Delegate church admin by job, not by login. Give each volunteer access to the one thing they actually do, such as the prayer list, the usher rota or a department's budget draft, and nothing else. Put a second person on anything involving money, so the one who prepares it is never the one who approves it. The administrator's role should become reviewing and approving work, not doing all of it and holding every password.
The church and people below are a composite. The borrowed password is, unfortunately, very common.
The week Funmi was away
Funmi had run church admin at Bethel Community Church for six years. She knew where everything was because she had put it there. The member list, the giving records, the rota, the prayer requests, the hall bookings: all of it ran through her laptop and her login.
In June her father fell ill and she travelled for ten days at short notice. On the first Sunday, the ushers did not have the rota. The prayer team did not have the week's requests. The treasurer needed last month's giving figures for a meeting and could not get them.
So Funmi did what any helpful person would do. From a hospital corridor, she sent her password to the youth pastor so he could "sort out a few things".
He did sort them out. He also, with the best intentions, could now see every member's personal details, every pastoral note and every gift anyone in the church had ever given. When Funmi came home, she changed her password and felt uneasy for weeks, without being able to say exactly what had gone wrong.
What actually went wrong
Nothing malicious happened. The problem was structural. Bethel had one key that opened every door, and the only way to share any part of the work was to share the whole key.
That arrangement fails in three predictable ways:
- It cannot cope with absence. When the one person with access is ill, travelling or simply busy, the church stalls.
- It cannot share safely. Any help means handing over everything, including information the helper has no reason to see.
- It cannot tell you who did what. If two people use one login, every change looks like it came from the administrator.
Start with the church admin jobs, not the people
Before deciding who gets access to what, write down the jobs that need doing each week. For most churches the list looks something like this:
- Keeping the usher and welcome rotas.
- Reading and praying through prayer requests.
- Recording the offering after each service.
- Drafting a department's budget.
- Following up first-time visitors.
- Submitting a department's monthly report.
Each of those is a church admin job a trusted member can do. None of them requires access to the whole church's data.
Give each job the smallest access that does it
Match every job to exactly the access it needs, and no more. The prayer team needs the prayer requests, not giving records. The person who counts the offering needs to record a collection, not to read every member's personal history. A department head drafting a budget needs their own department, not everyone else's.
This is sometimes called least privilege, and it sounds bureaucratic until you notice what it buys you. When access is narrow, you can say yes to help far more easily, because saying yes no longer means exposing everything.
Money always needs two people
Anything involving money should need two different people: one to prepare and one to approve. The person who records a cash collection should not be the person who confirms it. The person who drafts a budget should not be the person who signs it off. Nobody should be able to approve their own payment request.
This is not about suspecting anyone. It protects the volunteers as much as the church. When a question is ever asked about a number, a treasurer who can show that every figure was checked by someone else is in a far better position than one who did everything alone with the best of intentions.
Keep a record of who did what
Once each person has their own access, every change can carry their name. That makes mistakes easy to fix, because you can see where they came from, and it ends the uneasy feeling Funmi had of not knowing what had been looked at.
Review access when people change roles
Church admin volunteers move on, step back or change ministries. Access that made sense last year can quietly outlive its reason. Two simple habits keep it tidy:
- Remove access on the day someone steps down from a role, as part of thanking them for it.
- Review the full list once a quarter. Ten minutes with the pastor, going down the names and asking "do they still do this?"
What Bethel looks like now
Funmi still leads church admin at Bethel, but she no longer holds every key. The ushers keep their own rota. Two members of the prayer team see the requests and nothing else. The offering is counted by one person and confirmed by another. Department heads draft their own budgets, and the treasurer approves them.
When she travelled again the following year, nothing stopped. Nobody needed her password, and she did not need to send it.
If your administrator is carrying all of this in spreadsheets, these are some of the signs a church has outgrown them.
Flock lets members hold specific jobs, such as the prayer team or counting the collection, without being given staff access, and its budgets and funds keep maker-checker controls so preparing and approving money are always two different people. Member jobs are available on every plan, including the free one, and some, such as drafting a department budget, come with paid plans. Details are on the pricing page, and starting is free.