Operational Readiness Report

Leland's Seven Stewardship Principles — Church Stewardship Program

Operational Readiness Report

Sample Community Church — Atlanta, GA · 1,180 weekly attenders · 2 campuses

Baseline 2026-06-18 · version OR-1.0 (prototype) · respondent Danielle Osei, Finance Director

46of 100

Bronze tier

At risk

Executive summary

Sample Community Church scores 46 of 100 on the Church Operational Readiness assessment, placing the church in the Bronze tier. 46 of 99 available points were earned, with 1 point excluded as not applicable and normalized out of the denominator.

Section performance: Accounting 19 of 35 (53%, Developing); Human Resources 11 of 30 (37%, Limited); Information Technology 17 of 35 (49%, Developing). The strongest topic is Monthly Financial Reporting at 75%; the three weakest are Employee Retention Tracking (0%), Technology Strategic Planning (0%), Performance Review Process (25%).

4 critical and 8 high-severity findings are open. Evidence completeness is 33% and reporting confidence is Medium, so several findings rest on self-reported responses until documents are supplied.

Recommended posture: structured 12-month plan. Sequence foundations first: controls, cash discipline, safeguarding, security baseline. 18–24 month horizon: build the operating disciplines that make growth survivable.

Section results

Section	Score	Percent	Maturity
Accounting & Financial Reporting	19 of 35	53%	Developing
Human Resources	11 of 30	37%	Limited
Information Technology	17 of 35	49%	Developing

Topic results

Topic	Section	Earned	Available	Percent	Maturity
Audited Financial Statements	Accounting & Financial Reporting	3	6	50%	Developing
Monthly Financial Reporting	Accounting & Financial Reporting	3	4	75%	Adequate
Annual Budget Process	Accounting & Financial Reporting	4	6	67%	Adequate
Internal Financial Controls	Accounting & Financial Reporting	2	6	33%	Limited
Financial Performance Analysis	Accounting & Financial Reporting	2	4	50%	Developing
Cash Flow Management	Accounting & Financial Reporting	2	4	50%	Developing
Board Financial Oversight	Accounting & Financial Reporting	2	4	50%	Developing
HR Policies Documentation	Human Resources	2	5	40%	Developing
Performance Review Process	Human Resources	1	4	25%	Limited
Employee Training & Development	Human Resources	2	4	50%	Developing
Compensation Strategy	Human Resources	1	3	33%	Limited
Employee Handbook	Human Resources	2	4	50%	Developing
Recruitment & Hiring Process	Human Resources	2	4	50%	Developing
Employee Retention Tracking	Human Resources	0	3	0%	Minimal
Professional Development Budget	Human Resources	1	3	33%	Limited
IT Security Measures	Information Technology	3	6	50%	Developing
Data Backup & Recovery	Information Technology	2	5	40%	Developing
Software License Management	Information Technology	2	4	50%	Developing
Network Security	Information Technology	3	5	60%	Adequate
Data Privacy & Protection	Information Technology	2	4	50%	Developing
IT Support Resources	Information Technology	2	4	50%	Developing
Hardware Maintenance	Information Technology	2	3	67%	Adequate
Email Security	Information Technology	1	2	50%	Developing
Technology Strategic Planning	Information Technology	0	2	0%	Minimal

Response and evidence detail

Audited Financial Statements — 3 of 6 (50%, Developing)

Yes — Has an independent audit or review been completed for the most recent fiscal year?
Yes — Was that report issued within 120 days of fiscal year end?
Yes — Are prior-year comparatives presented alongside current results?
No — Did the most recent report contain no material weaknesses?
Not yet — Is the auditor's management letter tracked to written closure?
No — Does the board formally accept the audited statements in recorded minutes?

Evidence requested: Most recent audit or review report · Auditor management letter · Engagement letter · Prior-year comparatives

Monthly Financial Reporting — 3 of 4 (75%, Adequate)

Yes — Is a financial package produced every month without exception?
Yes — Is it delivered within 10 business days of month end?
Yes — Does it include budget-to-actual variance with written explanation?
No — Are all bank and giving accounts reconciled and signed off monthly?

