Personal assets, in the situation where the organization cannot indemnify. Indemnification depends on the organization having the money and on state law and the bylaws permitting it. Insolvency, which is when derivative and creditor claims are most likely, is exactly when indemnification fails.
The corporate negligence theory, which reaches upward. In states recognizing it, a plaintiff can plead that the failure was institutional rather than individual: inadequate staffing policy, inadequate oversight, inadequate response to known problems. Those are board-level allegations even when the claim itself is a resident injury.
Refundable entrance fee obligations on a continuing care campus, which are long-dated promises to residents that appear in disclosure statements and are backed by reserves. A dispute about those obligations is a financial claim against governance, and it is a category the liability program does not touch.
Employee benefit plans. Fiduciary duty under federal benefit plan law attaches to the people who exercise discretion over the plan, and a board that appoints and monitors the committee has taken on a fiduciary role whether or not anyone described it that way.
Regulatory and attorney general interest, which nonprofits attract in ways for-profits do not, because charitable assets carry oversight that commercial assets do not.