and volunteers clear harassment, reporting, accommodation-request, confidentiality and escalation procedures, supported by onboarding. See EEOC practical guidance.

Data handling. Organizations handling donor, employee or volunteer information should minimize collection, restrict access, use multifactor authentication, protect backups and assign incident-response responsibility. NIST cybersecurity basics supplies practical recommendations, not a universal legal mandate.

Scope and limitations

Coverage. Federal baseline for 501(c)(3) public charities using supplied research through November 9, 2026. State/local formation and solicitation, private foundations, Form 990-T, detailed schedules, payroll filings and specialized operations require separate review; no future-effective change is established here.

Policies & procedures

Required or conditionally required

Corporate records and access. Utah nonprofit corporations must retain permanent meeting minutes and records of actions without meetings and board-authorized committee actions, appropriate accounting records, and applicable membership records. Keep required principal-office records, including articles, bylaws, member-class resolutions, three years of member minutes and communications, current director/officer lists and the latest annual report; honor qualifying director and member inspection requests under the applicable notice and purpose rules. These are recordkeeping and access duties, not a written-policy mandate. See Utah Revised Nonprofit Corporation Act, §§ 16-6a-1601–1604.

Pregnancy-accommodation notice and process. Covered employers must put written notice of pregnancy, childbirth, breastfeeding and related-condition accommodation rights in the employee handbook or post it conspicuously. Ordinary private-employer coverage generally requires 15 Utah employees each working day in at least 20 weeks in the current or preceding calendar year; review religious-organization exclusions separately. Provide reasonable accommodations absent undue hardship, and do not require medical certification for more frequent restroom, food or water breaks. This is a notice and conduct requirement enforced by the Utah Labor Commission’s Utah Antidiscrimination and Labor Division, not a separate-policy mandate. See Utah Antidiscrimination Act §§ 34A-5-102 and 106.

Personal internet accounts. Employers must not request or require employee or applicant credentials for personal internet accounts. Hiring and investigation procedures should distinguish protected personal accounts from the statute’s exceptions for business accounts, employer equipment and specified investigations; see the Internet Employment Privacy Act. This regulates conduct rather than requiring a written policy.

Information security and disposal. Charities conducting business in Utah and maintaining statutorily defined personal information must implement reasonable procedures against unlawful use or disclosure. Information no longer retained must be shredded, erased or otherwise made indecipherable; the statute does not expressly require a written policy. The Attorney General enforces the Protection of Personal Information Act, §§ 13-44-102, 201 and 301.

Breach investigation and notices. Owners or licensees of computerized personal information about Utah residents must promptly investigate a discovered breach and notify affected residents without unreasonable delay if identity-theft or fraud misuse occurred or is reasonably likely. At 500 affected Utah residents, also notify the Attorney General and Utah Cyber Center; at 1,000, notify nationwide consumer reporting agencies. State notices must include known incident and discovery dates, affected-person counts, information types and a short description. Organizations merely maintaining another owner’s data must immediately notify and cooperate with that owner when misuse occurs or is reasonably likely. These are required actions, not a written-plan mandate; see § 13-44-202 and Utah Cyber Center reporting.

Recommended best practices

Data-handling playbook. Charities holding employee, donor or client information should document access permissions, data minimization, secure disposal, vendor escalation, an incident lead and notification decisions. Use the Protection of Personal Information Act as the Utah baseline, not as proof of a written-policy mandate.

Accommodation workflow. Covered employers should designate an accommodation contact, an alternative reporting route and a documented response process. Train supervisors on Utah protected categories, including sexual orientation and gender identity, using UALD employment guidance.

Financial controls. Boards should document payment approvals, separate disbursement and reconciliation duties, and assign independent monthly bank-statement review. These are recommended safeguards supporting the accounting-record duties in § 16-6a-1601, not prescribed statutory controls.

Scope and limitations

Coverage. This selected Utah reference uses a November 9, 2026 research cutoff. Federal obligations, payroll, local licensing, property-tax exemptions and specialized operations are deferred, not determined inapplicable.

Privacy-law boundary. The Utah Consumer Privacy Act excludes nonprofit corporations under both its current applicability provision and January 1, 2027 provision. Separate security and breach duties remain applicable.