Mandated Reporting for Nonprofits: What Staff Must Do

A caseworker sits with a family and notices something. A bruise explained twice, in two different ways. A child who flinches. A mother who changes the subject. Nothing that amounts to knowledge, and something that will not leave the caseworker's mind on the drive home.

What happens next is governed by state law, and the law is less demanding than most staff assume. Mandated reporting is not triggered by certainty. It is triggered by reasonable suspicion — and the decision about whether abuse occurred belongs to the investigating agency, not to the person making the report. Staff who believe they must be sure before reporting will systematically under-report, and that misunderstanding is the most common failure in nonprofit safeguarding.

This guide covers who counts as a mandated reporter, what triggers the duty, what to do when it is triggered, and how case records should handle it.

Who is a mandated reporter?

Every state has mandatory reporting law, but they take two approaches to who is covered.

Most states enumerate professions: teachers, health practitioners, social workers, child care providers, law enforcement, clergy in some states, and often anyone whose paid work brings them into contact with children. Nonprofit staff frequently fall inside these categories without realizing it — a youth program coordinator may be covered as a child care provider, a housing caseworker as a social service worker.

North Carolina and Wyoming take the other approach: they do not enumerate professional groups, which means the duty falls on any person who suspects abuse or neglect. A growing number of other states have moved toward universal reporting for at least some categories.

Three practical consequences. First, your staff's status depends on the state they work in, not on your organization's view of their role — a multi-state nonprofit has multi-state obligations. Second, volunteers are covered in some states and not others, and organizations that train staff but not volunteers leave a real gap. Third, whether the duty attaches to the individual or the organization varies, which determines whether telling a supervisor discharges it.

What triggers the duty

The standard in most states is reasonable cause to suspect or reasonable suspicion — language that deliberately sets a low bar. It does not require evidence, corroboration, or a disclosure from the child. It requires that a reasonable person in the same role, seeing what you saw, would suspect.

This is the point that training most needs to land. The reporter's job is to report what they observed. The investigating agency's job is to determine what happened. A reporter who waits for certainty is substituting their own untrained judgment for the agency's investigation, and delay in these cases is not neutral.

Reports made in good faith are protected from liability in every state. Failure to report, where the duty applied, carries penalties that range from misdemeanor charges to professional license consequences depending on the state.

Does telling a supervisor discharge the duty?

Usually not, and this is where well-intentioned internal policy creates legal exposure.

In most states the duty attaches to the individual who formed the suspicion. Reporting it to a manager who then decides whether to escalate does not satisfy that duty, and an internal policy requiring staff to route concerns through a supervisor before contacting the agency may put staff in the position of breaking the law by following it.

Write the policy so that internal notification and external reporting run in parallel: staff tell their designated lead and the report is made, with the policy naming who makes it and by when. Never write a policy that gives a manager authority to block a report.

What to do when the duty is triggered

Report within the statutory window. Most states require an immediate oral report — commonly to a state hotline or child protective services — often followed by a written report within a set number of hours or days. Know your state's window before you need it, not during.

Report what you observed, not your conclusions. "Child has a bruise on the left forearm; said he fell off his bike; mother said he fell down the stairs" is useful. "I think the mother is abusive" is not, and it colors the investigation.

Record the report itself. Date, time, who made it, which agency, any reference number given, and what was said. This is the record that protects the individual and the organization.

Do not investigate. Interviewing the child, confronting a parent, or gathering evidence can compromise the agency's investigation and, in some circumstances, the child's safety. The duty is to report, not to establish facts.

Support the reporter. Making a report is distressing, particularly when the reporter has a relationship with the family and expects to keep working with them. Organizations that do not plan for this get under-reporting driven by staff anxiety.

How this lands in case records

Mandated reporting creates specific demands on record-keeping that generic note-taking does not meet.

Contemporaneous notes carry weight. A note written at the time, dated and unedited, is evidence. A note reconstructed three weeks later under pressure is much weaker, and edits to an existing note without a visible history look like tampering even when they are not.

Observation and interpretation must be separable. Records should make clear what was seen and heard, distinct from what the worker inferred. Investigators need the former; the latter is context.

The report must be findable. When an agency, auditor or attorney asks what was recorded and when, the answer needs to be retrievable in minutes. Records scattered across email, personal notebooks and a shared drive fail this test.

Access needs to be controlled but not obstructed. Notes on a suspected abuse case are among the most sensitive records an organization holds. The people who need them should reach them quickly; nobody else should reach them at all.

This is where the quality of the case management system stops being an administrative matter. Plinth holds case notes as structured, timestamped records with an audit trail, so who wrote what and when is visible without relying on memory. AI case notes let a caseworker record an account of a visit and have it turned into a structured note immediately — which matters here specifically, because the barrier to contemporaneous recording is usually that the worker is between appointments and the note gets written on Friday. Role-based access keeps sensitive records visible to the people handling them and closed to everyone else. There is a free tier.

Building a policy that works

Review it annually and whenever you begin operating in a new state. The single most valuable line in the policy is the one confirming that no internal process may stand between a staff member and their statutory duty.

