Many donors now use online portals for applications, reports, amendments and payments. If access depends on one employee’s personal email or password, the organization can lose control when that person leaves or is unavailable. Portal access should be managed as an organizational asset.
Use organizational email addresses where possible
Register important donor accounts with controlled organizational addresses rather than personal email accounts. If the portal requires an individual user, make sure the organization can recover the account and understands who is registered.
Keep an access register
Record the portal name, donor, URL, account owner, recovery email, role, last review date and whether multi-factor authentication is enabled. Do not store passwords in an unsecured spreadsheet; use an approved password-management method.
Limit permissions
Not every user needs administrator access. Assign the minimum role needed for drafting, finance review, submission or account management. This reduces the risk of accidental changes and helps preserve accountability.
Plan for staff exits
Portal access should be included in the staff handover checklist. Remove former employees, change recovery details and confirm that at least one current authorized user can access the account before the exit is complete.
See grant handover checklist for a broader transition process.
Keep submission evidence
Download or capture confirmation receipts, submitted forms and final attachments where the portal allows it. Do not assume the donor portal will preserve every file indefinitely or make earlier versions easy to retrieve.
Review access periodically
At least periodically, confirm that listed users are still employed, recovery methods still work and unnecessary permissions have been removed. Review access before major deadlines so password problems do not emerge on submission day.
Practical access checklist
- Portal owner identified.
- Organizational recovery route configured.
- Multi-factor authentication enabled where available.
- Roles limited appropriately.
- Submission confirmations archived.
- Staff-exit process includes access removal.
- Access tested before deadlines.
What to do next
Use the Application Timeline Builder to include portal registration and access checks in your grant submission plan.
For funding opportunities and practical grant guidance, subscribe to Africads Grant News.
Use a password manager for shared continuity
Where donor portals require credentials that must be shared by authorized staff, use an organizational password manager rather than email or spreadsheets. This creates better access control and makes it easier to remove former staff without changing unrelated systems.
Test account recovery before it is urgent
Confirm that recovery emails, phone numbers and multi-factor devices still belong to current authorized staff. A portal account that works today can still become inaccessible if the only recovery method belongs to a former employee.
Track portal-specific deadlines and quirks
Some portals require registration days before submission, impose file-size limits or close automatically at a specific time zone. Keep these operational details with the account record so new staff do not have to rediscover them during a deadline.
Keep portal ownership with the organization
Even when a portal names one employee as the account holder, document the organizational owner responsible for continuity. That role should know how to recover the account, update authorized users and retrieve prior submissions.
Before closeout, download final reports, approvals and payment confirmations where possible. A portal may later become inaccessible or archive older awards, so the organization should maintain its own authoritative grant record.
Include portal access in business-continuity planning. If the primary user is unavailable on a deadline day, another authorized person should be able to recover access, locate the final documents and complete submission without using the absent employee’s personal credentials.
For organizations managing many funders, review the access register before major reporting seasons so dormant or broken accounts are fixed before multiple deadlines overlap.
Frequently asked questions
What should a grant portal access process include?
Track the portal, account owner, backup user, permission level, recovery method, submission authority, and current status.
Should staff share one login?
Where possible, use named user accounts and role-based access rather than shared credentials. Shared access makes accountability and offboarding harder.
What happens when a staff member leaves?
Transfer ownership, remove access, update recovery contacts, and confirm that the organization still controls the account before the person’s departure is complete.
Who should have submission authority?
Only the roles authorized by the organization and donor should be able to make final submissions or accept award-related actions.
Why does backup access matter?
A single-person account can become a serious operational risk if that person is unavailable near a deadline or leaves the organization.
Conclusion
Grant portals are organizational assets, not personal accounts. Your NGO should keep ownership, permissions, recovery, and submission authority documented so access survives staff changes and deadline pressure.
Put this guide into practice
Free resource: The Hidden Formula Funders Love. Use this free guide to apply the article’s advice to your next funding decision or application.
Optional paid resource: Nonprofit Grant Proposal Templates. Proposal, concept note, budget, logframe, M&E and donor-document starting points. Review the product details and current price before purchasing.
