To protect the organization, itself, and its members, the board must start by following the legal obligations common to all boards: duty of care, duty of loyalty, and duty of obedience.
Not every board needs an investment committee. If the organization has sizable assets, an endowment, and/or a planned giving program, it probably should form an investment committee.
Most nonprofits start as all-volunteer organizations (AVO), without a paid staff. The organization operates with the support of its board and maybe additional volunteers.