Evidence requested: Last three monthly packages · Close calendar · Reconciliation sign-offs · Distribution list

Annual Budget Process — 4 of 6 (67%, Adequate)

Yes — Is there a written annual budget approved by the governing board?
Yes — Is the budget approved before the fiscal year begins?
Yes — Is there a documented budget calendar with owners and dates?
Yes — Do ministry leaders submit written funding requests tied to outcomes?
Not yet — Is the budget built with revenue assumptions documented in writing?
No — Is a formal mid-year reforecast performed and presented?

Evidence requested: Approved annual budget · Budget calendar · Ministry request forms · Approval minutes · Mid-year reforecast

Internal Financial Controls — 2 of 6 (33%, Limited)

Yes — Is there a written internal financial controls policy?
Yes — Are offering counts performed by two unrelated people?
Not yet — Are duties for receiving, recording and reconciling separated?
No — Do payments above a stated threshold require dual authorization?
Not yet — Are restricted and designated funds tracked separately from general funds?
No — Is a controls self-review completed annually and reported to the board?

Evidence requested: Written controls policy · Count sheets · Approval matrix · Restricted-fund register · Controls self-review

Financial Performance Analysis — 2 of 4 (50%, Developing)

Yes — Are financial KPIs defined in writing with target ranges?
Yes — Is giving concentration in the largest households monitored?
Not yet — Is contributor retention and lapse measured over trailing 12 months?
No — Are ministry costs compared against stated ministry outcomes?

Evidence requested: KPI definition sheet · Trend dashboard export · Giving concentration analysis

Cash Flow Management — 2 of 4 (50%, Developing)

Yes — Is a rolling short-term cash forecast maintained?
Yes — Is operating runway in months known and reported?
Not yet — Is there a board-adopted operating reserve policy?
No — Are seasonal giving patterns built into the cash plan?
Not applicable — Is every debt obligation and covenant documented and monitored?

Evidence requested: 13-week cash forecast · Reserve policy · Debt schedule · Bank covenant summary

Board Financial Oversight — 2 of 4 (50%, Developing)

Yes — Is there a finance or audit committee with a written charter?
Yes — Does the board review financial statements at least quarterly, minuted?
Not yet — Do board members receive financial orientation on joining?
No — Is an annual conflict-of-interest declaration collected?

Evidence requested: Committee charter · Quarterly minutes · Conflict-of-interest declarations · Board financial orientation materials

HR Policies Documentation — 2 of 5 (40%, Developing)

Yes — Is there a consolidated written set of HR policies?
Yes — Has the policy set been reviewed in the last 12 months?
Not yet — Are employee versus contractor classifications documented?
No — Is background screening required and documented for all child- and youth-facing roles?
Not yet — Has every worker signed acknowledgment of the current policies?

Evidence requested: Policy manual with revision dates · Legal review note · Acknowledgment log · Background-check policy

Performance Review Process — 1 of 4 (25%, Limited)

Yes — Does every staff member receive a written annual review?
No — Are reviews conducted against written role-specific goals?
Not yet — Is a mid-year check-in held and documented?
No — Is review completion tracked centrally?

Evidence requested: Review template · Completed review sample (redacted) · Review completion tracker · Goal sheets

Employee Training & Development — 2 of 4 (50%, Developing)

Yes — Is there a documented onboarding path for new staff?
Yes — Is annual safeguarding training required and recorded?
Not yet — Do finance-handling staff receive annual controls training?
No — Is completion of required training tracked per person?

Evidence requested: Onboarding checklist · Training calendar · Completion records · Safeguarding certificates

Compensation Strategy — 1 of 3 (33%, Limited)

Yes — Are written pay ranges defined for each role?
No — Are ranges benchmarked against comparable churches?
Not yet — Does the board approve senior compensation in recorded minutes?

