Chapter 11
Operations
The area of organizational operations may be the single functional area that most closely resembles its counterpart in commercial and governmental organizations. If programs and services are the most visible parts of a nonprofit organization, operations (sometimes referred to as back-office operations) are the functions that make programs and services work. Keeping the lights on and the plumbing working are just as important for nonprofit organizations as for any other organization, but, despite the similarities, there are some differences. This chapter identifies some of those differences; it also highlights the main operational areas of risk that you should be focusing on.
Handling Operational Tax Issues in Nonprofit and Nongovernmental Organizations
Depending on the structure of the organization, its location, and the governing laws and regulations, it may be eligible to receive public funding either directly or in the form of tax benefits. These laws and regulations can be complex—organizations large and small often have difficulty sorting through them. A further complication is that accountants and managers may be experienced in commercial enterprises, but in working with nonprofits, they may need to review specific issues. (And, just to make things more complicated, the laws and regulations themselves tend to change.)
Note: Chapter 13, “Board Governance and Oversight,” has a high-level overview of organizational structures.
What to Watch For
Basic eligibility for certain benefits, tax abatements and exemptions, and other advantages of nonprofit organizations can require significant amounts of time. Although each benefit is different, there is a basic set of steps to take:
- Investigate what is available.
- Provide documentation as required to register for the benefit.
- Handle routine updates as necessary (perhaps on an annual basis or, in the case of sales and use taxes, on a case-by-case basis).
Sometimes these benefits are sizable and significant; in other cases, the benefits are small. They can be so small that it is easy to dismiss them, but this decision should not be taken lightly.
As an example, consider a situation in which a nonprofit organization is exempt from sales or use taxes for its purchases within a state or other area. If the tax rate is 10%, and the cost of a package of 500 sheets of blank paper is $4.50, the amount of tax works out to 45¢. To take advantage of that exemption (in the amount of 45¢), the organization must provide documentation of its tax-exempt status. While some organizations and staff may find it tedious to carry the tax exemption certification or to keep track of receipts, many organizations that that buy in bulk or purchase goods and equipment regularly can save thousands of dollars each year.
Prevention
On the other hand, if you consider the benefit over time once the initial work is done, it can mount up. Because the amounts can be small, there is often a temptation to forego the paperwork. This can be compounded when volunteers or staff who don’t see the long-term consequences handle small purchases—they may even offer to pay the tax themselves. The organization, its staff, and its volunteers need discipline in tracking down and using small benefits such as these.
Tip: Sometimes the initial paperwork to set up a nonprofit account with a vendor can be daunting both for the vendor and the organization. However, there are anecdotal reports from many organizations, staff, and volunteers that local vendors may be more helpful in setting up such accounts in the hope of attracting additional local business. At the other end, some large companies also have preferred customer practices that help set up such accounts.
Mitigation
In general, once transactions have occurred, it can be difficult to recover credits or benefits that were not applied. Prevention, as noted in the previous section, is the best approach. Also, if there is a mistake made and it is caught quickly (the same day, in many cases), the initial transaction can be undone and replaced by a more beneficial one.
Reviewing Basic Operational Risks for Organizations: Document and Data Retention
Document and data retention is a challenge for most organizations. Now that so much information is digitized, the problem may even be greater than it was before. Digitized documents take up almost no space, but you may wind up maintaining documents and data that are excessive in terms of what is useful or necessary.
What to Watch For
Here are some of the basic risks that you should watch for and try to prevent. The first may seem counterintuitive, but experience has shown that it is accurate that the organization is saving excessive documents and data. This is not just a matter of space but a matter of the time spent in cataloging and searching for documents that may or may not exist.
Watch for efforts involving lots of time and frustration in trying to find a specific document or piece of information. Whether it is a manual system search for a physical document with the claim, “I know it’s here somewhere,” or an automated document or text search, it is often the unsuccessful search that proves that you are saving too much.
In fact, in many cases, saving too much is not the problem—the problem is that you do not have a usable document and data retention and retrieval system.
Prevention
When setting up information retention policies (paper-based or digital), start from the end of the process: don’t save anything you don’t need. If you don’t know why you are saving a document or data (and there is no external requirement that you save it), chances are that it doesn’t need to be saved. Address this both as a policy issue and as practice: do what you say you will do in terms of document retention. (Somehow, “just in case” often seems to triumph over a retention policy involving when to not keep documents.) In setting up your information retention (and elimination) policies, consult all interested parties including legal counsel, and review outstanding agreements, contracts, and regulations so that you are in compliance with all of them. Fortunately, setting this policy need not be done on a regular basis. Once it’s done, you just make sure that the practice is carried out.
Note: “It may come in handy one day” is not a good reason to save documents or data.
When documents and data are saved, each item should have some type of categorization attached to it.
–What is the document or data?
–Who can see it?
–How long does that access permission last?
–Who can revise it?
–How long does that revision permission last?
–Who can discard it?
–How long does that discard permission last?
–Where is the document or data located?
–What passwords are needed?
Whether the retained data is digital or paper-based, it usually makes sense to manage the above document information on a spreadsheet or in a database. That way, you can quickly find all documents or data with permissions that are about to expire. You can also update the contact information for people who have access.
In implementing a retention policy along these lines, you may come into contact with people who point out that too much information is provided for a simple one-page document. The counterpoint to that objection is that if it’s worth preserving, this information about the single one-page document is worth entering.
