Documenting passwords?

Imagine having your public website and your membership portal go completely offline for a week.

An organization I know recently had that problem, and you can imagine … it was not fun.

The problem was, a couple of key staff members had left the organization.
And when something went wrong, the organization simply did not know how to access those accounts.

So, what to do?

First, here's what not to do:

Storing usernames and passwords in a spreadsheet or document is a Bad Idea™. (See here and here for organizations who've been burned this way.)

So: Do you want a properly secure and safely shared password vault that's easy to use for all your staff?

Unfortunately (says me) that’s not likely.
For most small nonprofit teams, it's either too expensive or too complicated.

Fortunately, it's probably not necessary.

For now, start by ensuring that your passwords are stored safely.

Insist that all staff use a proper password valut for all passwords. No spreadsheets or Word documents.

(If you’re unfamiiiar, take 2 minutes right now to try one; I like KeePassXC.)

Then we can talk about a simple way to safely document the information you’ll need
to recover account access in case of an emergency.

More on that tomorrow.

All the best,
A.

Easiest way to start documenting your systems

If the wrong person suddenly departs your organization,
your whole team could have a really hard time using the systems that person has left behind

… unless those systems get documented.

That could be a big job, but the good news is:
you don't have to do it all at once.

A Google Doc can be your starting point.

And it's a very easy starting point.

You just open up a new document and use outline formatting.

Right away, you have sections
and structure
and even a table of contents.

Share it with your team.
Let them edit it alongside you if you like,
or just give them read-only access.

Then, take a few minutes now and then to add the information that matters:

• Vendor names and contact information.

• Which third party provider takes care of what services.

• Structures and naming conventions for organizing your CRM data.

• Anything that's hard to explain in a sentence, or impossible to explain if you or one of your team members becomes unavailable.

Now there's a big caveat here: this is not for account usernames and passwords. Ever.

But for everything else, this simple document can be your very easy starting point.

You can always formalize it more later, if you like.

But you can only do that if you've actually started somewhere.

Try starting with a humble Google doc.

Within a few weeks or months, you'll have a resource that could really save your bacon.

I bet you could start it today.

All the best,
A.

“What should we document?”

When I advise organizations to start keeping their own internal documentation, one of the first questions is:

“What should we be documenting?”

Well, it doesn't have to be "everything."

But it probably should -- eventually -- cover:

• Frequently asked and re-asked questions about how to get something done within your system.
  Every organization has unique workflows.
  Unless you want your staff doing it differently every time, it's worth documenting.

• Definitions and policies you can't easily rattle off without a second thought.
  What's a "returning member"?
  What's the difference between those 12 separate permisson levels you've collected over the years?
  What to do if you find a security vulnerability?

• Contact info and account credentials for outside services and vendors.
  Who to call when your live sure goes down?
  How to log in to GoDaddy or Domain.com to manage your 33 custom domain names?

Those things start to matter when somebody's out sick,
or the goose poop really hits the fan,
or someone departs the organization unexpectedly.

But here’s the thing:

You don't have to document it all at once.

You'll be updating it over time anyway.

But to start, you do need a place to document it.

That's the thing to decide first.
More on that decision tomorrow.

All the best,
A.

Hot dog = sandwich?

At age 16, my daughter could argue about anything.

Her favorite starter was:
"Okay, is a hot dog a sandwich?"

I mean …

Everybody knows what a hot dog is.
But what counts as a sandwich?

If you can't define them both, then you can't agree on an answer.

• We know what a member is. But what's a "returning member"?

• We know what a donor is. But what's a "major donor"?

• We know what a contact is, but what's an "engaged contact"?

If you can define the terms, then you can say if someone is or isn’t.

But if not ...

You may just feel like you're arguing with a 16 year old.

All the best,
A.

Another security release for CiviCRM

In a fairly unusual move, CiviCRM has released its second security update (versions 6.16.5, 6.17.1, and 6.10.10 ESR) in two days.

A core team member explains:

This is quite unusual; but tldr -- it's very similar to another highly critical advisory from earlier today. So if we didn't fix it quickly, the odds are that someone else would recognize it soon.

If you were really on the ball and upgraded yesterday afternoon (versions 6.16.4, 6.17.0, and 6.10.9 ESR), you’ll want to upgrade again for this one. I’m re-doing some upgrades myself today.

Why this is a good thing:

First, let’s acknowledge that two security updates in two days is inconvenient. Nobody likes inconvenience.

But it’s also great to know that the CiviCRM security team is catching these things and pushing out the fixes.

Security and convenience will always be trade-offs.
In this case, I recommend trading in favor of security.

Any questions about this, pelase let me hear from you!

All the best,
Allen

A better mousetrap

Duplicate records are like household pests:

If you find one, there are probably many more you haven't seen. Yet.

The problem is: finding and removing them is usually hard.