Evidence requested: Pay range schedule · Benchmark study reference · Board compensation approval minutes

Employee Handbook — 2 of 4 (50%, Developing)

Yes — Does a current employee handbook exist?
Yes — Does it carry a revision date within the last two years?
Not yet — Does it include a written grievance and complaint process?
No — Has every worker signed receipt of the handbook?

Evidence requested: Current handbook PDF · Revision history · Signed receipts · Technology acceptable-use section

Recruitment & Hiring Process — 2 of 4 (50%, Developing)

Yes — Does every role have a current written job description?
Yes — Is there a defined posting and candidate evaluation process?
Not yet — Are references and background checks documented for every hire?
No — Is offer approval documented before an offer is extended?

Evidence requested: Job description library · Interview guide · Reference check records · Offer approval workflow

Employee Retention Tracking — 0 of 3 (0%, Minimal)

Not yet — Is staff turnover measured and reported annually?
No — Are exit interviews conducted and themes recorded?
Not yet — Is there a written succession note for each critical role?

Evidence requested: Turnover calculation · Exit interview summaries (themed) · Critical-role succession notes

Professional Development Budget — 1 of 3 (33%, Limited)

Yes — Is there a dedicated professional development budget line?
No — Does each staff member have a written development plan?
Not yet — Is development spend reviewed against outcomes annually?

Evidence requested: Budget line item · Individual development plans · Spend versus plan report

IT Security Measures — 3 of 6 (50%, Developing)

Yes — Is multi-factor authentication enforced on all staff accounts?
Yes — Is managed endpoint protection installed on every church device?
Yes — Are operating systems and applications patched within 30 days?
No — Is administrative access limited to named individuals and reviewed quarterly?
Not yet — Is there a written incident response plan naming who does what?
No — Is access removed the same day a staff member or volunteer departs?

Evidence requested: MFA coverage report · Endpoint protection inventory · Patch status export · Access review record · Incident response plan

Data Backup & Recovery — 2 of 5 (40%, Developing)

Yes — Are backups of financial and membership data automated daily?
Yes — Is at least one backup copy held off-site or in a separate cloud account?
Not yet — Has a restore been successfully tested in the last 12 months?
No — Are recovery time and data-loss objectives defined in writing?
Not yet — Are backup copies protected from deletion or encryption by an attacker?

Evidence requested: Backup schedule and logs · Off-site copy confirmation · Documented restore test · Recovery objectives

Software License Management — 2 of 4 (50%, Developing)

Yes — Is there a complete inventory of software and subscriptions in use?
Yes — Does each application have a named internal owner?
Not yet — Is there a renewal calendar with cost per application?
No — Are license counts reconciled against actual users annually?

Evidence requested: Application inventory · Renewal calendar · License counts versus users · Annual spend summary

Network Security — 3 of 5 (60%, Adequate)

Yes — Is guest wifi separated from staff and finance systems?
Yes — Is there a managed firewall with current firmware?
Yes — Have all default device passwords been changed?
No — Are remote-access paths documented and reviewed quarterly?
Not yet — Is a current network diagram maintained?

Evidence requested: Firewall configuration summary · Network diagram · Guest network separation proof · Remote access review

Data Privacy & Protection — 2 of 4 (50%, Developing)

Yes — Is a privacy notice published to members and participants?
Yes — Is there an inventory of where sensitive records are stored?
Not yet — Is access to giving records limited by role?
No — Is there a written data retention and disposal schedule?

Evidence requested: Privacy notice · Data inventory · Retention schedule · Access matrix for giving records

IT Support Resources — 2 of 4 (50%, Developing)

Yes — Is there a named IT support provider or staff member?
Yes — Is there a written response-time expectation?
Not yet — Are support requests logged?
No — Is there documented escalation for weekend service outages?

Evidence requested: Support agreement · Ticket log sample · Escalation contact sheet · Weekend service continuity note

Hardware Maintenance — 2 of 3 (67%, Adequate)

Yes — Is there an inventory of church-owned devices with age and warranty?
Yes — Is a replacement cycle funded in the budget?
Not yet — Is preventative maintenance performed on audio-visual and network equipment?

