Nonprofit Insurance Audit: A Yearly Review Process

An annual nonprofit insurance review is a process, not a policy re-read. The work is to document what changed in the organization over the past twelve months, translate those changes into coverage consequences, verify your limits against the contracts you have signed, and arrive at renewal with clean data instead of last year's application. Start roughly 90 days before your renewal date — the Nonprofit Risk Management Center recommends beginning the renewal conversation at least 90 days prior — and work through the nine steps below in order.

Step 1: Write down what actually changed

Most coverage failures trace back to a change nobody reported. Work through this list with your program directors, not just your finance staff.

Give your agent the same list you gave yourself. Underwriters price what they are told about; they decline claims arising from what they were not.

Step 2: Pull your loss runs and actually read them

A loss run is a periodic report of claim information provided by your insurer (IRMI). A related loss report lists reported claims with the date of occurrence, type of claim, amount paid, and amount reserved for each, as of the report's valuation date (IRMI).

Request three to five years, per line of coverage, from each carrier. Then read them for four things:

1. Open claims with large reserves. A reserve is the insurer's estimate, not a payment. Reserves on stale claims are often too high and can be challenged with documentation.
2. Closed claims with zero payment. These still show up as frequency. If several are duplicates or reporting errors, ask for correction.
3. Frequency patterns. Three small slip-and-falls at the same entrance is a facilities project, not an insurance problem.
4. Anything you do not recognize. Claims filed against the wrong entity happen more often than you would expect.

This matters on the workers' compensation side in particular. Experience rating compares your actual loss experience to what is normally expected for others in your rating class (IRMI), and the resulting experience modifier can be a debit or a credit — an employer with average experience carries a modifier of 1.0, poorer experience produces a modifier above 1.00, and better experience produces one below (IRMI). Errors in the loss data feeding that calculation are worth finding before they are locked in.

Step 3: Re-check property values

Two mechanisms make this the most commonly under-maintained item on any renewal.

Valuation basis. Replacement cost is the amount needed to replace a damaged item with one of similar kind and quality without deducting for depreciation; actual cash value pays the amount needed to replace the item minus depreciation — the decrease in value from age, obsolescence, and wear (Insurance Information Institute). Confirm which basis applies to your building, your contents, and — separately — your roof, since roofs are frequently scheduled differently.

Coinsurance. A coinsurance provision penalizes your loss recovery if the limit you purchased is not at least a specified percentage — commonly 80 percent — of the property's value. Fall short and you absorb part of the loss yourself, which is the coinsurance penalty; an agreed value provision can sometimes remove the risk entirely (IRMI).

Construction cost inflation is what turns an adequate limit into an inadequate one without anyone doing anything wrong. Review your commercial property limits annually, and specifically update the value of donated equipment, program vehicles, and technology you have acquired since the last renewal.

Step 4: Verify limits against contracts, leases, and grants

Pull every agreement your organization signed in the past year and extract the insurance requirements. Look for:

• Required limits per occurrence and in the aggregate
• Required coverages you may not carry (professional liability, abuse, cyber, auto)
• Additional insured obligations and whether they extend to completed operations
• Waiver of subrogation requirements
• Primary and non-contributory language
• Required notice-of-cancellation provisions

Then confirm your program satisfies the highest requirement across all agreements, not the average. If a funder requires $2 million combined and your general liability sits at $1 million, an umbrella or excess policy is usually the efficient fix — but only if it sits over the correct underlying policies.

Step 5: Check the retroactive date on every claims-made policy

Your D&O, EPLI, professional liability, and cyber policies are likely claims-made. A retroactive date eliminates coverage for claims arising from wrongful acts that took place before a specified date, even when the claim is first made during the policy period (IRMI).

At every renewal, record the retroactive date for each claims-made policy in a single document. If you change carriers, confirm in writing that prior acts are being picked up. If you are closing a program, merging, or dissolving, price an extended reporting period — the window after expiration during which a claim can still be reported and coverage triggered (IRMI) — before you cancel anything. Our EPLI deep dive explains why this single date carries so much weight.

Step 6: Reconcile employees, volunteers, and contractors

This step prevents both a coverage gap and a premium surprise. Build a roster with three columns and place every person in exactly one.

The distinction is legally consequential. Unpaid, uncompensated volunteers doing charitable work for a nonprofit are not considered employees and do not have to be covered by workers' compensation in New York — but nonprofits that compensate individuals must obtain coverage for employees, subject to listed exceptions, and "compensation" includes stipends, room and board, and other perks with monetary value, though reimbursement of actual expenses does not count (NY Workers' Compensation Board).

