National Center for Charitable Statistics

The Nonprofit FAQ

What to do if you suspect damaging activities at a nonprofit
The topic of how to deal with suspicions of wrongdoing in nonprofit organizations comes up frequently. Here are two bits of advice on how to approach that problem: in the first case, the question came from someone convinced that wrongdoing was occurring; in the second, the questioner wanted to know what advice to give to someone who thought there might be someting amiss. And as a third source of ideas, there is a list of links to discussions of related topics at the Free Management Library.

On 5/28/1998 someone wrote to NONPROFIT:

"Help. I am an employee in a California non-profit whose management is rumored to be embezzleing money. In two years we have had over seven CFO's/controllers; we can't be audited because our books are intentionally divided among dozens of programs; we have a 90% yearly turn-over of managemnt except for the top executive; the CEO blatently violates our own policies by hiring family members to be executive assistants; the board meetings are held in strict secrecy; the board members are personal friends of the CEO; and no one has ever seen an agency wide budget, yearly summary, etc. In short... we are in a mess! How does a little guy employee even begin to make a difference/ask for some accountability from upper management? Are there non-profit watch-dog agencies? Any body been a similar situation?"

Several people responded with helpful advice and cautions, including this summary posted by Putnam Barber:

If you are seriously interested in taking action to change this situation you need to treat it very carefully. As others have pointed out, there are considerable personal risks, even if you are right that outrageous misbehavior is occurring. The risks are, of course, greater if your impressions turn out to be wrong, or cannot be substantiated.

As a protective policy, please be very careful about saying anything in public that might damage the reputation of the organization or people who work there. This includes (I should think) avoiding making the kind of damaging remarks that are in your original post, since it is likely that someone who knows you can infer the identity of the organization you are talking about. If that person doesn't share your view of the situation, you risk both personal and legal challenges that at best would be time consuming and distracting and at worst might be personally devastating.

That said, there are still things you can do.

The first is to assemble whatever information you can get from official sources. As others have written, registered charities must file reports with both the federal government and local authorities.

The federal report is called Form 990. It is due each year on the 15th day of the fifth month after the end of the organization's fiscal year (extensions are allowed). Effective June 8, 1999, new regulations govern public access to copies of this form. A full copy of these regulations, and much other helpful information, is at

Organizations are now required to provide a copy "immediately" to anyone who comes to the administrative office and asks for it. A copying fee of $1 for the first page and $.15 for each subsequent page may be charged. The forms for the last three years are covered by this rule, as is the original application for recognition as an exempt organizations (though there are certain exceptions which apply to long-established organizations).

Note that the organization is not allowed to demand any information from the person making the request and (of course) it is not necessary that you ask for it yourself so you can get help for a friend who won't be known to the people at the agency in question.

In addition to this "walk in" provision, organizations are also required to respond to mail (including email) requests within 30 days of receiving the fee (if one is required). The actual cost of postage may be added to the charge for copying. If you send a written request without the fee, the organization must respond with information on the fee within seven days.

The earlier rules are still in effect as well. These require filing organizations to allow public inspection of the last three years of these forms at their principal office and at any office where there are three or more employees.

There are penalties for failing to follow these requirements, and the IRS will back up members of the public when resistance is reported.

You might want to get a copy of IRS Notice 88-120 to take along with you -- or give to whoever goes on your behalf to ask to as for the forms -- to preclude argument about whether this is a public document, etc. The Notice can be accessed, and printed, from,,i1=3&i2=26&genericId=6886,00.html. The IRS website also has advice about what to do if the organization refuses to provide access to the forms at,,i1=3&i2=18&genericId=6869,00.html.

There are state reports required as well. I don't know much about how California does these things, but usually there are "annual reports" to Corporations officials which provide limited information about the operations of the organization and "campaign reports and registrations" required by Charities regulators from any organization that does fund-raising from the general public. These offices are in Sacramento, of course, but there may be local branches which can help in your research.

