Sample Community Church operational readiness

Internal Financial Controls scored 2 of 6 available points (33%, Limited) with 4 unmet readiness criteria.

Best in class: Written policies with segregation of duties, two-person offering counts, dual authorization above a set threshold, restricted-fund tracking and an annual controls self-review.

• Are duties for receiving, recording and reconciling separated? — Errors and fraud are undetectable from inside.
• Do payments above a stated threshold require dual authorization? — A single point of failure on the largest amounts.
• Are restricted and designated funds tracked separately from general funds? — Misuse of restricted gifts is a legal and trust exposure.

Recommendation: Adopt a written internal-controls policy with two-person counts, dual authorization thresholds and an annual controls self-review reported to the board.

Data Backup & Recovery scored 2 of 5 available points (40%, Developing) with 3 unmet readiness criteria.

Best in class: Automated daily backups with one off-site immutable copy, a defined recovery objective, and a restore test performed and documented at least annually.

• Has a restore been successfully tested in the last 12 months? — Untested backups frequently fail when needed.
• Are recovery time and data-loss objectives defined in writing? — Leadership cannot plan around an outage.
• Are backup copies protected from deletion or encryption by an attacker? — Modern ransomware targets backups first.

Recommendation: Automate daily backups with an off-site immutable copy and perform a documented restore test at least annually.

Cash Flow Management scored 2 of 4 available points (50%, Developing) with 2 unmet readiness criteria.

Best in class: A rolling 13-week cash forecast, a board-adopted reserve policy at three to six months of operating expense, and documented debt-service headroom.

• Is there a board-adopted operating reserve policy? — Reserves get spent on the loudest need.
• Are seasonal giving patterns built into the cash plan? — Avoidable short-term borrowing or deferred payables.

Recommendation: Adopt a written reserve policy with a funding schedule and maintain a rolling 13-week cash forecast reviewed monthly.

IT Security Measures scored 3 of 6 available points (50%, Developing) with 3 unmet readiness criteria.

Best in class: Multi-factor authentication on every account, managed endpoint protection, patching within 30 days, least-privilege access reviewed quarterly and a written incident response plan.

• Is administrative access limited to named individuals and reviewed quarterly? — Former staff and volunteers may retain full control.
• Is there a written incident response plan naming who does what? — Improvised response multiplies damage and downtime.
• Is access removed the same day a staff member or volunteer departs? — Departed people retain access to sensitive systems.

Recommendation: Enforce multi-factor authentication on all accounts, deploy managed endpoint protection, patch within 30 days and adopt a written incident response plan.

HR Policies Documentation scored 2 of 5 available points (40%, Developing) with 3 unmet readiness criteria.

Best in class: Current written policies reviewed annually with counsel, covering classification, leave, safeguarding, grievance and background screening, acknowledged by every worker.

• Are employee versus contractor classifications documented? — Misclassification carries tax and penalty risk.
• Is background screening required and documented for all child- and youth-facing roles? — The highest-severity risk a church carries.
• Has every worker signed acknowledgment of the current policies? — Enforcement is unsustainable without acknowledgment.

Recommendation: Consolidate and date-stamp all HR policies, obtain an annual legal review, and collect signed acknowledgments from every worker.

Audited Financial Statements scored 3 of 6 available points (50%, Developing) with 3 unmet readiness criteria.

Best in class: An independent annual audit or review completed within 120 days of year end, with no material weaknesses and a management letter worked to closure.

• Did the most recent report contain no material weaknesses? — Unresolved weaknesses are the most common precursor to loss.
• Is the auditor's management letter tracked to written closure? — The same findings repeat year after year.
• Does the board formally accept the audited statements in recorded minutes? — Fiduciary responsibility is undocumented if questioned.

Recommendation: Engage an independent firm for an annual audit or review, publish a year-end close calendar, and track management-letter items to closure.

Board Financial Oversight scored 2 of 4 available points (50%, Developing) with 2 unmet readiness criteria.

Best in class: A finance or audit committee with a written charter, financially literate members, quarterly review of statements and an annual conflict-of-interest process.

• Do board members receive financial orientation on joining? — Approval becomes a formality.
• Is an annual conflict-of-interest declaration collected? — Undisclosed conflicts damage trust irreparably.

Recommendation: Charter a finance committee, provide board financial orientation, and run an annual conflict-of-interest declaration cycle.

