Why Your Nonprofit Website Is a Governance Liability (And Your Board Should Know It)
Key takeaways
- A website that is not actively governed is a governance risk with specific, nameable consequences that trustees have a fiduciary responsibility to understand, not merely a communications asset.
- Four risks hide in plain sight: outdated information creating legal exposure, accessibility failures amounting to discrimination, website data handling as a trustee matter, and platform dependency as key person risk.
- Under GDPR the trustees are the data controller, so exposure from third-party scripts, outdated consent mechanisms, or inadequate privacy notices falls to the board rather than the developer.
- If maintaining the site depends on one developer, plugin, or piece of undocumented knowledge, the board has approved an operational dependency it may not be aware of.
- The effective way to raise this is as identified governance risks needing a remediation plan, framed like a safeguarding audit or financial controls review, not as a request for a new website.
- The costs of inaction, including missed grants, donor attrition, and regulatory risk, never appear on a budget line but are real.
Summary
Most nonprofit Boards have not been told that their website is a governance risk. They have been told, if anything, that it is a communications asset. This framing is not wrong, but it is incomplete. A nonprofit website that is not actively governed — not monitored for compliance, not maintained with current information, not managed under a documented authority structure — is a governance risk with specific, nameable consequences that trustees have a fiduciary responsibility to understand.The regulatory dimension is the most directly consequential: the Charity Commission requires registered charities to maintain publicly available information about their governance, and a website that does not meet this requirement is in breach of the Commission's expectations. The European Accessibility Act and the Equality Act 2010 create accessibility obligations that an ungoverned website is unlikely to meet consistently. A data breach from a website with inadequate data governance creates ICO exposure and reputational damage that the Board will face without having been given the opportunity to prevent it.Beyond regulation, the institutional risk is substantial: institutional funders who find governance information incomplete or outdated during due diligence, donors who lose confidence when the website's quality is inconsistent with the organisation's stated scale, and media investigations that find factual inaccuracies on the website that undermine credibility at a critical moment. This post covers how to frame each of these risks in governance language that trustees can evaluate as part of their fiduciary responsibility, and what a Board-level response to website governance risk looks like.
Your board approves budgets for insurance, audits, and legal counsel without hesitation. But when the website comes up, it's treated as a communications expense — discretionary, deferrable, someone else's problem. That framing is wrong, and it's costing organisations far more than a rebuild ever would.
What Governance Actually Means for a Website
Governance isn't just about board meetings and policy documents. It encompasses every system through which an organisation makes, implements, and accounts for decisions — including how it communicates with the public. Your website is the most visible output of that communication system. If it's inaccessible, non-compliant, or misrepresents your programmes, the board is ultimately accountable.
In the UK, the Charity Commission expects trustees to ensure their organisation maintains accurate public information. A website that shows outdated annual reports, missing safeguarding policies, or incorrect trustee listings isn't a design problem — it's a compliance failure.
The Four Governance Risks Hiding in Plain Sight
1. Outdated Information Creates Legal Exposure
Outdated programme descriptions, expired policies, or incorrect contact details create legal exposure if a beneficiary, donor, or regulator relies on that information and is misled. Most boards have no process for ensuring website content reflects current organisational reality.
2. Accessibility Failures Are Discrimination
WCAG 2.2 AA compliance is not aspirational — for organisations receiving public funding or serving vulnerable populations, failure to meet basic accessibility standards can constitute discrimination under the Equality Act 2010. The board is responsible for ensuring the organisation meets its legal obligations. An inaccessible website is a breach of that responsibility.
3. Data Handling on the Website Is a Trustee Matter
Every contact form, newsletter signup, and donation flow on your website processes personal data under GDPR. The trustees are the data controller. If your website uses third-party scripts, outdated consent mechanisms, or inadequate privacy notices, the exposure falls to the board — not the developer who built the site three years ago.
4. Platform Dependency Is Key Person Risk
If your website requires a specific developer, plugin combination, or institutional knowledge to maintain, the board has approved an operational dependency they may not even be aware of. When that developer leaves — or the plugin breaks — the organisation loses its most public-facing asset with no contingency plan.
What the Board Should Be Asking
| Governance Area | What to Ask | Red Flag Answer |
|---|---|---|
| Compliance | When was the website last audited for regulatory compliance? | "We haven't" or "The agency handles it" |
| Accessibility | What is our current Lighthouse accessibility score? | Below 85, or "I don't know what that is" |
| Data | Do we have a current privacy policy and cookie consent mechanism? | "I think so" or pointing to a 2019 policy |
| Continuity | If our web developer left tomorrow, what would happen? | "We'd be in trouble" |
| Content | Who is responsible for keeping website content accurate? | No clear owner, or "whoever has time" |
| Performance | What does our website cost in lost donor trust annually? | Silence — this has never been calculated |
How to Raise This With Your Board
The most effective framing is not "we need a new website." That sounds like a spend request. The effective framing is: "We have identified governance risks in our current web infrastructure that require trustee awareness and a remediation plan."