Note: This argument doesn’t always work, but it’s worth a try. The point is to save what is necessary and nothing more as well as to know why you are saving anything that is being saved.
Reviewing Basic Operational Risks for Organizations: Disaster Recovery
Disasters happen, and there isn’t much you can do about them. In retrospect, you may be able to ascribe the disasters to preventable actions, but for the most part, these disasters are unforeseen and unstoppable. The traditional disasters of flood, fire, plague, and warfare have been joined by newer disasters such as climate change and cyber warfare (hacking and cyber malware that is controlled and launched by state actors or nations).
Although you cannot prevent disasters, you can plan for them and for the recovery or mitigation steps that will be needed.
What to Watch For
The line between a catastrophe or disaster and a misfortune or accident is clear only to the parties involved. There are some words and phrases you should listen for that can help you prepare for the inevitable disasters you may face. Red flags and alarms should go off when you hear remarks such as these:
–“We’re lucky it wasn’t worse.”
–“At least it happened on a weekend.”
These and similar remarks may indicate that you don’t have an adequate mitigation strategy in place. On the contrary, listen happily to remarks such as, “We just used the plan and started seeing clients and running all operations by the next day.”
As with every risk event you encounter in either your own organization or other organizations, consider each risk event an opportunity for learning and testing your own preparedness.
Precautions
The kind of disasters discussed in this section go beyond a single organization. In your planning for disasters, you should be providing for off-site backups of critical data as well as off-site functionality for digital operations (often with a cloud component). You should think about how to manage if your organization is without Internet or telephone access, or if the entire building is without power.
For disaster preparedness, you should start thinking about what to do if the entire region is without power. Flood waters may subside after a period of time, but if they leave behind destroyed bridges and tunnels over a wide area, no one may be able to move without effort. To find any kind of usable facility for your operations, you may be looking at severe disruptions.
Your clients, employees, patrons, vendors, and other people you deal with may be similarly unreachable or unable to get anywhere they want to go. A disaster preparedness plan can help you to a certain extent, but a lot of your actual disaster management may have to be built as needed.
The main component must be the ability for people to work together in new and different configurations. If they can do that, the disaster’s damage can be managed as best as possible.
There is another key point to a successful disaster recovery plan: It should be triggered automatically. It is human nature to think that just one more turn of the screw or one more attempt at trying to start a car engine might do the trick. Having a rigorous protocol that switches you over to alternative operations can prevent these kinds of moment-to-moment attempts to try to make things work.
Preparing for Business Interruption
These are among the most common types of business interruptions you should prepare for.
What to Watch For
You can group business interruption risks into groups as follows:
–Acts and accidents. Watch for acts of malice or fraud such as outright theft of items, deliberate diversion of funds, disruptions of operations, or similar actions.
–Operational errors. To the fullest extent possible, prepare for operational errors by anyone you employ or deal with. Without malicious intent, people may make mistakes or perform improperly, perhaps due to circumstances outside the workplace.
–Problems with partners. Do not assume that partner organizations work properly. For example, balancing the company checking account monthly is a routine and essential process. Periodically validating the statement data that you receive is prudent, particularly in investment accounts.
–Problems with people. Essential people, whether as part of your organization, part of partner organizations, or any group with which you deal (including financial advisors, funders, and regulators), may not be able to adequately perform their work. Are you prepared for this?
–Location changes of partners. Many partners (suppliers, consultants, and others) have established relationships that sometimes have been based on location. It is not uncommon in working with nonprofit organizations to discover long-standing relationships originally based on location (for example, the near-by office supply store) but where both parties have moved. Although the location no longer is convenient, the value of the long-standing relationship and knowledge on both sides may be worth keeping things as is. However, it is worth reviewing location-based relationships from time to time.
Handling Failure of Key Partners
This is one of the most frightening operational problems any organization can experience. If you rely on a single organization for the bulk (or all) of your funding, and they close unexpectedly, what do you do?
If your organization relies on another organization for its operational support or guidance, what do you do if the organization closes or cannot function?
What to Watch For
There are two basic approaches to prepare for this kind of problem.
The first is to limit sole sources or unique partners. This may or may not be an appropriate or feasible strategy for your organization. What is important is to recognize that it can pose a risk. Evaluate if such a risk exists, and, if it does, how it can be mitigated.
If your support is not just financial, the failure of a partnering organization can be just as traumatic as the death of a close friend or relative. Who do you turn to for guidance and support? Who knows you and your organization well enough to bring up an issue that you don’t know about that might affect you down the road?
The second approach is not to have two sources for critical resources, but to have a backup resource that can step in quickly. This might be another nonprofit in the same field, but perhaps located hundreds or thousands of miles away. Such contingency backup plans can be mutually advantageous.
Summary
As you hear about problems that affect various organizations, try to learn from what you hear. The first step is to not ask, “Could that happen here?” but rather, asking, “How could that happen here?”
The point is that anything could happen anywhere. You do your best to forestall problems, but if you start from the premise that anything can happen under the right circumstances, the challenge becomes finding what those circumstances might be. In order to do that, you need to look carefully at your organization and how it functions. (You also have to keep finding out the details of what has happened elsewhere, because the first reports are often revised.)
Delving into the details of what happened and how it could happen in your environment doesn’t allow a quick “Yes” or “No,” the simple (and not particularly useful) responses to, “Could that happen here?”