Employee Training & Development scored 2 of 4 available points (50%, Developing) with 2 unmet readiness criteria.

Best in class: A documented onboarding path plus annual required training in safeguarding, financial controls and data privacy, with completion tracked per person.

• Do finance-handling staff receive annual controls training? — Well-intentioned people breach controls unknowingly.
• Is completion of required training tracked per person? — Cannot demonstrate compliance if challenged.

Recommendation: Define required annual training by role — safeguarding, controls, privacy — and track completion to 100%.

Data Privacy & Protection scored 2 of 4 available points (50%, Developing) with 2 unmet readiness criteria.

Best in class: A published privacy notice, a data inventory identifying sensitive records and their location, a written retention schedule, and role-based access to giving and pastoral records.

• Is access to giving records limited by role? — A serious breach of pastoral confidence.
• Is there a written data retention and disposal schedule? — Unnecessary retention increases breach impact.

Recommendation: Publish a privacy notice, complete a data inventory with a retention schedule, and enforce role-based access to giving and pastoral records.

Email Security scored 1 of 2 available points (50%, Developing) with 1 unmet readiness criterion.

Best in class: SPF, DKIM and DMARC published and enforced, external-sender warnings enabled, and annual staff phishing awareness training with a wire-verification rule.

• Does a verbal verification rule apply to every payment-detail change? — Business-email compromise is the largest single-loss risk.

Recommendation: Publish and enforce SPF, DKIM and DMARC, enable external-sender warnings, and require a verbal wire-verification rule.

Network Security scored 3 of 5 available points (60%, Adequate) with 2 unmet readiness criteria.

Best in class: A managed firewall with current firmware, guest wifi separated from staff and finance systems, unique credentials, and quarterly review of remote-access paths.

• Are remote-access paths documented and reviewed quarterly? — Forgotten access paths are a common breach route.
• Is a current network diagram maintained? — Troubleshooting and recovery take far longer.

Recommendation: Separate guest wifi from staff and finance networks, keep firewall firmware current, and review remote access quarterly.

Monthly Financial Reporting scored 3 of 4 available points (75%, Adequate) with 1 unmet readiness criterion.

Best in class: A decision-ready monthly package delivered within 10 business days: activities, position, cash position, budget variance and a one-page narrative a non-accountant can act on.

• Are all bank and giving accounts reconciled and signed off monthly? — Errors and misappropriation can persist undetected.

Recommendation: Standardize a monthly close calendar and a four-page leadership package with plain-language variance commentary.

Technology Strategic Planning scored 0 of 2 available points (0%, Minimal) with 2 unmet readiness criteria.

Best in class: A two- to three-year technology roadmap tied to ministry priorities, with an annual budget and a review of ministry outcomes achieved.

• Is there a written multi-year technology plan tied to ministry priorities? — Spend accumulates without ministry benefit.
• Is technology reviewed annually against ministry outcomes? — Tools proliferate while outcomes stay flat.

Recommendation: Adopt a two- to three-year technology roadmap tied to ministry priorities with an annual budget and outcome review.

Performance Review Process scored 1 of 4 available points (25%, Limited) with 3 unmet readiness criteria.

Best in class: Annual written reviews for every staff member against role-specific goals, with a mid-year check-in and a documented development conversation.

• Are reviews conducted against written role-specific goals? — Reviews become personality assessments.
• Is a mid-year check-in held and documented? — Small issues become termination decisions.
• Is review completion tracked centrally? — Reviews quietly stop happening.

Recommendation: Adopt a single annual review template with role goals and a mid-year check-in, tracked to 100% completion.

Compensation Strategy scored 1 of 3 available points (33%, Limited) with 2 unmet readiness criteria.

Best in class: Written pay ranges benchmarked to comparable churches by size and region, reviewed annually, with housing allowance and benefits documented and board-approved.

• Are ranges benchmarked against comparable churches? — Over- or under-paying without knowing it.
• Does the board approve senior compensation in recorded minutes? — A reasonable-compensation challenge would be hard to answer.

Recommendation: Establish benchmarked written pay ranges by role, reviewed annually and approved by the board.

Financial Performance Analysis scored 2 of 4 available points (50%, Developing) with 2 unmet readiness criteria.

Best in class: Tracked KPIs with targets — giving per attender, recurring-giving share, contributor retention, top-ten concentration and cost per ministry outcome — reviewed monthly against trend.

