A clearer starting point.

Policies & procedures

Required or conditionally required

Public disclosure. Follow IRC §6104 procedures for public inspection and copies of covered exemption materials and annual returns, subject to applicable exceptions. Copies generally are due immediately for in-person requests and within 30 days for written requests; qualifying online availability can satisfy copying obligations, not eliminate inspection duties. See IRS Public Disclosure Requirements.

Federal-award financial procedures. Recipients and subrecipients subject to 2 CFR Part 200 need effective financial controls, written payment procedures under §200.305 and written allowable-cost procedures under Subpart E. Section 200.303 also requires reasonable cybersecurity and protected-information safeguards, not necessarily a standalone cybersecurity policy. See 2 CFR §§200.302–200.305.

Federal-award procurement. Covered recipients and subrecipients need documented procurement procedures and written conflict standards addressing real or apparent conflicts, exclusion of conflicted decision-makers, contractor gifts and disciplinary consequences. Qualifying parent, affiliate or subsidiary relationships also trigger written organizational-conflict standards under 2 CFR §200.318.

Federal-award compensation. Employee compensation charged to an award must conform to an established written policy applied consistently to federal and nonfederal activities and have appropriate supporting records. See 2 CFR §200.430.

Employment protections and notices. Title VII, ADA and GINA generally cover private employers with at least 15 employees; ADEA generally begins at 20. Covered charities must follow applicable nondiscrimination and accommodation duties and display the applicable EEOC notice; this is not a universal handbook mandate. See EEOC coverage guidance, ADA guidance and the EEOC poster.

Minimum-wage notice. Employers with employees covered by the FLSA must display its notice conspicuously; nonprofit status alone does not determine coverage. See the DOL FLSA poster requirements.

FMLA administration. Private employers generally become covered at 50 employees for 20 workweeks in the current or preceding calendar year; elementary and secondary schools have separate coverage regardless of size. Employee eligibility ordinarily requires 12 months’ employment, 1,250 service hours and 50 employees within 75 miles. Covered employers must post the general notice and, if they have eligible employees, include it in existing handbooks or leave materials, or provide it to new hires if none exist; triggered eligibility, rights-and-responsibilities and designation notices generally follow five-business-day rules. See DOL coverage and 29 CFR §825.300 notice guidance.

Emergency action plans. When another OSHA standard requires a plan, §1910.38 requires reporting, evacuation, critical-operation, employee-accounting, rescue/medical and contact procedures, employee review and evacuation-assistance training. Keep the plan written and available at the workplace; employers with 10 or fewer employees may communicate it orally. See OSHA’s emergency action plan standard.

Recommended best practices

Governance and financial controls. Boards should use annual interest disclosures, transaction-specific recusal, disinterested approval and minutes; compensation review should use independent reviewers, comparable data and contemporaneous documentation. Treasurers should document spending limits, reimbursement evidence, separate payment approval from reconciliation, and arrange independent review when staffing is limited. See IRS governance guidance.

Complaints and records. For directors, staff and volunteers, establish confidential reporting routes outside implicated supervisory lines, nonretaliation protections and investigation responsibility. Adopt record-category retention periods, secure disposal and preservation holds for litigation or investigations; Form 990 governance questions alone do not mandate written policies. See IRS governance guidance.

Personnel conduct. Give employees, supervisors and volunteers clear harassment, reporting, accommodation-request, confidentiality and escalation procedures, supported by onboarding. See EEOC practical guidance.

Data handling. Organizations handling donor, employee or volunteer information should minimize collection, restrict access, use multifactor authentication, protect backups and assign incident-response responsibility. NIST cybersecurity basics supplies practical recommendations, not a universal legal mandate.

Scope and limitations

Coverage. Federal baseline for 501(c)(3) public charities using supplied research through November 9, 2026. State/local formation and solicitation, private foundations, Form 990-T, detailed schedules, payroll filings and specialized operations require separate review; no future-effective change is established here.

Policies & procedures

Required or conditionally required

Corporate records. Wyoming nonprofit corporations must permanently retain member and board meeting minutes, actions without meetings, and authorized board-committee actions; maintain appropriate accounting records and, where applicable, membership records. Records must be written or convertible to writing within a reasonable time; this is a recordkeeping duty, not a written retention-policy mandate. W.S. 17-19-1601.

Principal-office records and member access. Keep current articles, bylaws, member-rights resolutions, officer/director names and addresses, the latest annual report, and the specified three-year history of member actions and communications at the principal office. Follow statutory member-inspection procedures and limit reasonable copying charges to estimated production costs; these rights concern corporate members, not automatically donors. W.S. 17-19-1601–1603.

Minutes responsibility. Designate an officer, through the bylaws or board action, to prepare member and board meeting minutes and authenticate corporate records. This is a governance assignment rather than a separate written-policy requirement. W.S. 17-19-840.

Insider loans. Nonprofit corporations must not lend money to, or guarantee obligations of, their directors or officers. A written prohibition can help implement this conduct restriction but is not itself the statutory mandate. W.S. 17-19-832.

Vacation forfeiture. An employer intending to exclude accrued vacation from wages payable at termination must have a written vacation-forfeiture policy acknowledged in writing by the employee. Retain the terms and acknowledgment; this does not require offering vacation. The Department of Workforce Services (DWS) administers wage law. W.S. 27-4-501(a)(iii).

Data-breach investigation and notice. For an organization within the statute’s “individual or commercial entity” coverage that conducts business in Wyoming and owns or licenses covered computerized personal identifying information about Wyoming residents, discovery of a qualifying breach triggers a prompt, good-faith investigation. If misuse occurred or is reasonably likely, notify affected residents as expeditiously as possible without unreasonable delay, subject to statutory investigation, restoration and written law-enforcement-delay provisions; the statute requires conduct and notices, not expressly a written response policy. W.S. 40-12-501–502.

Notice contents and service providers. Required resident notices must be clear and conspicuous and include contact and credit-agency information, affected information types, an incident description, the approximate breach date if ascertainable, protective actions, monitoring advice and applicable law-enforcement-delay information. A person maintaining covered computerized information for another business entity must disclose a qualifying breach to that entity as soon as practicable; the statute also allocates resident-notification responsibility. The Attorney General enforces these requirements. W.S. 40-12-502(e)–(g).

Recommended best practices

Conflict management. Boards should adopt written procedures for annual conflict disclosures, transaction-specific disclosure, recusal and documented disinterested review. These support compliance with Wyoming’s interested-director transaction rules but are not a separate written-policy mandate. W.S. 17-19-831.

Records and financial controls. Assign a records custodian, preserve a permanent minutes archive, separate payment preparation from approval, set approval thresholds, and arrange independent review of bank reconciliations. These controls support statutory recordkeeping and director oversight duties. W.S. 17-19-830 and 1601.

Employment complaints and notices. Employers should provide an accessible complaint route, an alternative contact when a supervisor is implicated, and a documented response process. Assign responsibility for checking applicable workplace-posting requirements using DWS Labor Standards and its free poster resources.

Data-response readiness. Organizations holding donor, employee or client information should identify an incident lead, preserve evidence, inventory potentially covered data and require prompt vendor escalation. This workflow supports evaluating statutory investigation and notification triggers. W.S. 40-12-501–502.

Scope and limitations

Coverage. This Wyoming reference uses the supplied research for November 9, 2026. It covers core corporate filings and selected state governance, employment and data-handling duties, not federal filings or policies, local requirements, specialized operations, or a comprehensive employment, privacy or tax inventory.