Evidence requested: Device inventory with age · Replacement schedule · AV maintenance log

Email Security — 1 of 2 (50%, Developing)

Yes — Are SPF, DKIM and DMARC configured for the church domain?
No — Does a verbal verification rule apply to every payment-detail change?

Evidence requested: DNS record export · External-sender banner sample · Phishing training completion

Technology Strategic Planning — 0 of 2 (0%, Minimal)

Not yet — Is there a written multi-year technology plan tied to ministry priorities?
No — Is technology reviewed annually against ministry outcomes?

Evidence requested: Technology roadmap · Annual technology budget · Prior-year outcome review

Findings and recommendations

Internal Financial Controls · Accounting & Financial Reporting
Critical severity
Internal Financial Controls scored 2 of 6 available points (33%, Limited) with 4 unmet readiness criteria.
Best in class: Written policies with segregation of duties, two-person offering counts, dual authorization above a set threshold, restricted-fund tracking and an annual controls self-review.
Recommendation: Adopt a written internal-controls policy with two-person counts, dual authorization thresholds and an annual controls self-review reported to the board.
Data Backup & Recovery · Information Technology
Critical severity
Data Backup & Recovery scored 2 of 5 available points (40%, Developing) with 3 unmet readiness criteria.
Best in class: Automated daily backups with one off-site immutable copy, a defined recovery objective, and a restore test performed and documented at least annually.
Recommendation: Automate daily backups with an off-site immutable copy and perform a documented restore test at least annually.
Cash Flow Management · Accounting & Financial Reporting
Critical severity
Cash Flow Management scored 2 of 4 available points (50%, Developing) with 2 unmet readiness criteria.
Best in class: A rolling 13-week cash forecast, a board-adopted reserve policy at three to six months of operating expense, and documented debt-service headroom.
Recommendation: Adopt a written reserve policy with a funding schedule and maintain a rolling 13-week cash forecast reviewed monthly.
IT Security Measures · Information Technology
Critical severity
IT Security Measures scored 3 of 6 available points (50%, Developing) with 3 unmet readiness criteria.
Best in class: Multi-factor authentication on every account, managed endpoint protection, patching within 30 days, least-privilege access reviewed quarterly and a written incident response plan.
Recommendation: Enforce multi-factor authentication on all accounts, deploy managed endpoint protection, patch within 30 days and adopt a written incident response plan.
HR Policies Documentation · Human Resources
High severity
HR Policies Documentation scored 2 of 5 available points (40%, Developing) with 3 unmet readiness criteria.
Best in class: Current written policies reviewed annually with counsel, covering classification, leave, safeguarding, grievance and background screening, acknowledged by every worker.
Recommendation: Consolidate and date-stamp all HR policies, obtain an annual legal review, and collect signed acknowledgments from every worker.
Audited Financial Statements · Accounting & Financial Reporting
High severity
Audited Financial Statements scored 3 of 6 available points (50%, Developing) with 3 unmet readiness criteria.
Best in class: An independent annual audit or review completed within 120 days of year end, with no material weaknesses and a management letter worked to closure.
Recommendation: Engage an independent firm for an annual audit or review, publish a year-end close calendar, and track management-letter items to closure.
Board Financial Oversight · Accounting & Financial Reporting
High severity
Board Financial Oversight scored 2 of 4 available points (50%, Developing) with 2 unmet readiness criteria.
Best in class: A finance or audit committee with a written charter, financially literate members, quarterly review of statements and an annual conflict-of-interest process.
Recommendation: Charter a finance committee, provide board financial orientation, and run an annual conflict-of-interest declaration cycle.
Employee Training & Development · Human Resources
High severity
Employee Training & Development scored 2 of 4 available points (50%, Developing) with 2 unmet readiness criteria.
Best in class: A documented onboarding path plus annual required training in safeguarding, financial controls and data privacy, with completion tracked per person.
Recommendation: Define required annual training by role — safeguarding, controls, privacy — and track completion to 100%.
Data Privacy & Protection · Information Technology
High severity
Data Privacy & Protection scored 2 of 4 available points (50%, Developing) with 2 unmet readiness criteria.
Best in class: A published privacy notice, a data inventory identifying sensitive records and their location, a written retention schedule, and role-based access to giving and pastoral records.
Recommendation: Publish a privacy notice, complete a data inventory with a retention schedule, and enforce role-based access to giving and pastoral records.
Email Security · Information Technology
High severity
Email Security scored 1 of 2 available points (50%, Developing) with 1 unmet readiness criterion.
Best in class: SPF, DKIM and DMARC published and enforced, external-sender warnings enabled, and annual staff phishing awareness training with a wire-verification rule.
Recommendation: Publish and enforce SPF, DKIM and DMARC, enable external-sender warnings, and require a verbal wire-verification rule.
Network Security · Information Technology
High severity
Network Security scored 3 of 5 available points (60%, Adequate) with 2 unmet readiness criteria.
Best in class: A managed firewall with current firmware, guest wifi separated from staff and finance systems, unique credentials, and quarterly review of remote-access paths.
Recommendation: Separate guest wifi from staff and finance networks, keep firewall firmware current, and review remote access quarterly.