• Is contributor retention and lapse measured over trailing 12 months? — Pastoral care and revenue are both missed.
• Are ministry costs compared against stated ministry outcomes? — Ineffective programs are funded indefinitely.

Recommendation: Adopt a five-KPI financial scorecard with written definitions and targets, reviewed monthly by the leadership team.

Employee Handbook scored 2 of 4 available points (50%, Developing) with 2 unmet readiness criteria.

Best in class: A current handbook issued to every worker covering conduct, leave, technology use, grievance and safeguarding, with signed receipt and a stated revision date.

• Does it include a written grievance and complaint process? — Issues escalate externally before leadership hears them.
• Has every worker signed receipt of the handbook? — Terms are difficult to enforce.

Recommendation: Publish a dated employee handbook including acceptable technology use and grievance process, with signed receipt from every worker.

Recruitment & Hiring Process scored 2 of 4 available points (50%, Developing) with 2 unmet readiness criteria.

Best in class: Written job descriptions, a defined posting and interview process, structured reference and background checks, and a documented offer approval step.

• Are references and background checks documented for every hire? — Safeguarding and liability exposure.
• Is offer approval documented before an offer is extended? — Unbudgeted salary commitments.

Recommendation: Standardize hiring: written job descriptions, structured interviews, documented references and a single offer-approval step.

IT Support Resources scored 2 of 4 available points (50%, Developing) with 2 unmet readiness criteria.

Best in class: A named support provider with a written response expectation, a request log, and documented escalation for outages affecting weekend services.

• Are support requests logged? — Root causes are never addressed.
• Is there documented escalation for weekend service outages? — Service disruption is visible to the whole congregation.

Recommendation: Contract a named support provider with a written response expectation and publish an escalation card for weekend services.

Annual Budget Process scored 4 of 6 available points (67%, Adequate) with 2 unmet readiness criteria.

Best in class: A documented annual calendar with ministry-level input, board approval before the fiscal year begins, and a written mid-year reforecast tied to strategic ministry priorities.

• Is the budget built with revenue assumptions documented in writing? — A shortfall is discovered mid-year, not modeled.
• Is a formal mid-year reforecast performed and presented? — Deficits compound before anyone reacts.

Recommendation: Publish a budget calendar with ministry request forms, board approval before year start, and a required mid-year reforecast.

Employee Retention Tracking scored 0 of 3 available points (0%, Minimal) with 3 unmet readiness criteria.

Best in class: Turnover measured annually by role and tenure, exit interviews conducted and themed, and a written retention plan for critical roles.

• Is staff turnover measured and reported annually? — Chronic churn is normalized.
• Are exit interviews conducted and themes recorded? — The same cause repeats indefinitely.
• Is there a written succession note for each critical role? — A single departure can stop ministry operations.

Recommendation: Measure annual turnover by role, conduct exit interviews, and document a retention and succession note for each critical role.

Professional Development Budget scored 1 of 3 available points (33%, Limited) with 2 unmet readiness criteria.

Best in class: A dedicated line item of one to three percent of personnel cost, allocated by written development plans and reviewed for outcome.

• Does each staff member have a written development plan? — Investment produces no measurable capability gain.
• Is development spend reviewed against outcomes annually? — Budget is spent without knowing what it produced.

Recommendation: Create a dedicated development budget line with individual plans and an annual review of spend against outcomes.

Software License Management scored 2 of 4 available points (50%, Developing) with 2 unmet readiness criteria.

Best in class: A complete application inventory with owner, cost, renewal date and license count, reconciled annually against actual usage.

• Is there a renewal calendar with cost per application? — Duplicate and unused spend accumulates.
• Are license counts reconciled against actual users annually? — Compliance exposure and wasted budget.

Recommendation: Build an application inventory with owner, cost, renewal date and license count, and reconcile it annually against usage.

Hardware Maintenance scored 2 of 3 available points (67%, Adequate) with 1 unmet readiness criterion.

Best in class: A device inventory with age and warranty status, a replacement cycle funded in the budget, and preventative maintenance for audio-visual and network equipment.

• Is preventative maintenance performed on audio-visual and network equipment? — Weekend service quality suffers unpredictably.

Recommendation: Maintain a device inventory with age and warranty, and fund a replacement cycle in the annual budget.