Compliance & Legal

How to run an annual policy attestation cycle as Foundation and Nonprofit Ops Teams

Compliance & LegalFor Foundation and Nonprofit Ops Teams3 apps12 steps~24 min to set up

Your four-person ops team runs an annual policy attestation cycle the same way every year: you export a staff roster from whatever HR system the last consultant set up, build a tracking spreadsheet in Google Sheets, email each person individually with a PDF attachment, chase non-responders by hand, and then consolidate returned forms into a master log before your audit. When a board member or your external auditor asks for attestation records for a specific grantee-facing staff member, you're digging through a shared Drive folder. The whole cycle takes three to four weeks of elapsed time for what is functionally a confirmation exercise. Fluxx and Foundant assume a dedicated compliance team. You don't have one.

Build this on Starch → See the apps used

Compliance & LegalFor Foundation and Nonprofit Ops Teams3 apps12 steps~24 min to set up

Outcome

What you'll set up

A tracked attestation dashboard that shows — in real time — which staff have signed, which are overdue, and which policies are still outstanding, without a single manual status update

An automated outreach and follow-up sequence that sends initial attestation requests and escalating reminders through Gmail or Outlook on a schedule you control, with no manual chasing

An auditable completion record linked to your existing staff data that you can hand to your auditor or board with one export rather than reassembling from inboxes and Drive folders

The Starch recipe

Apps, data, and prompts

The combination of Starch apps, the data sources they pull from, and the prompts you use to drive them.

Apps used

Knowledge Management Email Agent Task Manager

Data sources & config

Staff roster is pulled live from Google Sheets via Starch's integration catalog (live query). Outreach and reminder emails are sent through Gmail, which Starch syncs directly on a schedule. Policy documents live in Notion, which Starch also syncs directly on a schedule. Any external portal that requires form submission (state charity registration, funder compliance portals) is handled through Starch's browser automation — no API needed. The attestation tracking dashboard and the Knowledge Management wiki are custom surfaces built in Starch on top of these connected data sources.

Prompts to copy

Build me a policy attestation tracker. Pull our staff list from the Google Sheet at [URL] and create a record for each person with columns for: name, role, department, each policy they need to attest to (Conflict of Interest, Whistleblower, Records Retention, Gift Policy), date sent, date completed, and overdue flag. Show me a dashboard view filtered by completion status.

Set up an automation that emails each staff member their attestation packet from Gmail on March 1st. Include a link to the relevant policy document stored in Notion. Seven days before the deadline, send a reminder to anyone who hasn't confirmed. Three days before the deadline, send a final reminder and CC their manager.

Create a Knowledge Management page for our annual attestation cycle. Include: the policy documents, the timeline, who is responsible for each step, and a log of completion rates from prior years so we can show trend data to our auditor.

Add a task to my Task Manager: 'Confirm all attestation records exported and filed in Drive before April 15 board meeting' — P1, due April 12.

Run these in Starch → or paste them into your favorite agent

Walkthrough

Step-by-step

1 Connect Google Sheets from Starch's integration catalog so the agent can query your current staff roster live each time the attestation cycle opens.

2 Connect Notion as a scheduled-sync provider so Starch pulls your policy documents (Conflict of Interest, Whistleblower, Records Retention, Gift Policy) automatically and links them inside the attestation app.

3 Connect Gmail as a scheduled-sync provider so Starch can send initial attestation emails, log replies, and trigger follow-up sequences without you touching your inbox manually.

4 Describe your attestation tracker to Starch in plain language: name the policies, the staff segments that need to sign each one (all staff vs. board-adjacent vs. grantee-facing roles), and your deadline. Starch builds the tracking surface.

5 Set the outreach automation: tell Starch when to send the initial email, what the reminder cadence is, and who gets CC'd on escalations. Starch schedules all of it against your Gmail connection.

6 Staff receive an email with a direct link to their policy document in Notion; their reply or a browser-based form submission updates the tracker automatically.

7 Monitor the live dashboard in Starch — color-coded by completion status — without running VLOOKUP against a spreadsheet or refreshing an inbox thread.

8 For any external compliance portal (state charity filings, funder attestation forms) that has no API, Starch automates the submission through browser automation — no separate workflow needed.

9 Use the Knowledge Management app to store the cycle timeline, staff instructions, and prior-year completion rates so a new ops hire or auditor can find everything in one place without asking you.

10 Two weeks before your fiscal year-end or board meeting, run the completion report from the tracker: outstanding items surface as P1 tasks in your Task Manager with the staffer's name and policy attached.

11 Once the cycle closes, export the completion log — every staff member, every policy, date confirmed — and file it in Drive. The Knowledge Management page auto-updates with the completion rate for that year.

12 Next year, the automation repeats on the same schedule. You update the staff roster in Google Sheets; Starch picks up the changes on its next live query and adds new staff to the outreach list automatically.

See this running on Starch

Connect your tools, describe what you want, and the agent builds it. Closed beta is free.