The National Association of State Charities Officials (NASCO) has a web page (at which lists all state charities officials, with contact information.

The California Attorney General has a webpage on nonprofits at

I've also heard Californians mention something called the Franchise Tax Board which presumably deals with exemptions from various state taxes; organizations who accept such exemptions will be expected to conform to standards about their operations, so there may be information about the organization you're interested in that can be obtained through that Board and/or allies at that Board who can help you call for change.

(Some California cities also require registration and reporting by organizations doing fund-raising within their boundaries; in general I think these requirements are more of a nuisance than they are worth, but in your case they may be useful in helping you establish your case.)

Another source of general information about most organizations is Philanthropic Research, Inc., and their website at It has some information drawn from 990s and might give you an indication of whether pursuing the original documents would be helpful.

Your second step will be to figure out what to do next. It is unlikely that any public reports will contain obvious evidence of misfeasance. You will still be interested in them for two reasons. First of all, failure to file them is itself a problem. If you find that they are incomplete or nonexistent, it may be easier to get officials to launch an investigation of the organization based on that fact than on any information they might contain. Secondly, if they contain information that is easily demonstrated to be false or misleading, that too is a good starting point for calling for official investigation. As an insider in the organization, you may have access to documents that are inconsistent with the filed reports. Bringing them to the attention of regulators would be easier than trying to document on your own the sorts of misbehavior you describe.

As another note indicated, the Attorney General's office has general oversight responsibility over nonprofit corporations. The AG is unlikely to be willing to intervene in an internal fight within an organization, though. So you need to be able to demonstrate that more is at stake in your differences with the organization than a disagreement about sound business practices or agency direction.

Also, as others have again suggested, you need not take these steps yourself. It may be more prudent, and more effective, to have someone who has no direct connection to the issue work with you to collect the information and evaluate what you find. Complaints about the behavior of nonprofit organizations do not, I fear, rank high on the list of concerns of state and federal officials and, as I mentioned above, they are particularly cautious about becoming involved in internal squabbling. You can protect yourself and bolster your case by not getting directly involved.

If the situation is less clear cut, more discussion with others directly involved with the organization may be a good idea.

Harriet Bograd, founder of the "Cyber Accountability" email discussion group, provided this advice to be given
to someone who thinks there might be a need to "blow the whistle" in response to a query on July 1, 1998:

A first step is to advise the concerned employee to get the agency's Form 990 and study it carefully, and to do anything feasible to substantiate or disprove the suspected wrongdoing. If the suspicion is not well-founded, the employee would be better off figuring this out before making a fuss.

Beyond that, I suppose specific strategies would depend on the structure of the organization and the people involved. I can imagine starting by contacting the employees involved (as when they are making a well-intentioned mistake about what is proper), their supervisors, a chief executive or chief financial officer, an audit committee or finance committee chair or the treasurer or the chairman of the board. Another possibility would be to contact the group's accountants or lawyers. In most cases, I would certainly hope that the whistleblower would start by raising the issue directly with staff or board before going to outside authorities like the state attorney general (or the appropriate state charities office for that state) or the IRS - but I can imagine exceptions to that general rule (as when there was clear evidence that the executive staff and the board were all intentionally doing something improper).

Finally, the whistleblower can consider whether to go to the press, politicians, or funding sources. All this could be very damaging to the organization, so the person must think carefully about whether the whistleblowing is justified, and what kinds of interventions are most likely to do the most good and the least damage.

I just re-read your question, and realize I'm responding with strategies, and you asked about "rights and responsibilities." Perhaps others will address these issues more directly.

--Harriet Bograd, Attorney/Consultant

Coordinator, Cyber-Accountability Listserv

The Free Management Library adds information about:

- Risk Management (

- Crisis Management (

- Ethics Management (

- Getting a Lawyer (

- Insurance (

Posted 7/3/98 and revised 6/15/99; 5/30/05 -- PB; revised 8/19/99 -- CM