Nonprofit Insurance Renewal Checklist: 120 Days to Board Sign-Off
A nonprofit insurance renewal goes smoothly when you start about 120 days before expiry. Update your exposures, collect loss runs, review directors and officers (D&O), general liability (GL), cyber and property limits, then take the options to the board before you bind. The law only guarantees a short nonrenewal notice: 30 to 60 days in five states we checked.
The renewal email lands three weeks before the policies expire, the board meets next month, and nobody is sure whether the new program or the donated building was ever reported. This checklist gives you a timeline, the questions to ask about each policy and a one-page board report, all of which work without buying anything.
Key takeaways
- Insurers must warn you before refusing to renew, but only by a statutory minimum: at least 45 days in Florida and North Carolina, 60 in Washington, 30 in Ohio and 60 to 120 in New York, for the lines each law covers.
- The federal Volunteer Protection Act protects qualifying unpaid volunteers, including directors and officers, but says it does not affect the organization's own liability.
- That act also gives no protection for harm caused while driving a vehicle that requires a license or insurance, so check your auto and hired and non-owned auto cover.
- If you hold federal awards, 2 CFR 200.310 requires you to insure property bought or improved with federal funds at least as well as your own property.
- Many D&O policies are claims-made: they cover claims first made during the policy period for acts after a retroactive date. Changing insurers can move that date.
- The Federal Trade Commission (FTC) lists what a cyber policy should cover, including breaches at your vendors and attacks anywhere in the world.
A nonprofit renewal in five stages, from exposure update to board sign-off.When should a nonprofit start its insurance renewal?
Start about 120 days before the policies expire; that is our working advice, not a legal rule. It gives you a month to update the facts, a month for the broker to market the account, a month for questions and the board, and a buffer. If you wait for the insurer's notice, you may have far less.
State law sets only the minimum notice an insurer must give before it declines to renew or changes terms. Rules differ by state and by line of insurance, so read the linked law for yours. If your state is not listed, check your state's insurance code or ask your Department of Insurance.
Minimum nonrenewal notice for commercial policies in five states (official text, last verified 12 October 2026)
| State | Minimum notice before expiration | If the notice is late | Official source |
|---|---|---|---|
| Florida | At least 45 days' written notice of nonrenewal or of the renewal premium | Cover continues until 45 days after notice, or until replacement cover starts if sooner | Fla. Stat. 627.4133(1) (leg.state.fl.us) |
| New York | At least 60, not more than 120 days; 30 to 120 for excess liability and jumbo risks | Cover continues on the expiring terms for a set period | N.Y. Ins. Law 3426(e) (nysenate.gov) |
| Ohio | At least 30 days for commercial property, fire and casualty (some lines excluded), copy to agent | Cover continues until 30 days after the notice was mailed | Ohio Rev. Code 3937.26 (codes.ohio.gov) |
| Washington | At least 60 days, with the insurer's actual reason | Read the statute for your line | RCW 48.18.2901 (app.leg.wa.gov) |
| North Carolina | At least 45 days for policies of one year or less, with the precise reason; 30 days for lower limits or higher deductibles or rates you did not ask for | Read the statute for your line | N.C.G.S. 58-41-20 (ncleg.gov) |
Official links: Florida, New York, Ohio, Washington, North Carolina. Notice periods are the floor, not a renewal plan.
What does a nonprofit insurance renewal checklist include?
A nonprofit insurance renewal checklist covers five stages: update exposures, get loss history, review each policy, report to the board, then bind and file. Work through these in order; the day counts are our suggested lead times.
- 120 days out: update the facts. Budget and revenue, paid staff, volunteer numbers, new or closed programs, events, vehicles, locations, property values and any new contracts or grants that require insurance.
- 110 days: request loss runs. Ask each insurer or your broker for claims history on every policy. Record any incident not yet reported as a claim and ask how to report it.
- 100 days: check contract requirements. Leases, grant agreements and venue contracts often set minimum limits and require you to name others as additional insureds. List each requirement next to the policy that meets it.
- 90 days: brief the broker. Send the update, loss runs, requirement list and questions from the policy review below. Ask for options, not just a renewal quote.
- 60 days: review options. Compare expiring and renewal limits, deductibles, exclusions, retroactive dates and premium. Ask what changed and why.
- 45 days: board or committee sign-off. Present the one-page report below. Record the decision in the minutes.
- 30 days: bind in writing. Get binders or policies, pay on time, and request certificates for landlords, funders and partners.
- After renewal: file and diary. Save policies, certificates and the board decision in one folder, and set next year's 120-day start date.
Which policies should a nonprofit review at renewal?
Review every policy, but give D&O, general liability, property or a business owner's policy (BOP), cyber and auto the most time, because their terms change most at renewal. Coverage depends on the wording of each policy, so use this table as questions to put to your broker.
