A governance policy is the internal rulebook that defines how an organization makes decisions, who holds authority over what, and what happens when someone abuses that authority. It translates the fiduciary duties board members already owe the organization into concrete rules: who must disclose financial relationships, how compensation is approved, which records are kept and for how long, how violations get reported, and what the consequences look like. For publicly traded companies, federal law under the Sarbanes-Oxley Act fixes much of what the policy must contain. Nonprofits face a parallel set of expectations from the IRS, surfaced through Form 990.
Core Components Every Governance Policy Needs
A workable policy covers five areas. Each one exists because the law, a regulator, or a predictable failure mode requires it.
Mission and the Line Between Board and Management
The mission statement anchors the document. It defines the organization’s purpose and gives the board a benchmark for evaluating whether a decision serves the entity or someone’s personal agenda. Keep it short enough to recite from memory.
The policy then draws a clear line between the board’s role and day-to-day management. Boards set strategic direction, hire the chief executive, approve budgets, and monitor performance. They do not manage staff, negotiate contracts, or run programs. Blurring that line undermines the executives the board hired and erodes the independence oversight depends on.
Conflict of Interest Disclosures
Conflict of interest provisions require board members, officers, and key employees to disclose any financial relationship that could influence their decisions. Disclosure typically happens annually through a signed statement covering ties to vendors, contractors, and other entities doing business with the organization.
The policy should spell out what happens when a conflict surfaces. Standard practice: the conflicted individual leaves the room during discussion and voting, the remaining members decide whether the transaction is fair to the organization, and the minutes record who recused themselves and why.
For nonprofits, this provision carries extra weight. IRS Form 990 asks directly whether the organization has a written conflict of interest policy, whether officers and directors must disclose interests annually, and whether the organization monitors and enforces compliance.1Internal Revenue Service. Instructions for Form 990 – Section: Part VI. Governance, Management, and Disclosure Answering “no” doesn’t automatically cost the organization its tax-exempt status, but it invites closer scrutiny and signals weak governance to donors and grantmakers.
Code of Ethics
The code of ethics sets behavioral standards for everyone, from entry-level staff to the board chair. It covers professional conduct, confidentiality, proper use of organizational resources, and the consequences for violations, which can range from a formal reprimand to removal.
Public companies face an added federal requirement. SEC regulations require every registrant to disclose whether it has adopted a code of ethics covering its principal executive officer, principal financial officer, and principal accounting officer. If it hasn’t, it must explain why. Any amendment to or waiver from the code must be disclosed within four business days through a public filing or the company’s website.2eCFR. 17 CFR 229.406 – (Item 406) Code of Ethics
Whistleblower Protection
A governance policy without a safe way to report violations is decoration. The Sarbanes-Oxley Act prohibits all corporations, including nonprofits, from retaliating against employees who report concerns about financial management or accounting practices.3U.S. Department of Labor. Sarbanes-Oxley Act of 2002 More than 45 states have enacted their own whistleblower protections on top of that federal baseline.
An effective policy identifies exactly who receives reports, whether a compliance officer, a designated board member, or an anonymous hotline. It promises protection from retaliation in plain terms. And it commits the organization to investigating every credible report independently. Form 990 asks whether a nonprofit has a written whistleblower policy, so the document matters for IRS reporting even beyond its practical value.1Internal Revenue Service. Instructions for Form 990 – Section: Part VI. Governance, Management, and Disclosure
Document Retention and Destruction
The policy should include a schedule specifying how long the organization retains different categories of records. Founding documents like articles of incorporation and bylaws are kept permanently. Board minutes, financial audits, and tax returns are typically retained for at least seven years, with some records warranting longer periods depending on activities.
Tax-exempt organizations must maintain books and records sufficient to demonstrate compliance with tax rules, including documentation of income, expenses, and any unrelated business activities.4Internal Revenue Service. EO Operational Requirements: Recordkeeping Requirements for Exempt Organizations Form 990 again asks whether the organization has a written retention and destruction policy.1Internal Revenue Service. Instructions for Form 990 – Section: Part VI. Governance, Management, and Disclosure
The destruction side matters just as much. Under federal law, anyone who knowingly destroys or falsifies records to obstruct a federal investigation faces up to 20 years in prison.5Office of the Law Revision Counsel. 18 USC 1519 – Destruction, Alteration, or Falsification of Records in Federal Investigations and Bankruptcy A clear retention schedule protects the organization by distinguishing routine disposal from suspicious destruction.
The Fiduciary Duties the Policy Enforces
Every provision above exists to enforce three fiduciary duties board members owe the organization. These are legal obligations, not aspirations, and they can trigger personal liability when violated.
- Duty of care: board members must make informed decisions. That means actually reading financial reports, attending meetings, and asking hard questions before voting. A director who rubber-stamps a budget without reviewing it has breached this duty.
- Duty of loyalty: every decision must serve the organization, not the board member’s personal interests. Conflicts of interest, side deals with vendors a director owns, and diverting organizational opportunities for personal gain all violate this duty.
- Duty of obedience: the board must ensure the organization follows applicable laws, its own bylaws, and its stated mission. A nonprofit board that lets the organization drift from its charitable purpose has failed here.
Without the written policy, the duties still exist. Enforcing them just becomes much harder.
