For 501(c)(3) Public Charities, Foundations + Federally-Funded Nonprofits
Nonprofits sit at a regulatory crossroads few sectors face. IRS Form 990 + Schedule O public on Candid/GuideStar. OMB Uniform Guidance 2 CFR 200 on every federal dollar. Single Audit obligations once federal awards exceed thresholds. FASB ASC 958. State charity registrations in 40+ states. PCI DSS on every online donation. SOX §1107 + §802 whistleblower + records retention. RiskWatch unifies all of it as one survey-based assessment platform sized for compliance directors, grants managers, and audit committee chairs.
Trusted by public-mission organizations + healthcare 501(c)(3)s managing IRS Form 990, OMB Uniform Guidance, Single Audit, multi-state charity registrations, donor PCI DSS, and audit-committee evidence across federal grant streams, foundation funding, and state oversight.
Why Compliance Directors + Grants Managers Pick RiskWatch
RiskWatch runs IRS Form 990 + Schedule O, OMB Uniform Guidance 2 CFR 200, Single Audit prep, FASB ASC 958, multi-state charity registrations, donor PCI DSS, SOX §1107 + §802 obligations, and Charity Navigator + Candid Seal mapping as one program on one platform, scored against the same controls library, and tracked through a single audit-ready evidence trail. Built for nonprofits where one compliance director + grants manager + finance team covers every regulator, every funder, and every audit cycle, without enterprise-bank GRC overhead or six-figure consulting fees that should be going to mission spend.
Form 990 Schedule O governance disclosures + OMB Uniform Guidance 2 CFR 200 + Single Audit prep + FASB ASC 958 cross-mapped. Conflict-of-interest, whistleblower, document-retention, and audit-committee evidence shared across all four, no parallel binders for the auditor, the IRS, and the federal funder.
40+ state charity registration cycles tracked as overlays. Annual filings, registration renewals, fundraising-counsel disclosures, and state-by-state audit-threshold tracking run from the same evidence vault used for federal compliance, not a parallel spreadsheet per state.
Compliance director + grants manager + finance director + audit committee chair share one platform. Pre-built libraries cut prep time. White-glove implementation in 30 days, not 6 months. Pricing built for mission-driven budgets, not Fortune-500 GRC.
The Nonprofit Regulatory Landscape
IRS Form 990 + Schedule O governance disclosures are public on Candid/GuideStar, every donor, regulator, and watchdog reads them. OMB Uniform Guidance 2 CFR 200 governs every federal dollar awarded to a nonprofit. Single Audit is mandatory above $750K in annual federal awards. State charity registrations are required in 40+ states with their own forms and renewal cycles. PCI DSS 4.0 applies to every online donation form. SOX §1107 + §802 explicitly extend whistleblower + records-retention obligations to tax-exempt entities. Each regulator wants its own evidence package.
Three Domains, One Platform
RiskWatch covers all three. Each domain has a dedicated workflow, scoring model, and remediation queue. They share data so a single conflict-of-interest record satisfies Form 990 Schedule O Part VI, OMB Uniform Guidance 2 CFR 200.318 (procurement integrity), board governance policy, and the federal funder's grant-agreement language simultaneously.
Survey-based risk assessment across donor data, grant compliance, conflict-of-interest, and reputational risk, aligned to Form 990 governance and Charity Navigator standards.
IRS Form 990 + Schedule O, OMB Uniform Guidance 2 CFR 200, Single Audit prep, FASB ASC 958, and 40+ state charity registrations in one cross-mapped library.
PCI DSS 4.0 for online donations, NIST CSF 2.0 + ISO 27001:2022 for donor + program data, and SOX §1107 + §802 records-retention controls across every system.
The Coverage Gap
Nonprofit accounting platforms cover the books and 990 prep. CRM and donor platforms cover gifts and online giving. Grant management tools cover federal grant drawdowns. State charity registry tools cover one filing form. Each does one job. Compliance directors still operate four parallel programs, and a spreadsheet for the audit committee.
| Platform Category | 990 / IRS | OMB UG | Single Audit | PCI DSS | Donor Privacy | Multi-state |
|---|---|---|---|---|---|---|
| NPO Accounting PlatformsSage Intacct NPO, Blackbaud Financial Edge | Partial | Partial | Partial | · | · | · |
| CRM / Donor PlatformsSalesforce NPC, Bloomerang, DonorPerfect | · | · | · | Partial | Partial | · |
| Grant Management ToolsFluxx, Submittable, GrantHub | · | Partial | Partial | · | · | · |
| Internal Audit / ERMWorkiva, AuditBoard | Partial | Partial | Partial | · | · | · |
| State Charity Registry ToolsHarbor Compliance, Labyrinth | · | · | · | · | · | Yes |
| Spreadsheets & Email | · | · | · | · | · | · |
| RiskWatchThe unified audit-ready platform | Yes | Yes | Yes | Yes | Yes | Yes |
RiskWatch is the only platform covering all six nonprofit compliance domains: IRS Form 990 + Schedule O governance, OMB Uniform Guidance 2 CFR 200, Single Audit prep, PCI DSS 4.0 for donor data, donor + program privacy, and 40+ state charity registrations. NPO accounting platforms cover the books. Donor CRM platforms cover gifts. Grant management tools cover federal drawdowns. Each does one job. RiskWatch unifies all six in one survey-based assessment workflow.