Nonprofit policies at renewal: what they are and what to check
| Policy | What it is (official description) | Check your policy for |
|---|---|---|
| Directors and officers (D&O) | Usually claims-made: covers wrongful acts after the retroactive date if the claim is first made in the policy period (Virginia's definition, 14VAC5-335-20) | Retroactive date unchanged; employment practices cover; who counts as an insured; extended reporting options |
| General liability (GL) | SBA: protects against financial loss from bodily injury, property damage and medical expenses | Events and volunteers covered; additional insureds your contracts require; abuse or molestation exclusions if you serve children |
| Property or BOP | SBA: a BOP combines typical coverage options into one bundle | Values updated for new or donated property; property bought with federal funds included (2 CFR 200.310) |
| Cyber | FTC: first-party covers your own breach costs; third-party covers claims against you | Vendor breaches, worldwide attacks, duty to defend, breach hotline (FTC checklist) |
| Auto, hired and non-owned | Volunteer Protection Act gives volunteers no protection for vehicles that need a license or insurance | Staff and volunteers driving their own cars on your business |
| Workers' compensation | Set by state law | Your state's requirements, and whether volunteers are included |
What should you check on a claims-made D&O policy?
Check three dates: the policy period, the retroactive date and any extended reporting period. Virginia's regulation defines claims-made insurance as covering acts after any retroactive date, provided the claim is first made during the policy period or an extended reporting period. North Carolina's Department of Insurance guidelines say a claims-made insurer "cannot advance an existing retroactive date without written consent from the insured".
Under a claims-made policy, both the act and the claim have to land in the right window.If a quote from a new insurer shows a later retroactive date than your current policy, acts before that date may no longer be covered. Ask before you sign anything that accepts it.
Do volunteers and board members still need D&O cover?
Yes, usually. The Volunteer Protection Act limits the liability of qualifying volunteers, and its definition includes a volunteer "serving as a director, officer, trustee" who gets no pay beyond expenses and no more than $500 a year in other value instead of pay. But section 14503(d) says nothing in it affects "the liability of any nonprofit organization", and it does not cover harm from willful or criminal misconduct or gross negligence. The organization itself still needs insurance.
Cyber renewal questions from the FTC checklist
- ✓
Does the policy cover data breaches, including theft of personal information?
- ✓
Does it cover attacks on our data held by vendors and other third parties?
- ✓
Does it cover attacks on our own network, anywhere in the world?
- ✓
Does it cover terrorist acts?
- ✓
Will the insurer defend us in a lawsuit or regulatory investigation ("duty to defend")?
- ✓
Is there a breach hotline available every day of the year at all times?
⚠️What happens if you miss it: a policy you do not renew ends on its expiration date. If an insurer's nonrenewal notice is late, some states extend cover for a time (45 days after notice in Florida, 30 days after mailing in Ohio), but you cannot count on that. For claims-made D&O, a claim made after the policy ends is outside it unless you buy an extended reporting period. In Virginia the insurer must offer one, and you have at least 30 days from termination to buy it, but no offer is required if the policy ended for nonpayment.
How should you report insurance renewal to the board?
Give the board one page that shows what changed, what it costs and what you need them to decide. Insurance protects the organization the board oversees, so treat the renewal as a governance item, not just an admin task. Copy this layout into a document or slide:
One-page board insurance report: copyable layout
| Section | What to include | Example (illustrative) |
|---|---|---|
| 1. Summary | Renewal date, total premium expiring vs renewal, one-line recommendation | All policies renew July 1; premium up; recommend option B |
| 2. Policy table | Policy, insurer, limit, deductible, premium expiring and renewal, change | One row per policy |
| 3. What changed | New exclusions, lower limits, higher deductibles, retroactive date | Cyber now excludes ... (quote the wording) |
| 4. Exposure changes | New programs, sites, events, staff, property, grants | New youth program from September |
| 5. Gaps and contract checks | Risks not insured, contract limits not met | Venue contract asks for a higher GL limit |
| 6. Decision needed | Options with cost, and the vote you need | Approve option B by June 15 |
Email template to your broker (send at 90 days). Subject: [Organization] renewal, policies expiring [date]. "Our policies expire on [date]. Attached are our updated budget, staff and volunteer counts, new programs and events, property values and loss runs, plus a list of contract and grant insurance requirements. Please market the account and send options by [date], showing expiring and proposed limits, deductibles, exclusions, retroactive dates and premium side by side. Please flag anything that reduces cover. Our board meets on [date]."
How do you review insurance limits every year?
Review limits against what changed this year and what your contracts require, not against last year's quote. These checks go beyond bare compliance, and each takes minutes in a spreadsheet:
- Exposure triggers. New program, new site, a large event, budget growth, a vehicle, or work with children or vulnerable adults. Any one is a reason to ask about limits.
