You know something about your compliance is not right, but you do not yet know what kind of not-right, and the kind decides everything.
Compliance trouble comes in shapes that need completely different responses: you do not know what you are required to do, the status that lets you exist is exposed, you are missing registrations or required policies, an audit is looming and you are not ready, or an everyday risk has never been mapped. And underneath all of them is one urgent sort: is this a gap you build your way out of, or an active problem already burning that needs a professional today. This sorts both, gets a professional onto anything acute now, and hands you a plan. It is a sorting instrument, not a fix, and it is not legal advice. It takes about ninety minutes and asks for whatever compliance records you can find and honesty about what you have actually done versus what you assume is handled.
If anything here involves a vulnerable person harmed or at risk, a credible threat, or a legal duty to report, stop the paperwork. Act to protect the person, meet your reporting duty, and get the right professional involved, immediately. Nothing in this diagnostic outranks a person's safety. Then route the internal side to the volunteer, staffing, or culture work as it applies.
Some findings are not gaps to build your way out of, they are fires. If any of these is true, get the right professional onto it this week, before the systems work, and keep working this diagnostic in parallel because you will still need the system:
A letter, notice, or investigation from a regulator, the state, or the taxing authority. A return so overdue your status may be at risk. An audit or funder review already underway with findings against you. A lawsuit, a threatened one, or a demand. Or anything involving a person's safety or a legal duty to report.
An attorney handles legal exposure, a nonprofit accountant handles tax and audit exposure, and a safety matter is acted on immediately per the safety gate above. The professional starts now.
You cannot diagnose compliance you have not laid out. Pull what you can find: your last annual return, your incorporation and any registrations, your insurance policies, your policy documents, any letters from regulators or funders about compliance, and any audit reports. Note what you cannot find, because a missing record is itself a finding. Then write down every place you have a nagging sense of legal or compliance exposure, even vague ones, because a worry you cannot yet name is a lead, not noise.
Open the Compliance and Risk Snapshot →First, make sure you are in the right place. Then place your trouble in one of the five shapes, because the shape decides the guide.
Good, you are in the right place. Answer each statement the way it really is. There is no shame in a low score; that is the whole point of looking.
A leader's belief that they are compliant is worth little until one honest check tests it, because the most dangerous case is an organization that assumes something is handled and it is not. For each thing you believe is handled, ask for the proof: the filed return, the registration confirmation, the adopted policy in the minutes, the current insurance certificate. Where you cannot produce the proof, treat it as not done. Then decide, for each area, plainly: is this a gap to build, or a fire already burning for a professional.
That has crossed from gap to active problem: get the professional on it now, and mark that guide your first priority. This is a route, not a stop.
Turn the finding into an ordered plan that names your first guide, any professional already engaged, and the order compliance is actually built: know what you owe, protect your status, get registered and policied, get audit-ready, manage your risks. Where you have more than one, build the calendar first because it surfaces the rest, then status, then registrations and policies, then audit-readiness, then risk. An overdue status problem jumps to the front regardless, because losing the status ends everything else.
Open the Prioritized Compliance Plan →This is the work where the edge fires most, and that is correct. Any active legal or tax problem, any regulator contact, any audit already underway, and any question of whether something you did was lawful goes to an attorney or a nonprofit accountant, not a worksheet. Anything involving a person's safety or a duty to report is acted on immediately and reported as the law requires. Naming these is not the guide failing. It is the guide being honest about where its edge is, in the domain where the edge matters most.
You can say, in one plain sentence, whether your trouble is not knowing what you owe, a threatened status, missing foundations, an unready audit, or an unmanaged risk. You have a written plan that names your first guide and a date. Anything on fire is already in the right hands. And you know the difference, for your organization, between what you assume is handled and what actually is.
Once the acute matter is handled and you are on your feet, it is worth stepping back to look at the whole organization, not just the part that was on fire. There is a short whole-organization check-up waiting when you are ready. That is not a sales pitch. It is the next honest thing to look at. The whole-organization check-up →