A nonprofit insurance checklist should start with what your organization actually does — who it serves, who drives, who volunteers, what it owns, and what it promises in contracts — and only then move to coverage names. Most nonprofits need general liability and property as a foundation, a management liability program (D&O plus employment practices liability), and then a set of coverages driven by specific exposures: abuse and molestation, hired and non-owned auto, professional liability, cyber, and crime. The gaps that hurt are rarely the coverages nobody thought of; they are the ones people assumed were already included.
Build the checklist from exposures, not from a coverage list
Before you compare quotes, write down the answers to these questions. They determine both what you need and what an underwriter will charge for it.
- Who do you serve? Minors, elderly clients, people with disabilities, people in crisis, or the general public?
- Who does the work? Paid employees, volunteers, independent contractors, or a mix?
- Does anyone drive? Owned vehicles, personal cars used for program work, or rented vans for events?
- What do you occupy? Own a building, lease space, or operate out of donated facilities?
- What do you promise? Grant agreements, leases, and vendor contracts often specify coverages and limits.
- What have you claimed? Prior claims — even closed, zero-payment ones — shape your renewal.
If you want the broader picture of how these pieces fit together for a mission-driven organization, start with our nonprofit insurance overview and then use this checklist to pressure-test the details.
The core checklist
| Coverage | Evaluate it when… | Why it matters |
|---|---|---|
| General liability | Always | Third-party bodily injury, property damage, personal and advertising injury |
| Commercial property | You own or lease space, or own equipment | Buildings, contents, computers, program supplies |
| Directors & officers | You have a board | Personal exposure of directors and officers for management decisions |
| Employment practices liability | You have any employees | Wrongful termination, discrimination, harassment, retaliation |
| Workers' compensation | You pay anyone | Required in most states for employees; rules vary |
| Abuse & molestation | You serve minors or vulnerable adults | Commonly excluded or sublimited on the base GL form |
| Hired & non-owned auto | Staff or volunteers drive for you | Fills the gap when the vehicle isn't yours |
| Professional liability | You counsel, place, teach, or case-manage | Errors and omissions in delivering services |
| Cyber | You hold donor or client data | Breach response, notification, liability |
| Commercial crime | Anyone touches money | Employee dishonesty and theft |
| Fiduciary liability | You sponsor a benefit plan | Claims over plan administration |
| Umbrella / excess | Contracts require high limits, or exposures are severe | Additional limit above GL, auto, and employers liability |
Smaller organizations often package the first two into a business owner's policy. You can browse how each of these is written on our coverages page or within our broader commercial insurance practice.
Five gaps nonprofits discover after the claim
1. Volunteers are usually not covered by workers' compensation
This is the single most misunderstood item on any nonprofit checklist. Workers' compensation generally responds to employees, and volunteers typically are not employees. New York, for example, states plainly that "unpaid and uncompensated volunteers doing charitable work for a nonprofit organization are not considered employees and do not have to be covered by a workers' compensation policy," while nonprofits that compensate individuals must obtain coverage for employees, subject to specific exceptions (NY Workers' Compensation Board).
Two traps follow. First, "compensation" is broader than a paycheck — New York counts stipends, room and board, and other perks with monetary value, though reimbursement of actual expenses does not count. A stipended volunteer may be an employee for workers' comp purposes. Second, if a volunteer is genuinely uncovered and gets hurt, there is no statutory benefit waiting for them. The Nonprofit Risk Management Center notes that nonprofits may be able to extend workers' compensation to volunteers, and volunteer accident coverage is a separate product worth pricing. Our nonprofit workers' compensation guide walks through the employee-versus-volunteer analysis in more depth.
Also worth knowing: workers' compensation is not mandatory in every state for every employer. Texas is the clearest example — the Texas Department of Insurance states that "private employers can choose to carry workers' compensation insurance coverage, but it is not required in most cases," though non-subscribers must report their status and report work-related injuries to the state (TDI). Requirements turn on your state, entity type, and headcount. Verify yours; do not assume.
2. Abuse and molestation is frequently carved out of the base GL form
A sexual abuse exclusion "precludes coverage for claims alleging sexual abuse," and is also called a molestation exclusion (IRMI). Coverage is commonly restored through a standalone form or an endorsement — the Nonprofit Risk Management Center describes abuse coverage as available as a stand-alone policy form or integrated into other policies. If you run programs for children, youth, or vulnerable adults, read the actual grant of coverage and its sublimit rather than trusting a proposal summary. See our abuse and molestation coverage explainer and, for program-specific detail, the youth and childcare program insurance guide.
3. Nobody's auto policy is squarely on the hook
In the business auto policy, a nonowned auto specifically includes "vehicles owned by employees and used for company business" (IRMI). If your case manager drives a client in her own car, or a volunteer picks up donations in his truck, your organization can be pulled into the suit even though it owns no vehicle. The Nonprofit Risk Management Center describes non-owned auto liability as protecting the organization when volunteers use personal vehicles for nonprofit business. Add hired and non-owned auto liability and pair it with a written vehicle-use and MVR-check policy.
4. Property of others in your care
The standard commercial general liability form excludes damage to personal property in the insured's care, custody, or control — exclusion j.4. in the post-1988 ISO CGL (IRMI). Thrift stores holding consigned goods, arts organizations borrowing instruments or artwork, and shelters storing residents' belongings all sit in this gap. A legal liability coverage form is one way to address it.
