Nonprofits spend a lot of time thinking about funding risks, but maybe not in the right places. Some organizations appear financially stable on paper, but suddenly find themselves exposed to risks they didn't know existed. CPAs are uniquely positioned to identify structural vulnerabilities that could threaten operational continuity.
Nonprofits spend considerable time thinking about funding risk, and their boards typically frame the conversation around specific scenarios: "What happens if we lose this grant?" or "What if our major donor reduces support?" These are valid concerns, but often clients don’t actually represent where their financial vulnerability lies.
I've seen organizations that appear financially stable on paper, but suddenly find themselves exposed to risks they didn't know existed. Typically, it isn’t a funding problem in the traditional sense. It's a financial resilience problem, and it's one most nonprofits have never been taught to evaluate systematically.
CPAs who advise nonprofit clients are uniquely positioned to look beyond the surface-level financial picture and identify structural vulnerabilities that could threaten operational continuity. It requires asking different questions than we would typically ask during year-end reviews or audit planning.
What Financial Resilience Actually Measures
Financial resilience differs fundamentally from financial health. An organization may be meeting its obligations, growing programs, maintaining positive balances while still being structurally vulnerable to relatively minor disruptions. And traditional financial metrics don't capture it.
We can review a nonprofit's Form 990, analyze revenue diversification, and examine fund balances, and still miss the warning signs that an organization is one delayed reimbursement or paused grant away from serious operational strain. Financial resilience measures an organization's ability to continue operations without disruption when funding timing, availability, or structure change. It's about the organization's structural capacity to absorb and adapt to funding volatility.
The Diversification Illusion
Many nonprofits have impressively diversified revenue portfolios on paper: multiple federal and state grants, active individual giving, earned revenue from programs, and perhaps endowment or investment income. The revenue diversity percentages look good … until you look under the hood.
Here's what I've learned to look for:
-
Concentration risk hiding in plain sight – You may find that 60% to 80% of actual operating capacity depends on just two or three sources. The remaining sources may be restricted or too small.
-
Reimbursable funding creates structural dependency – An organization might have government contracts that look substantial, but if 90% arrives only after expenses are submitted and approved – which can take 60 to 90 days – the organization is dependent on either having significant reserves or perfect timing.
-
Restrictions that create unusable reserves – Balance sheets may show healthy fund balances, but with deeper conversation you may find those funds are restricted for capital projects, specific programs, or otherwise effectively unavailable for operational needs.
-
Revenue timing creates hidden cash flow risk – Often, nonprofits that have grown quickly add programs and staff based on annual revenue projections that are accurate, but the cash doesn't arrive evenly. They become reliant on lines of credit or delayed vendor payments to bridge gaps, even in profitable years.
Financial statements tell you how much funding exists, but they don't tell you how resilient the funding structure actually is when tested.
Warning Signs to Watch For
During routine client interactions (year-end reviews, interim check-ins, budget discussions) there are specific indicators that suggest a nonprofit may have structural resilience vulnerabilities. Here are just a few warning signs:
-
Client mentions recurring cash flow challenges despite positive annual results – When a nonprofit regularly discusses "timing issues" or frequently draws on a line of credit even with a budget projecting a surplus, that's often a signal that there is a structural timing mismatch between when obligations come due and when funding arrives.
-
Reserves are significantly below the formal policy target (or no policy exists) – If you ask about reserve policy and the answer is vague or nonexistent, that suggests the organization hasn't thought systematically about what level of reserves would be adequate given their funding structure and vulnerability profile.
-
Most revenue comes from cost-reimbursement contracts – When 70% or more of a nonprofit client’s revenue requires documenting expenses before payment arrives, this is an organization that cannot function without substantial reserves or perfect funding timing. For organizations heavily dependent on reimbursable government contracts, even short delays can create immediate operational strain.
-
Leadership can't articulate what happens if a major funder delays – If you ask what happens if your largest funder delayed payment by 60 days, and the response is uncertain, the organization hasn't stress-tested their resilience. Operating on an assumption that funding will always arrive as expected is overly risky.
-
Restricted funds dominate the balance sheet – If 60% to 70% or more of fund balance is restricted or designated, the organization has less operational flexibility than the total fund balance suggests.
-
Rapid program growth without reserve growth – When program revenue and expenses grow substantially but reserves have stayed flat, that suggests the organization is scaling its risk exposure without building the corresponding capacity to absorb disruption.
None of these indicators individually prove a resilience problem, but if you see several together, it's time for a deeper conversation with leadership about how their funding structure functions under stress.
The Four-Factor Framework
In my work with nonprofit clients at HBK CPAs & Consultants, I've found it helpful to look at resilience through four interconnected factors. Each can be strong or weak independently, which is why looking at them in isolation can be misleading. Here is what I look at:
-
Funding concentration – How dependent is the organization on a small number of sources? But I go beyond simple revenue percentages. I encourage clients to calculate what portion of their unrestricted, currently available operating capacity depends on their top three funders. That calculation often produces a very different picture than standard revenue diversity metrics.
