A nonprofit treasurer arrives one morning to find the file server is unreachable. The volunteer who had been managing it for five years, a retired engineer, reliable and well-meaning, has been suddenly hospitalised.
There is no documentation. Nobody else knows the passwords. Ten years of archives, the member database, event photographs and meeting minutes: all sitting behind a blank screen, and nobody knows how to get in.
This is not a rare situation. It is predictable, and yet organisations keep ignoring it.
Why it seems logical at first
Asking a skilled volunteer to handle IT looks like the obvious choice: it costs nothing, the person knows the organisation, and they are motivated. Nonprofits have a long tradition of pooling their members’ expertise, and in many areas that is a genuine strength.
IT is different. Not because volunteers are less capable, but because managing an information system creates structural dependencies that goodwill cannot fix.
The problem with undocumented knowledge
A volunteer works in the flow of doing. They configure a server, set up access rules, fix problems, and they carry all of it in their head because there is no need to write it down while they are there. That tacit knowledge is valuable as long as they are around. It becomes a serious risk the day they are not.
What we see in practice: very few nonprofits have up-to-date technical documentation. Many do not even know who hosts their website or who their internet provider is.
Legal responsibility stays with the director
Here is something many nonprofit leaders do not realise: in the event of a serious IT incident (a data breach, archive loss, ransomware attack), it is the organisation’s director who carries legal responsibility. Not the volunteer, however competent they may be.
The volunteer has no contract, no professional liability insurance, no guarantee. If their error or absence causes harm, the organisation and its registered representative bear the consequences.
Availability is a practical problem
IT does not wait. A failure on a Friday evening, an urgent security patch, a data restoration after a human error. All of these need an immediate response. A volunteer has a life, other commitments, and holidays. Goodwill does not solve that.
The complexity of systems has also grown. Managing access rights, keeping security current, monitoring backups, and meeting data protection obligations requires a range of skills that one person rarely covers completely.
Moving to a more reliable model
Outsourcing IT does not mean cutting out volunteers who want to be involved. An internal point of contact for small everyday needs remains useful. The choice between hiring an IT manager or outsourcing is worth weighing up properly. What changes is that security, continuity, and accountability rest on a professional arrangement: a contract, documented systems, and a team that responds when it matters.
To find out more about what a tailored IT arrangement can offer your organisation, visit /en/nonprofits/.
