COVID-19 FAQ: Nonprofit & Education

A. Community-based problems are best coordinated by community-based organizations. It’s no surprise that nonprofits have been on the front lines helping communities suffering as a result of the novel coronavirus (COVID-19) outbreak. Many are leaning into their missions, striving to continue their programming and services and working with private sector companies that are looking to adjust their business models to help respond to this crisis.

To find new opportunities for your nonprofit to lend support, identify the most significant concerns facing your community—and its surrounding areas—then map out how your organization could help address them given existing capabilities. Also, look to other types of businesses, such as manufacturers shifting from producing spirits to sanitizer and restaurants using their kitchen to help feed the hungry. Your organization may have the experience and infrastructure to help these companies optimize their new operations. Both public and private-sector entities can work together to empower local leadership and push the concept of “power to the edge,” involving empowering individuals at the edge of an organization to interact with that organization’s operating environment in a way that impacts the larger environment. Offering to collaborate inside—and beyond—your own organizational silos for the greater public good could help your organization come out on the other side of this stronger than before.

A. Cybersecurity is a vital concern in a largely digital economy. For this reason, safeguarding against cyber threats is more important now than ever before. While organizations scramble to respond to the COVID-19 outbreak, the rate of telecommuting has increased dramatically, potentially increasing the number of network entry points. Cyber-attackers have also become more aggressive, probing to exploit any vulnerability and leverage new attack vectors. More than ever, it is imperative to take the necessary steps to monitor and protect against cyber threats.

Strong access controls ensure that only those who are authorized can access sensitive data, while audit controls track access to systems. Intrusion detection systems can also monitor traffic across the network and raise alerts about any suspicious activity, making it possible to stop cyber threats as they arise.

A cloud VPN for employees can provide secure access to the organization’s network and shared files and encrypt all data. Two-factor authentication further strengthens these protections.

Internal threats are also a significant concern, but these can be mitigated by audit controls and intrusion detection. Staff should also be trained to identify any suspicious activities, such as phishing emails, and promptly report any dubious messages to the IT department. Employees should also be trained on proper documentation practices and protocols to avoid any unintentional data loss.

Faced with a litany of potential threats and limited resources, organizations can benefit from threat-based cybersecurity. This approach identifies the most common attack vectors and focuses security efforts on protecting aspects of the network that are most likely to be targeted by threat actors. Businesses should also review their cyber insurance policy to understand coverage and the potential costs of filing a claim. Lastly, firms should develop, review and update incident response and business continuity plans as necessary, in order to remain proactive about emerging threats and vulnerabilities during a changing business climate.

For more, view our insight: Protecting Your Organization from COVID-19 Cyberthreats.

A. Funders’ priorities have shifted in the wake of COVID-19. Reports from several groups and donor advised funds suggest that, in the immediate term, impact investors are shifting to fund health and human services groups who can expedite support for critical areas of need during the crisis. Funders are also stepping up oversight of the organizations they support, ensuring appropriate workforce protection, financial sustainability and assessing opportunities to shift priorities to areas of greater need or higher impact.

However, many grantmaking foundations are agreeing to loosen requirements for their grantees in the short term in an attempt to allow for some flexibility on things like grant goals and reporting deadlines. Many others are creating rapid response grants specifically aimed at organizations working to provide services during the pandemic.

A. Even during times of significant uncertainty, nonprofit organizations must keep their mission as the North Star guiding their response. Many organizations may face interruptions to programming as a result of reduced travel and social distancing—but that doesn’t mean furthering your mission should take a backseat.

Organizations must be prepared for an extended crisis environment as a pandemic fuels significant threats including cyberattacks, fraud, regulatory changes, supply chain disruptions and bankruptcies. Organizations need to take a step back and put together a crisis management team and a response program that includes executive leaders, investment advisors and communications and program staff. This team should assess how to maintain as much normalcy as possible while limiting exposure risks to both their own employees and the constituencies they serve. With cashflows for many nonprofits significantly disrupted, liquidity and sustainability must also be a driving force of decision-making. Nonprofits should also view the crisis as a catalyst for needed change, as the sense of urgency, cooperation, need for innovation and decisiveness that emerges in crisis can also help secure viability for the organization. As organizations look to the future, they should apply lessons learned and update their risk program.

A. In response to the novel coronavirus pandemic, governments around the globe have taken action to provide both companies and individuals with tax relief designed to increase cashflow and help companies continue to employ their workers. In the U.S., The Coronavirus Aid, Relief, and Economic Security (CARES) Act addresses the economic impacts of COVID-19 and includes a number of tax relief options.

All 501(c)(3) organizations have the option of paying unemployment insurance tax or self-insuring. The CARES Act reimburses 501(c)(3) organizations for half of their costs of unemployment benefits provided to laid-off employees. For charities that are tax-exempt from unemployment laws, the organizations are not eligible to receive unemployment benefits. However, organizations can receive this benefit if they voluntarily choose to self-insure.

The CARES Act also allows employers to claim a new credit against applicable employment taxes in an amount equal to 50% of the qualified wages paid after March 12, 2020, and before Jan. 1, 2021, with respect to certain employees, up to a maximum of $10,000 of wages per employee.

The Act includes a specific section related to nonprofit organizations, which allows organizations to be reimbursed for half of the costs incurred through the end of 2020 to pay unemployment benefits.

The CARES Act includes payroll tax credits for employers that have been harmed by COVID-19 but have retained their employees, and permits employers to defer payment on the employer portion of Social Security tax that would otherwise be due at the end of this year.