Monthly Financial Reporting · Accounting & Financial Reporting
High severity
Monthly Financial Reporting scored 3 of 4 available points (75%, Adequate) with 1 unmet readiness criterion.
Best in class: A decision-ready monthly package delivered within 10 business days: activities, position, cash position, budget variance and a one-page narrative a non-accountant can act on.
Recommendation: Standardize a monthly close calendar and a four-page leadership package with plain-language variance commentary.
Technology Strategic Planning · Information Technology
Medium severity
Technology Strategic Planning scored 0 of 2 available points (0%, Minimal) with 2 unmet readiness criteria.
Best in class: A two- to three-year technology roadmap tied to ministry priorities, with an annual budget and a review of ministry outcomes achieved.
Recommendation: Adopt a two- to three-year technology roadmap tied to ministry priorities with an annual budget and outcome review.
Performance Review Process · Human Resources
Medium severity
Performance Review Process scored 1 of 4 available points (25%, Limited) with 3 unmet readiness criteria.
Best in class: Annual written reviews for every staff member against role-specific goals, with a mid-year check-in and a documented development conversation.
Recommendation: Adopt a single annual review template with role goals and a mid-year check-in, tracked to 100% completion.
Compensation Strategy · Human Resources
Medium severity
Compensation Strategy scored 1 of 3 available points (33%, Limited) with 2 unmet readiness criteria.
Best in class: Written pay ranges benchmarked to comparable churches by size and region, reviewed annually, with housing allowance and benefits documented and board-approved.
Recommendation: Establish benchmarked written pay ranges by role, reviewed annually and approved by the board.
Financial Performance Analysis · Accounting & Financial Reporting
Medium severity
Financial Performance Analysis scored 2 of 4 available points (50%, Developing) with 2 unmet readiness criteria.
Best in class: Tracked KPIs with targets — giving per attender, recurring-giving share, contributor retention, top-ten concentration and cost per ministry outcome — reviewed monthly against trend.
Recommendation: Adopt a five-KPI financial scorecard with written definitions and targets, reviewed monthly by the leadership team.
Employee Handbook · Human Resources
Medium severity
Employee Handbook scored 2 of 4 available points (50%, Developing) with 2 unmet readiness criteria.
Best in class: A current handbook issued to every worker covering conduct, leave, technology use, grievance and safeguarding, with signed receipt and a stated revision date.
Recommendation: Publish a dated employee handbook including acceptable technology use and grievance process, with signed receipt from every worker.
Recruitment & Hiring Process · Human Resources
Medium severity
Recruitment & Hiring Process scored 2 of 4 available points (50%, Developing) with 2 unmet readiness criteria.
Best in class: Written job descriptions, a defined posting and interview process, structured reference and background checks, and a documented offer approval step.
Recommendation: Standardize hiring: written job descriptions, structured interviews, documented references and a single offer-approval step.
IT Support Resources · Information Technology
Medium severity
IT Support Resources scored 2 of 4 available points (50%, Developing) with 2 unmet readiness criteria.
Best in class: A named support provider with a written response expectation, a request log, and documented escalation for outages affecting weekend services.
Recommendation: Contract a named support provider with a written response expectation and publish an escalation card for weekend services.
Annual Budget Process · Accounting & Financial Reporting
Medium severity
Annual Budget Process scored 4 of 6 available points (67%, Adequate) with 2 unmet readiness criteria.
Best in class: A documented annual calendar with ministry-level input, board approval before the fiscal year begins, and a written mid-year reforecast tied to strategic ministry priorities.
Recommendation: Publish a budget calendar with ministry request forms, board approval before year start, and a required mid-year reforecast.
Employee Retention Tracking · Human Resources
Low severity
Employee Retention Tracking scored 0 of 3 available points (0%, Minimal) with 3 unmet readiness criteria.
Best in class: Turnover measured annually by role and tenure, exit interviews conducted and themed, and a written retention plan for critical roles.
Recommendation: Measure annual turnover by role, conduct exit interviews, and document a retention and succession note for each critical role.
Professional Development Budget · Human Resources
Low severity
Professional Development Budget scored 1 of 3 available points (33%, Limited) with 2 unmet readiness criteria.
Best in class: A dedicated line item of one to three percent of personnel cost, allocated by written development plans and reviewed for outcome.
Recommendation: Create a dedicated development budget line with individual plans and an annual review of spend against outcomes.
Software License Management · Information Technology
Low severity
Software License Management scored 2 of 4 available points (50%, Developing) with 2 unmet readiness criteria.
Best in class: A complete application inventory with owner, cost, renewal date and license count, reconciled annually against actual usage.
Recommendation: Build an application inventory with owner, cost, renewal date and license count, and reconcile it annually against usage.
Hardware Maintenance · Information Technology
Low severity
Hardware Maintenance scored 2 of 3 available points (67%, Adequate) with 1 unmet readiness criterion.
Best in class: A device inventory with age and warranty status, a replacement cycle funded in the budget, and preventative maintenance for audio-visual and network equipment.
Recommendation: Maintain a device inventory with age and warranty, and fund a replacement cycle in the annual budget.

