When I began my work in systems development, large IT departments had staff who managed all files and backups. Rooms of data entry clerks did all the keying. Today, end-user staff members handle these activities and, in many cases, lack the required knowledge and skills.
We provide our clients with documentation when we deliver a system. We provide a KMS (see article, No. 4) so the document is saved and accessible. Was it ever read? Was the document saved as recommended? I think we can say no to both questions.
What happens when we acquire different technologies?
These are our suggestions. Please note the phrase ‘they move on’.
1. A charity needs its own credit card to manage tools like MS Azure or online payment systems. Using a staff person’s card doesn’t work as they move on.
2. A charity needs its own cell number, as the number is used for verification, and when a number is a staff person’s phone, what happens when they move on?
3. Serial numbers for all installed software, including renewal dates, need to be recorded and saved where the information is easily accessible.
4. Users of the software need to be recorded, as access to software applications will change when they move on.
5. The charity’s internal tech staff person needs to be trained in the rules and accountable for application requirements.
6. The email used for the above position should be generic and not specific to any one staff member so that notifications are accessible.
7. All applications, databases, audit trail documents, the KMS we discussed, and event files need to be backed up. The internal technology staff position needs to know this information and ensure it happens. If an outside IT service is used, remember they work for the organization, and the charity is responsible for ensuring all requirements are met.
8. Any specific maintenance activity needs to be documented to ensure staff members are following through as required by the application.
9. Passwords for key areas like payment applications, cloud access and more cannot rest with just one person who can arbitrarily change it at any given time. Two or three senior staff members need to know these passwords to ensure access when necessary, and they must be securely saved.
10. All the documentation we have discussed in the past points can be safely stored in the organizations Knowledge Management System, where the information is backed up so that restoration is doable. All these decisions must align with the organization’s security requirements.
None of this sounds easy, but you can maintain it if you document changes as they occur. The above points are a starting list of what we have found. We know there is more to add, but the bottom line is that a staff position needs to define these actions and understand the assets a charity uses to do its business.
Case One: One of our applications shows a message at login indicating when a required utility to protect the data was last run. We recommended running it weekly, something an IT service could do. Unfortunately, no one managed this utility. A new staff member read the message when logging into the application. A long-time staff member told them to ignore it. Then the disaster happened, and their file became corrupted. The charity lost all records from 2017 to 2023. We asked about their backup file, and the IT service group said there was no backup. WHAT?
They were using a new IT service company, and somehow no one mentioned their most important fundraising asset. They had no current backup. We found a 2022 file and asked about audit records that could restore the data. None of those existed either.
Case Two: Charities can access MS Credits for Azure. Once the credit is set up, it is renewable each year. Our documentation indicated that a renewal was needed to maintain the annual credit. Four weeks before the anniversary date, the charity receives a weekly reminder.
We found that, rather than reading the renewal emails, several clients ignored or deleted them. On the renewal date, if the charity has not responded, cloud charges go directly to the credit card on file. Responding to the renewal is a staff issue, and they are responsible for acting. The cost can be hefty when no one is accountable for their job.
Summary
How many other organizations work in this kind of situation, where disaster or elevated costs are just around the corner?
The unfortunate truth is that they are at risk, and it often comes down to delegating to people with little experience or contracting an IT company without fully disclosing all applications.
There are other stories, just not as catastrophic. Times have changed. Everyone knows how to use computers? The question becomes: do they know how to use them well enough to protect their charity and keep it out of risky situations?
Sharron Batsch is the developer of @EASE Fund Development Software and the author of From Chaos to Control, Build a High Performance Team Using Knowledge Management. She has worked with a wide variety of charities for over 36 years as both a consultant and volunteer fundraiser and event chair. She developed and managed a training program through Continuing Education for the University of Manitoba for the business use of microcomputer solutions offering 147 courses annually. While at the University she redeveloped a certificate program in Information Management and hosted a breakfast series for senior IT managers. She has received awards for her work in Knowledge Management from the Consulting Engineers of Canada and the Alberta Consulting Engineers. Her work helps define how charities can best use the data they collect and create an environment with 15 second retrieval using a Knowledge Management System. She specializes in information management for the not-for-profit community.
