Start with the current admin list and purpose
Check admin access after staff changes, board changes and programme handovers. A small non-profit can go months without a formal review, then suddenly discover that an old committee member still has full control. That is not ideal when you need order during year-end reporting, donor audits, or when load-shedding knocks out the office and people are working from phones at home.
A good rule is to review access every quarter, and again after any staff movement, supplier change, or migration. In coastal towns like Cape Town and Durban, also check whether mobile access is still being used on devices that may have been replaced because of humidity or battery issues. The review does not need to be complicated, just regular and recorded.
- Quarterly scheduled review
- Immediate review after exits or role changes
- Review before migration or major setup changes
- Review after board or committee turnover
Match permission levels to real duties
Not everyone needs full administrator rights. In fact, most people should not have them. Separate daily tasks from control tasks so the team can work without giving away unnecessary access. Someone who sends newsletters may need contact list management but not password resets. Someone who books meetings may need calendar control but not document-wide admin rights.
When reviewing roles, ask what each person actually does each week. If their work has shifted from operations to support, or from training to projects, their access should shift too. Keep the setup simple enough that the team understands it. Too many loose permissions often causes confusion, and one mistaken change can affect the whole office.
- Assign access by duty, not by habit
- Remove admin rights where standard access is enough
- Keep at least two trusted admins for continuity
- Avoid shared login details for permanent admin work
Review shared calendars and document spaces separately
Calendar sharing and document collaboration often build up quietly over time. A project folder may be shared with external volunteers, or an event calendar may still allow editing by someone who left after the campaign ended. Review each shared space on its own, not just the main admin list. This helps you spot old permissions that no longer suit the work.
Look at who can view, edit, and manage access. If a folder contains donor records, meeting notes or finance files, limit access tightly. For public programmes, a wider group may need viewing rights but only a few people should be able to change entries. Keep a record of who owns each calendar and document area so there is no confusion later.
- List all shared calendars and document spaces
- Check who can edit versus who can view
- Remove ex-staff, interns and volunteers who no longer need access
- Confirm one clear owner for each shared area
Use a simple review checklist before every change
A short checklist keeps the review consistent, especially when more than one person handles administration. It also helps if the organisation changes hands on the support side or if you bring in someone new for a migration. Write the steps down and use the same process every time. That way, nothing gets missed when things are busy.
Before making changes, check current users, active permissions, linked devices and recovery options. Confirm who signs off on a removal, who updates the internal records, and who tells staff about the change. If someone needs temporary access for a project, set an end date right away. That prevents the common problem of temporary access becoming permanent by accident.
- Confirm the reason for the change
- Check all affected mailboxes, calendars and documents
- Set expiry dates for temporary access
- Record who approved the change and when
Keep control after the review is done
A review only helps if the result is kept up to date. Save the final admin list in one safe place and update it when a role changes. If you use paper notes or scattered files, the record becomes hard to trust. Make sure the team knows who to contact when a new account is needed, or when someone leaves and access must be closed immediately. This is especially important for organisations with staff in different cities.
Make sure more than one person is trained on the process. If the only person who understands admin changes is away, access requests can pile up. Keep the handover simple, and review the notes after every onboarding or offboarding. A clean record saves time later, and it reduces the chance of a missed permission.
- Store the latest admin register securely
- Update records after every role change
- Train a backup person on the process
- Review handover notes after onboarding or exit
