There may be an FCRA problem. But the root cause may not be FCRA.
It may be governance.
Three organisations recently completed the IGMA™ FCRA Governance Assessment. Three is a small sample, and I would not treat the results as a sector benchmark. But one pattern stood out, and I think it deserves every board’s attention.
Compliance was not the weakest dimension. Resilience was.
| Governance dimension | Average score (out of 5.00) |
|---|---|
| Compliance, Ethics & Legal Protection | 3.52 |
| Financial Stewardship & Sustainability | 3.38 |
| Stakeholder Trust & Transparency | 3.33 |
| Leadership & Operations | 3.08 |
| Board Governance & Strategic Oversight | 2.80 |
| Risk, Resilience & Continuity | 2.23 |
The gap between the top and bottom rows is 1.29 points. On a five-point maturity scale, that is the difference between a system that broadly works and one that mostly exists on paper.
Proving today versus preparing for tomorrow
The pattern raises an uncomfortable question: are organisations spending more effort proving that they are compliant today than preparing for what could go wrong tomorrow?
That is understandable. Compliance has deadlines, forms, auditors and penalties. Resilience has none of those until the day it is needed. So the urgent work gets done, and the important work waits.
But for an FCRA-dependent organisation, a serious regulatory problem rarely stays a compliance problem. It travels:
Funding → Programmes → People → Cash flow → Donor confidence → Reputation → Mission delivery
A suspension, a delayed renewal or a frozen account does not ask whether the annual return was filed on time. It asks how long the organisation can keep going, who it can keep paying, and what it will tell its donors and the communities it serves.
Why this is a board issue
This is why I increasingly see FCRA governance as an organisational governance issue, not simply a compliance issue.
The second-lowest score in the sample, Board Governance & Strategic Oversight at 2.80, points the same way. Where the board is not looking ahead, risk and continuity planning tend to be left to management, and often to one or two people in finance.
A board should ask more than “Are we compliant?” It should also ask two harder questions:
- How confident are we that our FCRA governance system is working effectively? Not whether the forms were filed, but whether the controls, records and oversight behind them would stand up to scrutiny.
- If foreign funding were disrupted tomorrow, how resilient would our institution be?
Five things boards and management can do differently
- Put FCRA on the risk register as an institutional risk, owned at board level, not only as a compliance item owned by finance.
- Map the dependency. Which programmes, salaries and commitments depend on foreign contribution? What share of monthly costs would stop if those funds stopped?
- Write a short continuity plan: what happens in the first 30, 90 and 180 days of a disruption, who decides, and what is protected first.
- Plan the conversation with donors and staff before it is needed. In a crisis, trust is lost fastest through silence.
- Review it on a fixed cycle. A resilience plan that is never tested is an assumption, not a plan.
None of this replaces compliance. Compliance is the floor. Resilience is what keeps the institution standing when something beyond its control goes wrong.
Do you see FCRA risk mainly as a compliance issue, or as an institutional governance and resilience issue?
For the regulatory background, see FCRA Amendment Rules 2026: What NGOs Need to Know.
About the sample: three organisations, average scores only. No organisation is identified, and the figures are illustrative, not a sector benchmark. This article is for educational and governance purposes and is not legal advice.