What Keeps Not-for-Profit Boards Awake at Night

Three Risks Every Board Member Should Be Monitoring

As we finish our summer work with clients and head into the end of the year, we’ve noted as a team that 2026 so far has been the year of rapid evolution. And it feels like AI is accelerating change at a pace faster than ever.

In this uncertain environment, not-for-profit (NFP) leaders are left navigating an ever-evolving risk landscape. While organizations remain focused on advancing their missions, as they should, board members are increasingly being called upon to oversee risks that could threaten the core of their organizations, including financial stability, reputation, operations, and stakeholder trust.

There are three areas in particular that we see NFP clients and boards focusing on because they affect many facets of an organization. These three areas are more important now than ever before.

1. Cybersecurity: Protecting Your Data and Resources

Because NFP organizations collect, out of necessity, sensitive data (including donor, volunteer, and employee data), they are increasingly attractive targets for cybercriminals. NFP organizations also may be dealing with limited technology resources and expertise, and they may be outsourcing technology functions to cloud-based systems, assuming their information is secure. However, moving data and systems to the cloud does not eliminate cybersecurity risk.

While cloud providers are responsible for securing their systems, organizations remain responsible for many aspects of data protection, including user access, security settings, and monitoring for suspicious activity. And because AI has made phishing and other schemes seem more real than ever, it’s critically important that every organization meets minimum-security standards:

• Does the organization have cybersecurity insurance?
• Has the organization performed a penetration test to see how vulnerable their system(s) are?
• Are employees receiving regular cybersecurity training?
• Does the organization have a cyber incident response and recovery plan?

A single cyberattack can result in significant costs, loss of donor confidence, and halting of operations, despite being preventable in many cases. Cybersecurity should be part of an organization’s overall enterprise risk management strategy.

2. Fraud: Strengthening Internal Controls

During times of high inflation and economic uncertainty, the motivation and rationalization sides of the fraud triangle may be ever more prevalent. The key for organizations is to reduce opportunity-side risk, which starts with strong internal controls. Especially in smaller organizations, fraud opportunities arise when only one or two individuals are responsible for daily operations and financial decision-making.

Fraud can come in many forms, including asset misappropriation, procurement fraud, or payroll schemes. Leaders of NFP organizations can reduce the risk by ensuring the following are in place:

• Involving board member(s) in the internal control review when there are a small number of staff and when there may not be adequate segregation of duties among the employees.
• Ensuring the vendor list and expenditure detail are reviewed periodically to identify any fictitious vendors or non-business-related expenses.
• Reviewing the expense reports of the executive director by a board member, not a staff member, to ensure that there is space for expenses to be scrutinized and questioned, if needed.
• Providing a whistleblower reporting channel.

Taking steps to prevent fraud can help safeguard the organization’s assets and reinforce confidence among employees, donors, and other stakeholders.

3. Workforce and Succession Planning: Preparing for the Future

“Peak 65” is a demographic milestone occurring between 2024 and 2027 where a record number of Americans are turning 65 and retiring. As experienced leaders leave the workforce, it’s so important to have a succession plan because people remain an NFP’s most valuable asset, yet one of its greatest risks.

In addition to retirements, organizations are facing challenges with retaining employees, workplace burnout, and challenges around recruiting new talent. In light of these challenges, NFPs should consider these questions:

• Do we have a formal succession plan for the CEO and other key executive positions?
• Are we developing future leaders within the organization?
• Are employees engaged and happy?
• Are there employees in positions where their departure would cause significant knowledge gaps and vulnerabilities to the organization?

As key positions turn over, a useful strategy is to fill them with temporary help. There are many providers that can help with interim CFOs or interim EDs/CEOs to assist the organization while the search for the permanent replacement is conducted, which can typically take many months.

Organizations that proactively invest in leadership development and succession planning are better positioned to manage transitions and maintain organizational stability.

How Will You Monitor Your Organization’s Risk?

Protecting your data and resources and having a strong leadership pipeline or plan can help ensure your organization weathers the ever-present uncertainties of economic, technological, and workforce change, while remaining focused on your mission.

Strong governance starts with asking the right questions. By regularly evaluating cybersecurity preparedness, fraud prevention measures, and leadership continuity plans, boards can play a critical role in safeguarding their organizations. To learn more about assessing organizational risk and strengthening oversight practices, contact Clark Nuber’s Not-for-Profit team today.

© Clark Nuber PS, 2026. All rights reserved.