5. Board members are not shielded by tax status
501(c)(3) status is a tax classification. It is not a liability shield. The federal Volunteer Protection Act does grant limited immunity to volunteers of nonprofits who act within the scope of their responsibilities, hold any required license, and did not cause harm through willful or criminal misconduct, gross negligence, reckless misconduct, or while operating a motor vehicle requiring licensure or insurance. Critically, the statute provides that "nothing in this section shall be construed to affect the liability of any nonprofit organization or governmental entity with respect to harm caused to any person" (42 U.S.C. § 14503). The organization remains exposed, and defense costs arrive long before any immunity question is resolved. That is the job of D&O insurance — see why D&O matters for nonprofit boards.
Illustrative scenarios
The following are hypothetical illustrations only. They are not real claims, and outcomes always depend on the actual policy language, endorsements, and facts.
| Hypothetical situation | Coverage most likely in play | The gap to check |
|---|---|---|
| A visitor slips in your lobby | General liability | Adequate limits; medical payments sublimit |
| A volunteer rear-ends a car while delivering meals in her own vehicle | Hired & non-owned auto, excess auto | Is HNOA on the policy at all? |
| A terminated program director alleges retaliation | EPLI | Retroactive date; defense inside the limit |
| A donor database is exfiltrated | Cyber | Notification and forensics sublimits |
| A grant funder demands proof of $2M in combined limits | GL + umbrella | Does your umbrella sit over the right underlying policies? |
What underwriters actually evaluate
Nonprofit submissions are underwritten on operations, not on mission statements. Expect to supply:
- Annual budget or revenue, and the split between program, fundraising, and administrative spend
- Employee headcount and payroll by function, plus volunteer counts and hours
- A description of every program, including populations served and whether minors or vulnerable adults are involved
- Transportation practices — who drives, in what, with what screening
- Special events: number, attendance, whether alcohol is served, whether third parties are hired
- Facility details: owned or leased, square footage, occupancy, construction, protection
- Governance: board size, meeting frequency, financial controls, conflict-of-interest policy
- Screening and supervision protocols for anyone working with vulnerable populations
- Three to five years of loss runs
Organizations in human services, youth development, mental health, and housing and shelter get the most scrutiny on the last two items. Religious organizations, arts and culture, and membership organizations tend to draw questions about events and facility use instead.
How much limit is enough?
There is no universal answer, but there are three anchors. First, contractual floors: leases, grant agreements, and vendor contracts often state a required limit — meet the highest one. Second, published guidance: the Nonprofit Risk Management Center suggests entry-level general liability limits of $1 million per claim and $1 million aggregate, with higher limits recommended for D&O. Third, severity: if a single incident could involve multiple claimants — a van accident, an event injury, an abuse allegation — the primary limit is rarely the right stopping point, and an umbrella becomes the cheapest limit you will buy.
Common mistakes
- Buying by price across mismatched carriers. Splitting GL, auto, and umbrella across three insurers creates seams where each points at the other.
- Assuming the D&O policy includes employment practices coverage. Sometimes it does; sometimes it is a separate insuring agreement with its own limit.
- Never reading the abuse endorsement. A $100,000 sublimit and a $1 million limit are very different answers.
- Treating volunteers as risk-free. They create auto, injury, and supervision exposure the organization owns.
- Letting claims-made coverage lapse. A gap can erase years of prior-acts protection. More on that in our annual insurance review process.
Frequently asked questions
Do we need insurance if we have no employees and no building? Usually yes. General liability responds to third-party injury wherever you operate, and D&O responds to board decisions regardless of payroll. If anyone drives for the organization, non-owned auto belongs on the list too. Newly formed organizations can start with our startup nonprofit guidance.
Are our volunteers covered by our insurance? It depends on the policy. General liability and D&O forms frequently include volunteers as insureds, but the Nonprofit Risk Management Center cautions that this depends on the specific policy language. Workers' compensation generally does not cover volunteers unless the organization elects to include them.
Does 501(c)(3) status protect our board members from lawsuits? No. Tax-exempt status has no bearing on liability. Limited volunteer immunity under 42 U.S.C. § 14503 has significant exceptions and does not protect the organization itself.
Is workers' compensation required for our nonprofit? It depends on your state, your headcount, and whether the people doing the work are compensated. Texas leaves it elective for most private employers (TDI); New York requires it for nonprofits that compensate individuals, with defined exceptions (NY WCB). Confirm your own state's rule.
We don't work with children. Do we still need abuse coverage? Consider it if you serve any population that could be characterized as vulnerable — elderly clients, people with disabilities, people in residential or crisis settings. The exposure follows the relationship, not the age.
Do we need cyber insurance for a small donor list? Notification obligations and forensic costs are driven by the number of affected records and applicable law, not by budget size. Our cyber coverage overview for nonprofits covers what a small organization should look for.
Turn the checklist into a program
Working through this list surfaces the specific questions worth asking — which endorsements you actually have, where the sublimits sit, and whether your limits satisfy the contracts you have already signed. If you would like an independent agent to run that comparison against your current policies, request a nonprofit insurance quote or get in touch with our team. We will tell you what is genuinely missing, not just what is available to sell.