30 / 60 / 90-day plan

Bronze tier · Structured 12-month plan. 18–24 month horizon: build the operating disciplines that make growth survivable.

First 30 days — Stop the highest-severity exposure.

Adopt a written internal-controls policy with two-person counts, dual authorization thresholds and an annual controls self-review reported to the board.
Automate daily backups with an off-site immutable copy and perform a documented restore test at least annually.
Adopt a written reserve policy with a funding schedule and maintain a rolling 13-week cash forecast reviewed monthly.
Enforce multi-factor authentication on all accounts, deploy managed endpoint protection, patch within 30 days and adopt a written incident response plan.

31–60 days — Put written policy and evidence behind the critical fixes.

Consolidate and date-stamp all HR policies, obtain an annual legal review, and collect signed acknowledgments from every worker.
Engage an independent firm for an annual audit or review, publish a year-end close calendar, and track management-letter items to closure.
Charter a finance committee, provide board financial orientation, and run an annual conflict-of-interest declaration cycle.
Define required annual training by role — safeguarding, controls, privacy — and track completion to 100%.
Publish a privacy notice, complete a data inventory with a retention schedule, and enforce role-based access to giving and pastoral records.

61–90 days — Close the medium-severity gaps and prepare board reporting.

Adopt a two- to three-year technology roadmap tied to ministry priorities with an annual budget and outcome review.
Adopt a single annual review template with role goals and a mid-year check-in, tracked to 100% completion.
Establish benchmarked written pay ranges by role, reviewed annually and approved by the board.
Adopt a five-KPI financial scorecard with written definitions and targets, reviewed monthly by the leadership team.
Publish a dated employee handbook including acceptable technology use and grievance process, with signed receipt from every worker.

