When a volunteer IT helper or tech coordinator leaves your non-profit, the clock starts ticking immediately. Most small community organizations operate on trust, often sharing administrative credentials via casual text messages or sticky notes. However, even when departures are amicable, leaving access open creates severe organizational vulnerability.
Your first 24 hours must focus on securing entry points without disrupting day-to-day operations. Begin by taking inventory of all primary administration dashboards: your Google Workspace or Microsoft 365 tenant, your domain registrar (such as GoDaddy or Namecheap), web hosting, and your donor database. Do not delete the outgoing volunteer’s account immediately; outright deletion can break automated workflows or cause immediate loss of important document ownership. Instead, change the account password, revoke active sign-in sessions, and disable their Multi-Factor Authentication (MFA) recovery methods.
Next, verify whether the tech helper used their personal phone number or personal email for account recovery verification. A common pitfall occurs when an executive director attempts to reset a master password, only for the two-factor SMS prompt to ping the former volunteer’s mobile device. Reassign all recovery channels to an official, role-based inbox such as [email protected].
Finally, confirm who holds primary billing authority on all active software subscriptions. Ensure that payment methods and renewal notices are routed to the executive leadership team. By completing these key baseline steps in the first 24 hours, you establish operational control and safeguard critical donor and client data.