What Public Companies Must Include
Publicly traded companies operate under the Sarbanes-Oxley Act, which Congress passed in 2002 after Enron and WorldCom. Two sections shape the governance policy most directly.
Section 404 requires every annual report to include an internal control report. Management must take responsibility for maintaining effective controls over financial reporting and assess their effectiveness as of the fiscal year end. For larger companies, an independent auditor must also examine and report on those controls.6Office of the Law Revision Counsel. 15 USC 7262 – Management Assessment of Internal Controls Smaller issuers that don’t qualify as accelerated filers are exempt from the independent audit requirement, but they still must perform the management assessment.
Section 906 imposes criminal penalties on executives who certify false financial statements. An officer who knowingly signs off on a report that doesn’t comply with the law faces up to a $1 million fine and 10 years in prison. If the certification is willful, the penalties rise to a $5 million fine and up to 20 years.7Office of the Law Revision Counsel. 18 USC 1350 – Certification of Periodic Financial Reports These are individual penalties on the certifying officers, not fines on the corporation. The CEO and CFO carry personal criminal exposure for what they sign.
Companies listed on the NYSE or Nasdaq must also maintain a written clawback policy that requires recovery of incentive-based compensation when the company restates its financials. The amount recovered is whatever the executive received above what they would have earned based on the corrected numbers, calculated without regard to taxes already paid on that compensation.8eCFR. 17 CFR 240.10D-1 – Listing Standards Relating to Recovery of Erroneously Awarded Compensation The rule applies to all incentive pay tied to financial reporting measures, including stock price and total shareholder return.
What Nonprofits Must Include
Nonprofits don’t carry the full weight of Sarbanes-Oxley, but the IRS uses Form 990 to evaluate governance quality. Part VI asks whether the organization has written policies covering conflicts of interest, whistleblower protection, and document retention.9Internal Revenue Service. Exempt Organizations Annual Reporting Requirements – Governance (Form 990, Part VI) These policies aren’t technically mandatory for most nonprofits, but answering “no” is a red flag that can trigger deeper IRS review and undermine credibility with funders.
Where nonprofit governance really has teeth is executive compensation. If a nonprofit pays an insider more than the value of what they provide, the IRS treats the overpayment as an excess benefit transaction under Section 4958 of the Internal Revenue Code. The person who received the excess benefit owes an excise tax of 25% of the overpayment. If they don’t correct it within the taxable period, a second tax of 200% kicks in. Any organization manager who knowingly approved the transaction faces a separate 10% tax, capped at $20,000 per transaction.10Office of the Law Revision Counsel. 26 USC 4958 – Taxes on Excess Benefit Transactions
Boards can protect themselves by following the rebuttable presumption process before approving compensation. Three steps are required: the decision must be approved by board members with no conflict of interest in the arrangement, the board must obtain and rely on comparable salary data from similar organizations, and the board must document its reasoning at the time of the decision.11eCFR. 26 CFR 53.4958-6 – Rebuttable Presumption That a Transaction Is Not an Excess Benefit Transaction When all three steps are documented, the burden shifts to the IRS to prove the compensation was unreasonable. Smaller nonprofits with gross receipts under $1 million can satisfy the comparability requirement with data from just three similar organizations in the same community.
Enforcement When Someone Violates the Policy
A governance policy without enforcement provisions is a suggestion. The document should specify a range of disciplinary measures scaled to severity.
For less serious infractions, boards commonly use a formal censure, which is a resolution documenting the specific violation and recording the board’s disapproval. A vote of no confidence serves a similar function when a member has lost the board’s trust through a pattern of conduct rather than one incident. Neither carries legal consequences on its own, but both create a documented record that matters if the situation escalates.
More serious violations may warrant restricting a member’s privileges, such as removing their authority to represent the organization publicly or limiting their access to facilities outside scheduled meetings. In extreme cases, the board may pursue removal through a formal process, though the grounds and procedures for removal should be defined in the bylaws rather than left to improvisation.
One limit worth noting: boards generally cannot prevent a sitting member from participating in debate or casting votes during meetings. Restricting a member’s ability to function as a director raises legal risks and can conflict with the member’s obligations under their oath of office. The policy should acknowledge that boundary clearly.
Keeping the Policy Current
Governance policies go stale. Tax law changes, organizations restructure, new board members bring different challenges, and what seemed thorough five years ago may now have gaps. Most organizations set either an annual or biennial review cycle. Certain events should trigger an immediate out-of-cycle review regardless of the schedule:
- New legislation or regulatory changes, such as amendments to the tax code, new SEC disclosure rules, or changes to a state’s nonprofit corporation statute.
- Major internal changes, including significant board restructuring, a merger, the addition of a new subsidiary, or a shift in the organization’s core activities.
- An enforcement failure, meaning the organization tried to use the policy to address a conflict or disciplinary situation and found the language inadequate.
Amendments follow the same formal adoption process as the original: a governance committee drafts the changes, the full board reviews them at a scheduled meeting, and the board votes. Record the amendment in the meeting minutes with the same detail as the original adoption. Replace old versions across every platform so nobody accidentally relies on outdated language. A version history with dates and descriptions of each change gives the organization a clear record of how its governance has evolved.