Try this in CiviCRM:

Install the Duplicate Monitor extension.
Then, add its "Dedupe Monitor Alert" dashlet to your CiviCRM Home dashboard.

While you're not even looking, this extension will use your existing duplicate-matching rules to quietly scan your entire database for duplicates, and alert you of any it finds, through that dashlet.

You can also configure it further, but don't worry about that right now.

Just install it and let it work.

That alone will be a big step forward in clearing out those pests.

All the best,
A.

Cleanup by deletion

Should you delete old CRM contacs?

If your CRM has been around for a while, you might have considered it.

Lots of folks have strong opinions:

• “Deleting is permanent, and you may be losing something valuable. Never delete!”

• “Maintaining data you don't need is costly and wasteful. Delete them!”

If you already have strong feelings about it, congratulations.
You know what to do.

For the rest of us, there are considerations:

• Does your CRM have tiered pricing based on total number of contacts?
  That's a financial expense, with no easy workaround.

• Are you constantly struggling to eliminate truly inactive contacts from your workflows?
  That's a mental expense, but there are ways around it.

• Is a contact you haven't heard from in 20 years worth keeping? 10 years? 2 years?
  The cut-off is usually not obvious.

So:

If you must keep your total contact count below X thousand,
you may need to delete some.

If you're confident that contact records with no activity in the last X years
can't possibly contain useful information,
you could delete some.

But for other cases,
it's probably worth putting some thought into classifying them
into one or more levels of activity/inactivity.

If you can do that,
most CRMs offer tools to help you mark them as such (CiviCRM does).

Once you work that out,
you can get the inactive ones out of the way without having to agonize over deleting them.

All the best,
A.

Cleaning data is a continuous effort

Keeping your data tidy and useful is an ongoing effort -- just like with any other collection.

For example:

My wife does a lot of costuming work at our local community theater.

For decades they had a large costume warehouse space.
With patience and experience, you could find almost anything you wanted there.

But it was a mess.

Volunteers came and went.
Nobody really kept it organized.

A couple of years ago they converted that space for another purpose,
threw out more than half of the costume pieces,
and moved the remainder into a new,
shiny,
smaller
costume closet.

The result was something that could be much easier to manage.

It's definitely easier to find things now.

But there's no guarantee.
A few more seasons will tell the tale.

Whether it remains neat and tidy,
or becomes another mess
-- albeit a smaller one --
depends entirely upon how they manage it.

Somebody needs to be in charge of ensuring:
things get put away properly,
new items get filed correctly,
damaged pieces get repaired or removed,
and resources aren't wasted acquiring duplicate pieces.

It's an ongoing effort.

Because systems don't organize themselves.

Sounds familiar?

Yep.

It's a lot like your CRM. :-)

All the best,
A.

Security update, next Wednesday: CiviCRM

Be advised, CiviCRM has announced a security update to be released next Wednesday night, August 5:

There will be a small but critical security update for CiviCRM on Wednesday, August 5 (US/Pacific Time). Updates will be provided for the following releases:

• CiviCRM v6.17 (August release; for the release-candidate, see https://download.civicrm.org/latest/)

• CiviCRM v6.16 (July release; future ESR; for current download, see https://civicrm.org/download)

• CiviCRM v6.10 (January release; current ESR; see https://civicrm.org/esr)

We expect the release to become available near the end of the day (TZ conversions).

Be ready:

Operational Assurance subscribers (and others who already have an arrangement with me for updates) can rest easy — this update will be applied to your site.

If that’s not you, I encourage you to be ready for this update.

All the best,
Allen

“Inactive” contacts?

Here's one way you can begin sorting out your messy CRM data.

Tag your inactive contacts, and start using that distinction frequently.

Some CRM systems try to make this easier by letting you silo inactive contacts.
In others, you just create a tag called "Inactive", and use that in groups, searches, etc.

But the hard part here is not using the software.

The hard part is actually defining what we mean by "inactive contact."

In other words:
When a human staff member examines any given contact record,
how can they decide if it's inactive?

Is it based on event attendance? Event registration?
Last contribution date? Any activity at all?
How long ago? Is the time window the same for all types of activity, or for all donation amounts?

Before you can start marking folks inactive, you have to define those parameters.

It can be hard.

But it can be done.

And more importantly, it can be worth it,
especially if you're already noticing the mental burden (and other costs)
of having inactive contacts scattered amongst your working data.

You could probably take half an hour this week to think it through,
examine some contacts,
and write down a good definition of an inactive contact.

Once you have that,
you (or your staff) can start marking them,
and then start treating them accordingly.

It just takes that first step to get started.

All the best,
A.

Messy data? There’s hope yet.

Is your CRM starting to feel like somebody else's junk drawer?

Can't distinguish which members are most engaged,
on the verge of dropping out,
or completely dormant?
Spending far too long trying to identify the donors
who would just need a nudge to increase their annual gift?

