An NGO’s technology landscape may be spread across programme teams, finance, operations and external suppliers. Each system may make sense individually while the overall picture remains difficult to explain. A first review should make that picture visible without collecting more sensitive information than the work requires.
1. Map systems and their owners.
Start with systems used for everyday work and important records. Include email, collaboration, finance, programme data, document storage and specialist tools that your organisation actually uses. Identify each system’s business owner, administrator, supplier and renewal or review point where known.
Record what the system supports and what would be affected if it became unavailable. Distinguish between a system that is operationally important and a record that is sensitive; both matter, but raise different questions.
2. Follow access through a staff change.
Walk through how a new team member receives access, how role changes are handled and what happens when someone leaves. Look for a named decision-maker, a clear instruction and evidence the change was completed.
- Who can approve access?
- Where is the current access list maintained?
- Which accounts have administrative privileges?
- Who reviews shared or external access?
- How are supplier-held accounts and organisational ownership handled?
Do not copy passwords or personal records into a review workbook. Agree the minimum information needed and use authorised, appropriately limited access.
3. Ask for recovery evidence.
A statement that backups exist is different from evidence that important information can be restored. Ask who is responsible, what the recovery process covers and whether a recent restore has been demonstrated or documented.
Any test should be planned, authorised and designed to avoid disrupting operations. If evidence is unavailable, record a gap to investigate rather than assuming recovery will work or fail.
4. Review one workflow from beginning to end.
Choose a process staff find difficult, such as requesting an operational payment or finding an approved document. Follow it through the people and systems involved. Identify where information is re-entered, ownership is unclear or status is hard to see.
A process problem does not automatically need a new platform. A clearer approval rule, an agreed owner or a better handover may be the next useful step. Where a new tool is justified, define the requirement before comparing products.
5. Prioritise the next decisions.
Group findings by business impact, urgency, effort and dependency. Agree owners for the next actions and identify decisions needing management attention. Distinguish evidence, interpretation and untested assumptions.
For organisations working in Rwanda or elsewhere in East Africa, confirm applicable data-protection, contractual and donor requirements with qualified advisers and the actual governing documents. This is operational guidance, not a legal opinion, penetration test or compliance certification.
Ubumwe’s Technology Advisory service can help turn a review into a prioritised improvement plan. Scope, access and outputs should be agreed before work starts.