How It Works
RiskWatch is a survey-based assessment platform. The work is structured around questionnaires that capture governance, grant compliance, financial controls, donor data, and cybersecurity posture in a consistent format, then scored against every framework you align to.
For nonprofits, that workflow runs continuously across IRS Form 990 + Schedule O, OMB Uniform Guidance 2 CFR 200, Single Audit preparation, FASB ASC 958, 40+ state charity registrations, PCI DSS 4.0, SOX §1107 + §802 records, and Charity Navigator + Candid Seal. A single conflict-of-interest record scores against Form 990 Schedule O Part VI, OMB UG 2 CFR 200.318, the audit-committee charter, and the organization's own governance policy simultaneously.
The same platform runs all of it, surfaces gaps before the auditor or federal program officer arrives, assigns remediation owners, and tracks completion. Replace the four parallel tools and the spreadsheet bridge between them.
Built For Your Role
Owns day-to-day program execution, vendor management, and operational risk across multi-state programs and federal grant streams.
Operational risk register live. Vendor + subrecipient evidence captured continuously. Multi-state operations tracked from one console.Owns IRS Form 990 + Schedule O governance, OMB Uniform Guidance, conflict-of-interest, whistleblower, and multi-state charity registrations.
990 + Schedule O governance evidence captured year-round. OMB UG + Single Audit ready. State charity filings tracked from one place.Owns federal grant drawdowns, OMB Uniform Guidance compliance, subrecipient monitoring, and foundation grant reporting.
OMB UG 2 CFR 200 evidence live. Subrecipient monitoring documented. Federal program officer questions answered from the same vault.Owns FASB ASC 958 financial reporting, Single Audit preparation, internal controls over financial reporting, and audit-committee finance reporting.
Single Audit prep continuous. ASC 958 evidence captured. Internal controls scored. Audit-committee finance report built from live data.Owns audit-committee oversight, external auditor liaison, whistleblower complaint review, and board-level risk reporting under Form 990 governance.
Board + audit-committee dashboards live. Whistleblower complaints tracked + reviewed. External auditor evidence exports on demand.Owns PCI DSS for online donations, NIST CSF 2.0 + ISO 27001 for donor + program data, SOX §802 records retention, and donor-privacy posture.
PCI DSS 4.0 evidence captured. NIST CSF + ISO 27001 mapped. Records retention + whistleblower technical controls in place.Built For Your Segment
National 501(c)(3) public charities operating across multiple states under IRS Form 990, OMB Uniform Guidance, Single Audit, and 40+ state charity registrations.
Mid-cap operating charities scaling federal + foundation grants, often crossing the Single Audit threshold and registering in 10–25 states.
Private foundations + community foundations under IRS Form 990-PF, payout requirements, expenditure-responsibility rules, and donor-advised fund oversight.
Nonprofits drawing federal awards from HHS, DOJ, DOE, DOS, and other agencies under OMB Uniform Guidance 2 CFR 200 + agency-specific terms.
Churches, religious orders, and faith-based service organizations balancing 501(c)(3) status, denominational governance, and grant-funded program work.
Tax-exempt hospital systems + healthcare nonprofits running Form 990 + Schedule H community-benefit reporting alongside HIPAA + healthcare-specific rules.
Frameworks We Cover
RiskWatch ships with pre-built libraries for every major US nonprofit regulation + accounting standard + watchdog rating system. Map controls once. Score against the framework that matters this audit cycle.
Trusted by 1,500+ risk and compliance teams
We had four binders running 990 + Schedule O governance, OMB Uniform Guidance for our HHS and DOJ grants, multi-state charity registrations across 27 states, and donor PCI DSS for online giving, plus a separate spreadsheet for the audit committee. Now it's one platform. Conflict-of-interest, whistleblower, document-retention, subrecipient monitoring, and donor-privacy evidence all run from the same vault. Our last Single Audit produced zero questioned costs and one minor finding instead of seven.
Resources
Public Charities · Foundations · Federally-Funded
30-minute walkthrough of the nonprofit library, your grant + state inputs, and the single evidence-trail output. No slideware, no consulting upsell, no Fortune-500 pricing.
Or call US: +1 941-500-4525