Don't throw up your hands just yet.

You can fix this, even with your limited resources.

The "secret" to clean and reliable CRM data is probably a little too obvious. You "just" need to:

• Approach your data with a systems mindset. Don't allow anyone to treat it like a drunk drawer. Ever.

• Design an organizational system for tagging, grouping, and reporting that supports your strategy for outreach, member engagement, and donor management.

• Ensure that any staff who can edit data actually understand your system and their place in it, that they have a common vision for that strategy and how your CRM data will support it. They're not just creating records, they're building a library of useful information.

• Make a regular practice of finding and merging duplicate contacts and improving your own organizational system.

Of course the problem is: Who the heck has time for all that?

So here's the trick:

First, admit that you have limited time, staff, and budget.
They will never be enough to implement the "perfect" system.

But don't stop there.

Notice that you do have some time, staff, and budget.
You can use those to tackle some of the biggest challenges with your messy data.

Could you give this 1 hour of your time each day?
What about 1 hour per week?

If you can do that, there's hope.

So:

Look through that "secrets" list again.

Which one can you spend just 1 hour on, this week?

All the best,
A.

Should your members log in?

Letting your members log in to your CRM has a lot of upside.

• Consitutents can do a lot without your help:
  Update their own data.
  See their giving history and membership status.
  Catch up on pending payments (membership dues, pay-later event fees, etc.)

• Duplicate creation goes way down.
  They’re logged in, so the CRM knows who they are.

• You can control access to members-only features and other substantial membership benefits.

But it's not all hearts and rainbows.

• Some people just won't want to log in.

• Some people will contact you repeatedly for help with their password.

• Members-only features take careful planning to get right, and careful maintenance to keep right.

I've got clients in both camps:

• Some are getting huge value by keeping their members informed, engaged, and empowered.

• Some are just not willing to open what could be a can of worms for their limited staff.

There's one way to find out if it might be right for you:

1. Articulate exactly why you'd want it.
   How would it benefit your mission?

2. Articulate exactly why your members would want it.
   What would they get out of it that would be worth keeping track of yet another password?

3. Create a small online limited-time offering that you think your members would value.

   A handbook,
   a report,
   a simple directory,
   a printable "super supporter" membership card,
   a desktop wallpaper,
   early access to an upcoming event,
   almost anything that’s cute or fun or useful.

4. Limit that offering to logged-in members only, and run a test for 2 weeks.
   If you get traction, it's a sign that this is the kind of thing your members appreciate. Make plans for more engagement.
   If you hate the experience, or your members just don't care, you've learned something important and haven't lost months of effort.

It's another way to make small bets that could produce big wins.

All the best,
A.

Security updates

Is your system running with the latest security updates?

If you're on WordPress, you should check on that now.

WordPress released a security fix last week that has been causing lots of trouble.

Compromised sites.
New admin users created.
Sites defaced or quietly misused.

If you're on another CMS, it's still worth checking on.

Security updates are not something you want to sleep through.

All the best,

A.

P.S. If you're on Joinery's Operational Assurance plan, you're already covered. If not, check with your tech team to be sure you have a good plan in place.

Thin

The peach tress in my backyard are done producing for the year.
Results are mixed.

For one of them -- but not the other three -- I took the time early in the season to thin the fruit.

Thinning always feels wrong.
I'm literally plucking dozens of tiny peaches and throwing them into the compost.

Part of me always imagines each of them large and sweet and juicy.
Culling them seems a shame.
Maybe I should let them all grow.

But now I wish I'd thinned all four trees.

Because where I thinned, I got fat juicy peaches.
And where I didn't, I just got a bunch of hard tiny fruit.

Sometimes getting the best results means deliberately giving up on perfectly good possibilities
so the ones you keep have room to flourish.

All the best,
A.

The question is worth more than the answer

Ever try to learn a new language?
Or swing dancing?
Or to play an instrument?
Or any system that requires more than a handful of facts to operate?

Could you do it just by quizzing an expert?

Or would you need to spend time trying, rethinking your approach, observing the results, and repeating that hundreds of times?

Of course for that kind of learning, just "asking questions" and "gettting answers" isn't enough.

You have to let your mind spend time in the problem.

Form your own theories about how the whole thing works.

Test those theories; see if they match the real world; and adjust them until they do.

Repeat that process, and you'll get deep learning that goes beyond memorized facts.

Skip it, and you just get whatever it is that comes with quick answers.

All the best,
A.

The message that sticks

Every communication you send contains both an explicit message and an implicit one.

Whether you're training a staff member, reporting to your board, or appealing to your donors.

The explicit message is usually something like:

• Here's our standard procedure.

• Here's a summary of our status, strengths, and weaknesses.

• Here's how your donation helps.

But along with that comes an implict message.