What happens after you report

Staff report more readily when they know what follows, and most training never covers it.

The agency screens the report against its state's criteria. Not every report is investigated — screening decisions turn on whether the allegation, if true, would meet the statutory definition and whether the agency has jurisdiction. A screened-out report is not a judgment that the reporter was wrong to call.

If it proceeds, the agency investigates on its own timetable and generally does not report back to the reporter in detail. This is the part staff find hardest: they make a report about a family they see weekly and hear nothing. Supervisors should say so in advance, because silence is otherwise read as "nothing happened" and erodes willingness to report next time.

Your organization's duty does not end at the call. If you continue working with the family, the relationship needs handling — and your records should reflect the ongoing work accurately, including anything that changes the picture. A second report is required if new suspicion arises; the first does not discharge the duty forever.

Training that changes behavior

Annual click-through training produces staff who can define mandated reporting and still freeze when it matters. What works is narrower and more concrete.

Use your own scenarios. Generic case studies about strangers in parks do not resemble the ambiguity of real work. Use anonymized situations from your own services — the ones where staff genuinely disagreed.

Rehearse the call. Most hesitation is not conceptual, it is procedural: not knowing the number, what will be asked, or how long it takes. Have people make a practice call from a script.

Name the fear and address it. Staff worry about being wrong, damaging a relationship, or triggering an outcome worse than the situation. Say plainly that good-faith reports are protected in every state, that assessing the evidence is the agency's job, and that the organization backs the reporter.

Train volunteers too, wherever they have direct contact — regardless of whether your state's statute names them.

Refresh when the law changes, and whenever you begin operating in a new state.

Vulnerable adults are a separate regime

Organizations serving adults often assume mandated reporting is a child protection matter. Many states have parallel statutes covering elder abuse and abuse of vulnerable or dependent adults, and they differ from the child regime in ways that catch people out.

The reporting agency is usually different — commonly Adult Protective Services rather than child protective services — with its own hotline and its own intake criteria. The definition of who is covered turns on vulnerability or dependency rather than age, which means it can include a 40-year-old with a cognitive disability and exclude an independent 80-year-old. The categories of harm typically extend beyond physical abuse and neglect to financial exploitation, which is the most commonly reported form and the one frontline staff are least trained to recognize.

Capacity introduces a genuine tension the child regime does not have. An adult with capacity may decline intervention, and their autonomy is entitled to respect in a way a child's is not. That does not remove a reporting duty where one exists, but it changes what happens next, and staff need to understand that reporting is not the same as overriding someone's choices.

If you serve both children and adults, write both regimes into the policy with their respective agencies, windows and thresholds. A single "safeguarding" section that blurs the two produces staff who call the wrong number.

Frequently asked questions

Are nonprofit staff mandated reporters?

It depends on the state and the role. Most states enumerate professions, and nonprofit staff often fall within categories such as social service workers or child care providers. North Carolina and Wyoming require reporting by any person.

Do I need proof before making a report?

No. The standard is reasonable suspicion, not proof. Determining what happened is the investigating agency's role, and good-faith reports are protected from liability in every state.

What if my supervisor tells me not to report?

In most states the duty attaches to you personally, so a supervisor's instruction does not discharge it. Make the report. A policy that lets a manager block one should be rewritten.

Are volunteers mandated reporters?

In some states, yes; in others, no. Organizations relying on volunteers for direct service should train them as if they were covered, because the safeguarding logic applies regardless of the statutory position.

What happens if we fail to report?

Penalties vary by state and range from misdemeanor charges to professional licensing consequences, alongside civil exposure and funder or licensing consequences for the organization.

Does mandated reporting apply to vulnerable adults?

Many states have parallel statutes covering elder abuse and abuse of vulnerable or dependent adults, often with different reporting agencies and windows. Check both if you serve adults.

Can we tell the family we made a report?

This depends on state law and on whether disclosure would place the child at greater risk. Take this decision with reference to your state's rules and, where the situation is serious, legal advice — not as a matter of general practice.

How do we handle a disclosure made to a volunteer?

The same way as one made to staff: listen, do not question or investigate, record what was said as closely to verbatim as possible, and ensure a report is made within the statutory window. Whether the volunteer is personally a mandated reporter varies by state, but the organization's safeguarding duty does not.

What if we suspect abuse by a member of our own staff?

Report externally exactly as you would any other suspicion — the duty is not suspended because the alleged perpetrator is internal. Run the employment process separately and in parallel, and take care that an internal investigation does not interfere with the agency's.

Should staff tell their manager before calling?

Ideally both happen, and neither waits for the other. Telling a manager is good practice for support and coordination; it does not discharge an individual statutory duty, and no manager should be able to prevent the call.

Recommended next pages

• What is case management? — Structured records as the foundation
• Case note best practices — Writing notes that hold up
• Nonprofit board fiduciary duties — Where safeguarding oversight sits at board level
• Spotting risks early in case management — Recognizing patterns across records

Last updated: August 2026