-
Usable funding – How much revenue is actually available to support operational needs? Exclude restricted funds, funds that can only be accessed after specific expenses are incurred, and designated reserves. What I’m driving at here is, "How much revenue could you actually deploy if you faced a funding gap tomorrow?"
-
Funding timing – When does revenue arrive relative to when obligations come due? Nonprofits heavily dependent on reimbursable contracts may have significant structural vulnerability, even when annual revenue is more than adequate. If clients map out their expected monthly cash flow and then assume their major reimbursements are delayed by 30, 60, and 90 days, you will find vulnerabilities that weren't visible in annual budget projections.
-
Operating reserves – This isn't just about the absolute dollar amount in reserves; it's about whether that amount is appropriate given the organization's funding structure and vulnerability profile. An organization with primarily monthly donor revenue might be fine with three months of reserves; an organization with primarily quarterly reimbursable contracts might need six months or more to achieve equivalent resilience.
When examining these four factors together, rather than in isolation, you get a much clearer picture of whether an organization can withstand disruption.
Helping Clients Think Proactively about Financial Sustainability
The most valuable service CPAs can provide to nonprofit clients goes beyond identifying vulnerabilities: it's helping them develop a systematic approach to evaluating and improving their resilience.
This starts with altering the questions boards and leadership teams ask themselves. Instead of "Do we have enough funding?" the question should be "Is our funding structure built to withstand disruption?" Instead of "Are we diversified?" it should be "Is our diversification meaningful given our operational dependencies?"
I've found it helpful to walk clients through scenario planning that goes beyond their standard budget variance analysis. What happens if their largest government contract is delayed by 45 days? What if individual giving drops 20% during a recession? These aren't catastrophic; in fact, they're relatively ordinary disruptions a well-managed organization should be able to absorb.
For clients without formal reserve policies, developing one provides a framework for these conversations. The policy doesn't need to be complex, but it should articulate a target reserve level that's appropriate to funding structure. Document how that target was determined and outline the circumstances under which reserves can be used and how they'll be replenished.
Clients should also understand that building reserves isn't simply setting money aside: it's about examining whether the funding mix includes enough unrestricted, flexible revenue to support reserve accumulation.
Why This Matters Now
Nonprofit funding is becoming simultaneously more complex, more regulated, and more timing sensitive. Government contracting processes have grown more bureaucratic, with longer payment cycles and more stringent documentation requirements. Foundation funding is increasingly restricted for specific purposes. Even individual giving has become less predictable due to economic volatility and competing priorities.
All this makes it easy for risk to hide inside the funding structure. An organization could have more funding sources than ever, but is actually more vulnerable to disruption because of how that funding is structured and timed.
This creates both opportunity and responsibility for CPAs advising nonprofit clients. We're often the only outside voice with access to the detailed financial picture, the expertise to interpret it, and the trusted relationship to raise difficult questions. Boards of directors may not know what questions to ask about resilience, but we can help them frame their questions and develop the analytical framework to answer them.
For many nonprofits, the greatest financial risk isn't losing a particular grant or donor; it's being structured in a way that requires everything to go exactly right, all the time. This is a state of operation that's increasingly unrealistic in today's environment.
Starting the Right Conversation
For most nonprofit clients, improving financial resilience begins with a clearer understanding of where their specific vulnerabilities exist. That means looking beyond the annual financial statements and examining together the four resilience factors I mentioned before and have used to great effect.
As CPAs, we can facilitate that analysis of our clients’ particular funding structure and operating model and help boards and finance committees develop a more sophisticated understanding of their risk profile. Organizations that understand their actual resilience—not just their apparent financial health—are in a far stronger position to make strategic decisions, communicate effectively with funders, plan for growth, and navigate disruption.
The most important questions aren't always the ones being asked in board meetings. Our role as CPAs is sometimes to introduce the questions that should be asked, provide the analytical framework to answer them, and help translate the answers into actionable strategy. That's where real value lies—not in confirming that the numbers add up, but in helping our clients understand what the numbers mean for their ability to sustain their mission over time.
Dan Sefick, CPA, is national director, nonprofit solutions, with HBK CPAs & Consultants and a principal in the Pittsburgh, Pa., office. He can be reached at DSefick@hbkcpa.com.
Sign up for PICPA's weekly professional and technical updates by completing this form.
Statements of fact and opinion are the author's responsibility alone and do not imply an opinion on the part of the PICPA's officers or members. The information contained herein does not constitute accounting, legal, or professional advice. For actionable advice, you must engage or consult with a qualified professional.