How you handle questions and surprises.
Your reaction to push-back and challenges.
Your choice of analogies, incentives, and priorities.
Your underlying emotional state.

What can be surprising is this:

Long after the explicit message is forgotten, the implicit message sticks -- and pretty deeply, too.

Of course, if you're not careful, you can send a lot of implicit signals that contradict the good things you’re trying to say.

But if you're paying attention, you can communicate a lot of good things implicitly:

• I'm hopeful, and with good reason.

• I care about your interests.

• I think you're valuable, capable, and good.

• I actually believe the things that I’m saying.

Do that often enough, and you'll be building the culture you want to see.

Because culture isn't built only by what you say.

It's built by what people learn while you're saying it.

All the best,

A.

“Chasing the system”

When something unexpected happens in your CRM system, you have two choices.

You can chase the system.
Or, you can try to understand it.

"Chasing the system" is my term for hacking away at things just enough to make them look good.

A report seems wrong?
Change the data until the report looks right.

Someone didn't receive a mailing?
Add them to a different group.

Staff member gets an error?
Give them another permission.

Sometimes it even makes the symptoms go away.

But your understanding doesn't improve.

Do that often enough, and you end up with a system full of mysterious fixes that nobody understands and everybody is afraid to touch.

The alternative feels slower.

Instead of asking, "What should I change?"
Ask, "Why did this happen?"

That one question changes everything.

Every answer makes your mental model a little more accurate.

And over time, that's what makes you effective.

The point isn’t to memorize every setting in the system.

It’s to understand the system well enough that you can predict what it will do before you change it.

All the best,
A.

Delegating or babysitting?

One of the biggest jobs of a manager is delegation.

Because if every decision has to come back to you,
your organization can't really grow.

Of course, effective delegation doesn't begin with delegation.

It begins with onboarding:

• Helping someone understand how you do things.

• Giving them context.

• Teaching them what "good" looks like.

• Answering questions while the stakes are still low.

But it doesn't end there.

It continues through ongoing investment:

• Regular conversations.

• Feedback.

• Encouragement.

• More context as their responsibilities grow.

Skip those investments, and something weird happens.

You still think you're delegating.
But you're probably babysitting.

Every decision comes back to you.
Every task needs reassurance.
Every mistake becomes evidence that "I guess I just have to do it myself."

The funny thing is...

Babysitting often feels cheaper than good onboarding …

Right up until you realize you've been answering the same questions over and over for the past six months.

All the best,
A.

“Explain like I’m 5”

Every organization has things it needs to explain.

To staff.
To volunteers.
To donors.
To the people it serves.

And surprisingly often, one page is enough.

Now and then, a client will ask me to help them work up some "one-pagers" for their staff.

I almost always say yes.

Here's one I made recently for client staff who are testing a new login feature:

Sure, a one-pager isn't as flashy as a 30-minute training video.
It's not as detailed as a 20-page annual report.

But people read it.
If it's well done, they remember it.
And when they need it again, the info is right there.

Here's what I've learned:

It's tempting to try and explain everything.
But people don't usually need a comprehensive explanation.

They just need enough
to understand the idea today
and a quick way
to refresh their memory tomorrow.

Whether you're training staff,
or encouraging donors,
or helping someone reset their passord...

The one question worth asking is not,
"Am I covering all the bases?"
but,
"What do they really need to know?"

Because the goal of communication isn't completeness.

It's understanding.

All the best,
A.

Someone to show up for

We usually think coaching gets us "access to expertise." But it also gets us someting even more important: someone to show up for.

---

Big improvements usually come from consistent effort over time.

The hard part isn't knowing what to do.
It's doing it again next week.
And the week after that.

Something I've noticed in my own life:

The things I do with other people tend to stick.
The things I can do "whenever" are much easier to postpone.

My Brazilian Jiu Jitsu classes happen at scheduled times, with people who expect me to be there.
My strength training plan is completely flexible. If I skip in the morning, I can pick it up in the evening. Maybe.

Guess which one I've been more consistent with,
and made the biggest improvements in.

It's made me think differently about coaching:

Sure, you're getting access to expertise.
But you're also getting accountability.

Because "see you next Tuesday at 3:00" isn't an abstract promise to our future selves.
It's an appointment with another human being.

It doesn't just improve the quality of your effort.
It improves the consistency of your effort.
And that's what matters over time.

Because the opposite of accountability isn't laziness.
It's optionality.

Your gym is always open.
Your great American novel is always waiting.
That side project can always start tomorrow.

A coach changes that.
They convert "I should work on this sometime" into "I'll see you Thursday."

That's a much more profound shift than simply receiving advice.

If you're struggling to make progress on something important,
don't just ask whether you have enough information.
Ask whether you have enough accountability.

Sometimes the missing ingredient isn't a better plan.
It's another person expecting you to show up.

All the best,
A.