Nonprofit boards are built to turn over. Terms end, officers rotate, volunteers come and go with the seasons — especially as giving season approaches and volunteer rosters swell. It's a healthy structure for governance. It's a quiet problem for IT, because access rarely rotates on the same schedule people do.
In nearly every nonprofit assessment we run, we find the same pattern: a former treasurer who can still open the accounting system, a past board chair still on the donor CRM, a volunteer coordinator from two galas ago still holding a shared drive link. None of it is malicious. All of it is exposure — and if that data includes donor payment information or client records, it's exposure your board is accountable for whether or not anyone remembers granting it.
Where the access actually lives
Before you can close gaps, you need the full map. Board members and active volunteers commonly touch more systems than most executive directors realize:
- The donor CRM and fundraising platform — often with full contact and payment history
- Financial systems: accounting software, bank portals, payment processors
- Shared drives holding grant applications, financial statements, and strategic plans
- Email lists and marketing platforms carrying your entire donor and supporter base
- Physical access: building keys, alarm codes, and door credentials
The annual reset
You don't need a complex system — you need a scheduled one. The nonprofits we work with run this every year, typically after board elections or before the giving season crunch:
- List every current board member, officer, and active volunteer with system access, and compare it against who actually holds a current role
- Revoke access the day a term or volunteer commitment ends — build it into your offboarding conversation, not an afterthought weeks later
- Grant access by role, not by person — the treasurer role gets accounting access; when the treasurer changes, the access transfers instead of accumulating
- Require MFA on every account touching donor or financial data, board members included — a personal Gmail habit shouldn't be your donor database's weakest link
- Log the review — a simple record of who had access to what, and when it changed, is exactly what funders and cyber-insurance questionnaires increasingly ask to see
Why funders are starting to ask
Grant applications and cyber-insurance renewals are both trending toward the same question set: who can access sensitive data, and how do you know? A nonprofit that can produce a current access log looks like a well-run organization. One that answers "we're not totally sure" invites exactly the follow-up questions nobody wants mid-application.
Pull your board roster and your system access list side by side this week — before giving season volunteer numbers swell further. Anyone on the access list who isn't on the current roster gets revoked today. If you'd like help building the annual process, our free nonprofit IT assessment starts with exactly this review.
Board turnover is a sign of healthy governance. Make sure your systems reflect that same health — access that changes when people do, not access that just quietly accumulates.
Andrew — Founder, NextGen Strategy Partners
Veteran-owned managed IT for the nonprofits, schools, behavioral health providers, and medical & dental practices of McHenry & Lake Counties. Request a free security assessment →