- Contract minimums. Add a column for the limit each lease, grant or venue contract requires, and flag shortfalls with =IF(D2<E2,"SHORT","OK"). Keep the contracts themselves in the free contract renewal tracker, so their own end dates are tracked too.
- Federal awards. Under 2 CFR 200.447, insurance costs required and maintained under the award are allowable, and other insurance is allowable within limits, such as following your written policy. Ask your finance lead how premiums are allocated.
- Premium change. Track =(G2-F2)/F2 for renewal against expiring premium on each policy, so the board sees the movement line by line.
- Start date. Put =H2-120 next to each expiration date, and sort by it every month.
💡 Pro Tip
Give the retroactive date its own column next to each claims-made policy. If a renewal or a new quote shows a later date, it stands out at once, and North Carolina's guidelines say an insurer cannot advance it without your written consent.
Spreadsheet or software for nonprofit insurance renewals?
If one person runs a handful of policies that all renew on the same date, a spreadsheet with the columns above and a calendar reminder at 120 days is enough. Many small nonprofits never need more.
It gets harder when policies renew on different dates, when program staff must supply information, or when the board and funders ask for proof that renewals were handled. That is where a tool such as ExpiryEdge earns its place: each policy gets an owner and a backup, reminders go out at 90, 60, 30 and 7 days, document requests collect certificates and loss runs, and an audit trail records who did what. See insurance renewal tracking for your own policies. For the wider process, read our commercial insurance renewal checklist and the guide to insurance policy tracking for businesses; brokers handling many nonprofit clients can see insurance broker renewal tracking.
Frequently asked questions
When should a nonprofit start its insurance renewal?
About 120 days before expiry, which is our advice rather than a legal rule. State law only guarantees a short nonrenewal notice, such as 30 days in Ohio or 45 days in Florida and North Carolina, which leaves little time to market the account and get board approval.
Does a nonprofit need D&O insurance if board members are volunteers?
Usually yes. The federal Volunteer Protection Act limits the liability of qualifying unpaid directors and officers, but it states that it does not affect the organization's own liability, and it excludes willful misconduct and gross negligence.
What is a retroactive date on a D&O policy?
It is the date after which wrongful acts can be covered under a claims-made policy. If a new policy has a later retroactive date, earlier acts may not be covered. North Carolina's guidelines say an insurer cannot advance it without the insured's written consent.
What should a nonprofit ask about cyber insurance at renewal?
Use the FTC's checklist: cover for data breaches, attacks on data held by vendors, attacks anywhere in the world and terrorist acts, plus whether the insurer will defend you in a lawsuit or regulatory investigation and offers an always-on breach hotline.
Do federal grants require nonprofits to carry insurance?
If you buy or improve property with federal funds, 2 CFR 200.310 requires you to insure it at least as well as your own property. The award terms may set further requirements, so read each grant agreement.
What should go in a board insurance report?
One page: renewal date and total premium change, a table of policies with limits, deductibles and premiums, what changed in the wording, new exposures, gaps against contract requirements, and the decision you need from the board.
Sources
- Florida Statutes 627.4133 (2026)
- New York Insurance Law 3426
- Ohio Revised Code 3937.26
- Revised Code of Washington 48.18.2901
- North Carolina General Statutes 58-41-20
- 42 U.S.C. 14503, Volunteer Protection Act, limitation on liability for volunteers (govinfo)
- 42 U.S.C. 14505, Volunteer Protection Act definitions (govinfo)
- eCFR, 2 CFR 200.310 Insurance coverage
- eCFR, 2 CFR 200.447 Insurance and indemnification
- Virginia Administrative Code, 14VAC5-335 (claims-made liability insurance)
- North Carolina Department of Insurance, Guidelines for Claims-Made Policies
- Federal Trade Commission, Cyber Insurance (Cybersecurity for Small Business)
- U.S. Small Business Administration, Get business insurance
Last reviewed: 12 October 2026
Frequently asked questions
Usually yes. The federal Volunteer Protection Act limits the liability of qualifying unpaid directors and officers, but it states that it does not affect the organization's own liability, and it excludes willful misconduct and gross negligence.
It is the date after which wrongful acts can be covered under a claims-made policy. If a new policy has a later retroactive date, earlier acts may not be covered. North Carolina's guidelines say an insurer cannot advance it without the insured's written consent.
Use the FTC's checklist: cover for data breaches, attacks on data held by vendors, attacks anywhere in the world and terrorist acts, plus whether the insurer will defend you in a lawsuit or regulatory investigation and offers an always-on breach hotline.
If you buy or improve property with federal funds, 2 CFR 200.310 requires you to insure it at least as well as your own property. The award terms may set further requirements, so read each grant agreement.
One page: renewal date and total premium change, a table of policies with limits, deductibles and premiums, what changed in the wording, new exposures, gaps against contract requirements, and the decision you need from the board.