Structured 12-month plan — Sequence foundations first: controls, cash discipline, safeguarding, security baseline.

Measure annual turnover by role, conduct exit interviews, and document a retention and succession note for each critical role.
Create a dedicated development budget line with individual plans and an annual review of spend against outcomes.
Build an application inventory with owner, cost, renewal date and license count, and reconcile it annually against usage.
Maintain a device inventory with age and warranty, and fund a replacement cycle in the annual budget.

Document request checklist

Employee Retention Tracking — Turnover calculation · Exit interview summaries (themed) · Critical-role succession notes (Evidence outstanding)
Technology Strategic Planning — Technology roadmap · Annual technology budget · Prior-year outcome review (Evidence outstanding)
Performance Review Process — Review template · Completed review sample (redacted) · Review completion tracker · Goal sheets (Evidence outstanding)
Internal Financial Controls — Written controls policy · Count sheets · Approval matrix · Restricted-fund register · Controls self-review (Evidence outstanding)
Compensation Strategy — Pay range schedule · Benchmark study reference · Board compensation approval minutes (Evidence outstanding)
Professional Development Budget — Budget line item · Individual development plans · Spend versus plan report (Evidence outstanding)
HR Policies Documentation — Policy manual with revision dates · Legal review note · Acknowledgment log · Background-check policy (Evidence outstanding)
Data Backup & Recovery — Backup schedule and logs · Off-site copy confirmation · Documented restore test · Recovery objectives (Evidence outstanding)
Audited Financial Statements — Most recent audit or review report · Auditor management letter · Engagement letter · Prior-year comparatives (Evidence on file)
Financial Performance Analysis — KPI definition sheet · Trend dashboard export · Giving concentration analysis (Evidence outstanding)
Cash Flow Management — 13-week cash forecast · Reserve policy · Debt schedule · Bank covenant summary (Evidence outstanding)
Board Financial Oversight — Committee charter · Quarterly minutes · Conflict-of-interest declarations · Board financial orientation materials (Evidence on file)
Employee Training & Development — Onboarding checklist · Training calendar · Completion records · Safeguarding certificates (Evidence outstanding)
Employee Handbook — Current handbook PDF · Revision history · Signed receipts · Technology acceptable-use section (Evidence on file)
Recruitment & Hiring Process — Job description library · Interview guide · Reference check records · Offer approval workflow (Evidence outstanding)
IT Security Measures — MFA coverage report · Endpoint protection inventory · Patch status export · Access review record · Incident response plan (Evidence outstanding)
Software License Management — Application inventory · Renewal calendar · License counts versus users · Annual spend summary (Evidence on file)
Data Privacy & Protection — Privacy notice · Data inventory · Retention schedule · Access matrix for giving records (Evidence outstanding)
IT Support Resources — Support agreement · Ticket log sample · Escalation contact sheet · Weekend service continuity note (Evidence on file)
Email Security — DNS record export · External-sender banner sample · Phishing training completion (Evidence outstanding)
Network Security — Firewall configuration summary · Network diagram · Guest network separation proof · Remote access review (Evidence outstanding)
Annual Budget Process — Approved annual budget · Budget calendar · Ministry request forms · Approval minutes · Mid-year reforecast (Evidence on file)
Hardware Maintenance — Device inventory with age · Replacement schedule · AV maintenance log (Evidence on file)
Monthly Financial Reporting — Last three monthly packages · Close calendar · Reconciliation sign-offs · Distribution list (Evidence on file)

Leadership approval

Draft — requires leadership approval before distribution.

Senior leader — name and date

Board chair — name and date

Signature lines print for wet signature. No electronic signature is captured in this prototype.

Coach review — Leland Rubin

Reviewer notes on sequencing, ownership and readiness for the next reassessment on 2027-03-15.

Reassessment cadence: Every six months during the coaching engagement.