By Nancy Johnson
Partner
Why this matters now
A written whistleblower policy is an important governance practice for nonprofit organizations. Although the IRS has been asking whether a nonprofit has a whistleblower policy on Form 990 for years, a new auditing standard will increase auditors’ focus on how organizations assess fraud risk.
A whistleblower policy is one of the simplest, yet effective controls an organization can adopt. It gives staff, volunteers and board members a safe way to raise concerns before small problems become serious ones.
The new fraud standard: SAS No. 151
The AICPA Auditing Standards Board has approved Statement on Auditing Standards (SAS) No. 151, The Auditor’s Responsibilities Relating to Fraud in an Audit of Financial Statements. SAS No. 151 requires more audit procedures around fraud while reinforcing that management and the governing board remain primarily responsible for preventing and detecting it. The standard applies to audits of financial statements for periods ending on or after December 15, 2028.
The standard adds more specific requirements in five areas:
- Professional skepticism throughout the engagement
- Fraud risk assessment
- Documentation
- Communication with management and the board
- Responses when fraud is identified or suspected
Two things do not change: the definition of fraud, and the auditor’s objective of obtaining reasonable assurance that the financial statements are free of material misstatement due to fraud or error.
For nonprofits, the practical effect will be increased auditor attention to fraud risks, including how allegations of fraud are reported and how management and those charged with governance respond. An organization’s whistleblower policy and related reporting procedures may receive greater attention during the audit.
Form 990 and the law behind it
Form 990 asks every filing organization whether it has a written whistleblower policy (Part VI, line 13). Although a formal written whistleblower policy is not universally required by federal law, a “no” answer is publicly reported and may prompt questions about governance practices from donors, grantors, and regulators.
There are legal protections that exist whether or not a formal policy exists for the nonprofit:
- Federal law: Certain provisions concerning obstruction of justice and destruction of records apply broadly, including to nonprofit organizations. Nonprofits should also consider applicable federal and state whistleblower and anti-retaliation laws.
- False Claims Act: protects people who report fraud against federal programs or misuse of federal grant funds.
- State laws: Whistleblower and anti-retaliation protections vary by state, so nonprofits should consider the laws applicable in the states where they operate.
The IRS views a written whistleblower policy as helpful because it encourages people to come forward, describes the organization’s commitment to protection from retaliation, and identifies who can receive a report. This can also be helpful for volunteers, including in organizations with no paid staff.
What a strong policy includes
A good policy is short, written in plain language and approved by the governing board. It should cover these elements:
| Element | What it says |
| Scope | What can be reported: financial fraud, theft, waste, record destruction, safety hazards, and violations of law or internal policy |
| Non-retaliation | No one who reports in good faith will be punished or fired; anyone who retaliates faces discipline up to termination |
| Reporting channels | Who to tell, with alternates outside management such as the board chair, an audit committee member or an outside compliance officer |
| Confidentiality | Reports may be made confidentially, and the reporter’s identity is protected as far as an investigation allows |
| Compliance officer | A named person who acknowledges each report, oversees investigation and reports to the board at least annually |
| Accounting matters | Complaints about accounting, internal controls or auditing go straight to the audit or finance committee |
| Good faith | Reports need reasonable grounds; knowingly false or malicious claims are a disciplinary offense |
Adopting the policy is only the start. Organizations should also:
- Distribute it widely: in the employee handbook and volunteer orientation materials.
- Investigate fairly: assign an independent person or committee to review every complaint objectively.
- Train regularly: revisit the policy at staff meetings and trainings so everyone knows their rights and duties.
What to expect from Han Group
For audits of financial statements for periods ending on or after December 15, 2028, SAS No. 151 will increase auditors’ consideration of fraud-reporting programs. If your organization has a whistleblower or other fraud-reporting program, we may ask how the program operates and how allegations are evaluated and addressed.
If your organization does not have a formal program, we may discuss the processes in place for employees or others to raise concerns. Where appropriate, we may recommend enhancements to the organization’s policies, reporting channels, or other governance practices.
Next steps for your board
- Confirm whether a written whistleblower policy exists and when the board last approved it
- If not, consider adopting one; the National Council of Nonprofits offers a sample to start from
- Name a compliance officer and at least one reporting contact outside management
- Add the policy to the employee handbook and volunteer orientation
- Schedule a brief staff and volunteer training on the policy
- Check that your Form 990 answer matches what is actually in place
Han Group helps nonprofit organizations strengthen their internal controls and navigate audit and compliance requirements. To learn how we can support your organization’s governance and audit readiness efforts, Contact Us.