Present it the same way you would present findings from a safeguarding audit or a financial controls review — with specific risks identified, likelihood and impact assessed, and options for resolution costed. Boards respond to structured risk framing. They disengage from design conversations.
A Blueprint Audit produces exactly this output: a board-ready diagnostic that maps technical debt, compliance gaps, and content governance failures in plain language — with a prioritised remediation roadmap your trustees can approve and track.
The Cost of Inaction Is Not Zero
Deferring website investment feels like saving money. In practice, it accumulates compounding costs: missed grant opportunities because funders couldn't verify your governance on your site, donor attrition because the donation journey was broken on mobile, staff time spent manually fielding enquiries that a functional website would have resolved, and regulatory risk that grows with every year of non-compliance.
None of these costs appear on a budget line. All of them are real.
Further Reading
- Board Questions for Nonprofit Website Governance & Oversight
- Charity Commission Compliance: UK Nonprofit Website Requirements
- NGO Websites Are Governance Problems Not Design Problems
- Blueprint Audit: Board-Ready Website Diagnostic
What Changes When You Treat the Website as Governance
Organisations that make this shift stop having the same conversation every 18 months. Instead of another reactive rebuild triggered by a crisis — a broken donation form during a campaign, a Charity Commission query about outdated trustee information, a funder who couldn't verify financials — the website becomes something that gets reviewed, maintained, and invested in as part of normal governance cycles.
The ED stops apologising for the site in funder meetings. The board has a clear picture of what the organisation's most public asset says about it. The comms team has the infrastructure to do their job. None of this is aspirational — it's what well-governed website infrastructure actually produces.
Frequently asked questions
Yes, it can be. A nonprofit website creates legal exposure in several areas: accessibility failures under the Equality Act 2010, data protection non-compliance under UK GDPR and the ePrivacy Directive, misrepresentation of governance or financial information regulated by the Charity Commission, and intellectual property issues from unconsented photography or unlicensed content. Each of these represents a real enforcement risk, not a theoretical one.
The website is the most public expression of the organisation's governance. Trustees are collectively responsible for how the organisation presents itself to donors, regulators, and the public. If the website contains inaccurate trustee listings, outdated financials, inaccessible content, or non-compliant data handling, the board carries governance responsibility for those failures — regardless of whether they were aware of them.
A communications problem is a message that isn't landing effectively. A governance liability is a gap between what the organisation claims about itself and what it actually does — or a failure to meet a legal obligation. When a website lists trustees who have resigned, claims compliance it hasn't achieved, or publishes content without proper consent, it creates liability that goes beyond communications. The board is accountable for these failures in ways it isn't accountable for aesthetic or messaging choices.
The most common are: outdated trustee and leadership information, missing or inaccessible annual reports and financial statements, non-compliant cookie consent and data handling, accessibility failures that exclude disabled users, safeguarding policy information that is absent or out of date, and programme or impact claims that cannot be evidenced. Any of these can be the basis of a regulatory enquiry, a funder's refusal, or a reputational challenge.
Funders — particularly institutional and grant-making funders — use the website to verify claims made in applications before and during the assessment process. They check: is the leadership team as described, is the registered charity number verifiable with the Charity Commission, are recent accounts accessible, does the safeguarding policy reflect current best practice, and does the website's description of the programme match what the application describes. A website that fails these checks delays or kills grant applications.
Yes. The ICO can issue fines for GDPR and ePrivacy non-compliance, including failures related to cookie consent and data handling — fines can reach £17.5 million or 4% of global annual turnover under UK GDPR. The Equality and Human Rights Commission can take action over accessibility failures under the Equality Act. The Charity Commission can investigate governance failures reflected on the website. These are live enforcement mechanisms, not theoretical risks.
At minimum: the current list of trustees with roles, the charity registration number and registered address, the most recent annual report and accounts, the safeguarding policy (for organisations working with vulnerable groups), the privacy policy and cookie policy, and contact information for complaints and data subject requests. These are not optional transparency gestures — several are legal requirements for registered charities.
A governance audit of the website should happen at least annually, aligned with the annual report cycle. Specific elements need more frequent review: trustee listings should be updated within days of any board change, financial documents should be updated when accounts are filed, and compliance documentation should be reviewed whenever the relevant regulations or the organisation's practices change. Ad hoc audits should also be triggered by significant organisational events such as leadership transitions, mergers, or new programme areas.
When a governance liability is identified, the board should ensure it is documented, that responsibility for remediation is assigned to a named individual with a defined timeline, and that the remediation is verified and reported back to the board. The board cannot simply delegate liability and assume it is resolved — trustee accountability requires oversight of the remediation, not just delegation of the task.
A governance audit assesses what the website says about the organisation's accountability, compliance, and accuracy — it is a risk identification exercise, not a design critique. A redesign addresses how the website looks and functions. Many organisations that commission redesigns without a preceding governance audit end up with a more attractive site that has the same underlying governance liabilities. The audit should come first and inform the brief for any redesign that follows.