Try it on Starch →

Worked example

April 2026 Annual Attestation — Grantmaker Foundation (4-person ops team, 23 staff)

Sample numbers from a real run

Staff requiring Conflict of Interest attestation	23
Staff requiring Gift Policy attestation (grantee-facing only)	11
Completed by Day 7 (initial send)	16
Triggered by first automated reminder (Day 14)	5
Triggered by escalation to manager (Day 21)	2
Total cycle elapsed time (days)	24
Ops team hours spent on manual tracking and chasing	1

In prior years, the ops director spent roughly 12 hours across a 5-week cycle: building the tracking spreadsheet, emailing 23 staff individually, re-emailing the 7 who didn't respond, and assembling the final log for the auditor. In the April 2026 cycle, the Starch attestation app pulled the staff roster live from the foundation's Google Sheet on March 31st, identified 23 staff for the Conflict of Interest form and 11 grantee-facing staff for the Gift Policy form, and sent personalized emails through Gmail that same afternoon. By April 7th, 16 of 23 had confirmed. Starch's reminder automation sent a second email to the remaining 7 on April 14th; 5 responded within 48 hours. The final 2 triggered the manager CC escalation on April 21st — both completed the same day. Total ops-team time on the cycle: roughly 1 hour to set up the tracker and review the dashboard twice. The auditor received a clean completion log export on April 24th. The Knowledge Management page now shows three years of completion-rate trend data — 78% Day-7 completion in 2024, 82% in 2025, 87% in 2026 — which the ops director used in the board's governance report without building a single slide from scratch.

Measurement

How you'll know it's working

Attestation completion rate by Day 7 (initial send), Day 14 (first reminder), and cycle-close deadline

Elapsed calendar days from first send to 100% completion

Ops-team hours spent on the attestation cycle per year (target: under 2 hours)

Number of escalations to managers (indicates policy communication or culture issues worth flagging to the ED)

Year-over-year completion rate trend for board governance reporting

Comparison

What this replaces

The other ways teams handle this today, and how the Starch version compares.

Google Sheets + Gmail + manual tracking

Zero software cost but requires 10-15 hours of ops-team time per cycle, no automatic reminders, and produces an audit log that lives in someone's inbox rather than a searchable record.

Fluxx or Foundant

Purpose-built for grantmaking compliance workflows but starts at six figures annually and assumes a dedicated grants-management team — not practical for a 4-person ops team running a $50M foundation.

DocuSign + manual tracking spreadsheet

Good for capturing signatures but adds per-envelope cost, doesn't automate the outreach or reminder sequence, and produces signature records that still need to be reconciled against a staff roster manually.

Jira or Asana for task tracking

Can track completion per person if set up carefully, but requires manual creation of tasks for each staff member each year and has no native email-outreach or policy-document-linking capability.

On Starch RECOMMENDED

One platform — knowledge management, email agent, task manager all running on connected data. Setup in plain English; numbers stay current via scheduled syncs and live agent queries.

Try it on Starch →

FAQ

Frequently asked questions

We use Salesforce as our staff and contact database, not Google Sheets. Can Starch pull the staff roster from there?

Yes. Connect Salesforce from Starch's integration catalog and the agent queries it live when your attestation tracker runs. You'd tell Starch: 'Pull all active staff contacts from Salesforce where record type is Employee and status is Active.' No spreadsheet export needed.

Our auditor wants a signed PDF, not just a confirmation email. Can Starch handle that?

Starch handles the outreach, tracking, and completion log. For a formal e-signature on a PDF, you'd pair it with DocuSign — Starch can automate the DocuSign envelope send via browser automation and log the completion back to your tracker when the envelope is returned. A formal DocuSign API connector is available through Starch's integration catalog as well.

We have board members who also need to attest, not just staff. Can the same app handle both groups with different policy sets?

Yes. When you describe the tracker to Starch, you specify the segments: 'Staff sign Conflict of Interest, Whistleblower, Records Retention, and Gift Policy. Board members sign Conflict of Interest and Gift Policy only.' Starch builds separate tracking rows and outreach sequences for each group.

Is Starch SOC 2 certified? Our board has asked about data security for anything that touches HR or compliance data.

Starch is not SOC 2 Type II certified today. If your board or a funder requires SOC 2 documentation for a system handling staff compliance records, that's worth flagging before you deploy. Starch can still run the outreach and tracking workflow while keeping the authoritative signed records in DocuSign or Drive.

What happens if a staff member's name or role changes mid-cycle? Does the tracker update automatically?

If your roster lives in Google Sheets or Salesforce, Starch queries it live each time the app runs, so the next scheduled check picks up changes. It won't retroactively re-send to a role change mid-cycle unless you tell it to — you'd add a step like 'if a new record appears in the staff list after March 31st, send the attestation email immediately and add them to the tracker.'

We submit an annual expenditure responsibility certification to one of our funders through their online portal. Can Starch handle that too?

If the funder portal is web-accessible and doesn't require a physical signature or proprietary desktop software, yes — Starch automates it through your browser with no API needed. You'd describe the form fields and submission steps to Starch once, and it handles the annual submission. This is the same pattern as any other browser-based compliance filing.