Two audit-time consequences follow. A stipended "volunteer" may be an employee whose payroll belongs in the workers' comp calculation. And a genuinely uncompensated volunteer who is injured generally has no workers' comp benefit available — which is the argument for volunteer accident coverage as a separate line item. Requirements differ by state; Texas, for example, leaves workers' compensation elective for most private employers, though non-subscribers must report that status and report work-related injuries (TDI). Confirm your own state's rules rather than carrying an assumption forward. The nonprofit workers' compensation guide covers this in more detail.

Step 7: Clean up your certificate of insurance file

Certificates run in both directions, and both need annual attention.

Inbound. Collect current certificates from every vendor, subcontractor, and facility user — caterers, contractors, transportation providers, groups renting your space. Track expiration dates and chase renewals. Understand the limit of what a certificate proves: ACORD's own guidance is that "a Certificate of Insurance is NOT an insurance policy, and does not serve to provide, endorse, amend, extend or alter in any way the terms of an insurance policy," and certificates generally exist for informational purposes and do not on their own confer additional insured status (IRMI). If a contract requires additional insured status, ask for the endorsement, not just the certificate.

Outbound. Keep a list of everyone who must receive your certificate — landlords, funders, event venues — so renewal certificates go out automatically rather than in response to a complaint.

Step 8: Prepare for the premium audit

A premium audit is an audit of the exposure basis for a policy — payroll, sales, or vehicle count — after the policy period ends, to determine actual exposure and calculate final premium (IRMI). Payroll is the premium basis in workers' compensation and, for some classifications, in general liability (IRMI).

This is why an estimate submitted at binding becomes a bill at year end. To prepare:

• Reconcile payroll registers against your general ledger before the auditor arrives
• Separate payroll by job function so people are assigned to the right classification
• Document overtime separately, since some classification rules treat the excess portion differently
• Have 1099 records and subcontractor certificates ready — uninsured subcontractors are frequently charged as payroll
• Keep volunteer records distinct from employee records
• Review the auditor's worksheet before it is finalized, and dispute misclassifications in writing

Budget for the possibility of an additional premium if you grew. Organizations that add staff mid-year and never adjust the estimate are the ones surprised in month thirteen.

Step 9: Update the risk-management side

An audit is also the moment to revisit how you prevent claims, not just how you pay for them. Look at what changed in the last year — new programs, new locations, new equipment, more volunteers, a first paid employee — and confirm your written procedures, waivers, screening practices, and vehicle-use rules still match how the organization actually operates.

Confirm specifically that: background screening covers everyone with access to vulnerable populations; supervision ratios reflect current program size; drivers have current MVR checks and adequate personal auto limits; your employee handbook and complaint procedure have been updated; and incident reporting is happening rather than being handled informally. Underwriters weigh these controls, and tightening them is often the most durable way to improve both your risk and how your submission is received.

A working renewal calendar

Common mistakes

• Rolling forward last year's application. Stale exposure data is the leading cause of both underinsurance and audit surprises.
• Comparing premiums instead of programs. A lower quote with a lower abuse sublimit, a reset retroactive date, or eroding defense costs is not a savings.
• Ignoring closed zero-payment claims. They still register as frequency in underwriting.
• Treating the certificate as the coverage. It is informational; the endorsement is the coverage.
• Skipping the review in a quiet year. Quiet years are when retroactive dates and property values drift unnoticed.

Frequently asked questions

When should we start the renewal process? About 90 days before your expiration date, which is the timeline the Nonprofit Risk Management Center recommends for beginning renewal work. Complex or claims-affected accounts benefit from more.

What is a loss run and how do we get it? It is a periodic report of your claim information from the insurer (IRMI). Request it from your agent or directly from each carrier; ask for three to five years, valued as of a recent date.

Why did we get a bill after our policy expired? Most likely a premium audit. Auditable policies are priced on estimated exposure and adjusted to actual exposure after the period ends (IRMI).

Do we need a new appraisal every year? Not necessarily an appraisal, but you do need current values. Coinsurance provisions penalize recovery when the limit purchased falls below the required percentage of value (IRMI), and construction costs move.

What happens to old claims if we switch D&O or EPLI carriers? It depends entirely on the retroactive date and any prior acts agreement. Get the answer in writing before you bind, and consider an extended reporting period on the expiring policy.

Do we really need to collect certificates from vendors? Yes — and where a contract requires additional insured status, request the endorsement, because the certificate alone does not confer it (IRMI).

Make this year's review the useful one

If you would like a second set of eyes on the full program — limits against contracts, retroactive dates across every claims-made policy, property values, and audit exposure — that is the review we do for nonprofit clients. See how the pieces fit in our nonprofit insurance overview, work through the coverage checklist alongside it, or request a quote and policy review.