While there are many tax savings opportunities included in the CARES Act, eligibility for some provisions is dependent on size and other factors, and many benefits are mutually exclusive or have other tax implications. Given the level of complexity in applying these provisions, it is critical organizations consult with tax professionals in order to maximize their savings.

For information on how nonprofits can benefit from the CARES Act, read our recent blog post.

A. It’s critical to remember that things are far from business as usual, and employees’ home lives are integrated with their work like never before. Many employees have added the roles of teacher and caregiver to their daily responsibilities. From the C-suite to the front lines, organizations should be seeking to support employees through clear communications, reduced focus on milestones or productivity measures that may not be realistic and by promoting services and resources for employees that need them. Nonprofits should also ensure their employees are aware of any relevant support or relief measures they have access to. The Families First Coronavirus Response Act, for example, ensures workers even of small organizations have access to paid sick leave and expanded family and medical leave for specified reasons related to COVID-19.

A. To understand your respective organization’s revenue impact, you need to find answers to questions like how many of your offices, programs or stakeholders are in locations with higher outbreaks of COVID-19; what facilities or other assets you can convert to serve additional functions that would be more useful during this time; and how you can insulate your programs from disruption, among others. Once you gain a better understanding of your potential risk areas—and mitigation strategies—you can build scenario models to determine varying levels of risk to revenue and execute against a plan that aims for the lowest impact. Nonprofits should ensure they are able to maintain adequate liquidity in the short term.

For organizations that have implemented a digital strategy, they have real-time data and strong analytics in their back pocket and should use these tools to inform their financial decisions.

Instead of forecasting a single revenue figure, progressive organizations have turned to forecasting a range of potential outcomes. The range is used as a guide for contingency plans. Flexibility to respond to revenue or demand fluctuations increases an organization’s resilience to disruption—be it an unexpected demand surge or problem with fundraising. While you can’t predict the future, harnessing your most relevant, up-to-date information about your business to inform critical decisions comes close.

A. Each organization has a unique risk profile, so conducting a business continuity risk assessment is vital to developing an action plan to mitigate that risk. Accounting for the location of facilities and the nature of operations will prove largely valuable for determining your organization’s short-term risk profile, so nonprofit organizations should identify possible disruptions to operations according to those variables, and then prepare a set of processes to minimize the probability of each one. They should also evaluate any applicable third-party vulnerabilities with suppliers, vendors and customers. Scenario planning for a range of circumstances can also help identify potential risks for the medium term that may not yet be apparent.

Many nonprofits could face significant risk to their supply chain as a result of the COVID-19 pandemic, which has caused widespread travel restrictions, closed nonessential businesses and created workforce shortages. This has led to significant delays and a shortage of goods and services, and often nonprofits are attempting to fill those gaps. Maintaining consistent communication with suppliers can help to share updated information about key issues, including availability and order fulfillment time. To mitigate these supply chain issues, nonprofits can also explore possibilities for diversifying suppliers and using alternate supply sources, where applicable.

Human capital represents one of the most important assets of any nonprofit but can also pose significant risks. The COVID-19 pandemic created new challenges in terms of workplace environment and safety. There are also other human capital risks like the increased costs of overtime and/or hazard pay, competition from big box stores for minimum wage-level workers, and the possibility of government funding cuts. Nonprofits will need to find solutions for these issues and should consider policy changes and technology investments to allow for effective telecommuting. They should also look at new financial modeling, including zero based budgeting, to ensure they maintain financial sustainability.

Cybersecurity is another critical source of risk, and cyber threats have only risen during the crisis. The expansion of remote work creates more vulnerability and additional entry points for threat actors. The IT department can help protect against this risk by using tools for access control, audit control, intrusion detection and data loss prevention to ensure system security. Also, if remote workers need to access files on the network, using cloud computing with data encryption helps protect that data, and ensuring employees use a cloud VPN with two-factor authentication can prevent unauthorized access.

A. While there is no regulator requiring nonprofits to file financial statements by a certain date, but they typically are required to submit them to creditors, which can have varying deadlines. Organizations should speak with their creditors to see if they can secure extensions on these deadlines where possible.

Most charities that solicit contributions from donors also have responsibilities to file annual reports with a charitable solicitation bureau, typically under the state Solicitor’s office. Often, these reports are required to include an organization’s financial statements. and they typically require a financial statement copy to be attached. As a result of the pandemic, several states have provided extensions on the deadlines for these reports, so organizations should confirm what is available in the state where they are domiciled.

Additionally, the Office of Management and Budget (OMB) released a memo in late March intended to allow agencies to provide federal award recipients with some flexibility on certain requirements and costs during this challenging time. Nonprofits that are the recipients of federal awards should reach out to federal funders proactively to avail their organizations the flexibilities authorized by the OMB.

While banks and regulators may relax reporting deadlines, nonprofits should still prioritize getting financial information to stakeholders and donors as soon as possible. Nonprofits should also consider updating the disclosures within their financial statements to highlight how COVID-19 has affected their financials, including details on donations, access to grants or government contracts, investment values and liquidity. Doing so allows organization to explain how COVID-19 has affected their finances, and to lay out a plan for moving forward. Significant delays in reporting to stakeholders could lead to negative perceptions around the health and sustainability of the organization.

For more on how to take advantage of these extensions, read our report on the accounting and reporting impacts of COVID-19.

For more information on the OMB guidance to federal agencies, read our blog post.