Partner News: How volunteers increase your Association’s cybersecurity risks

Published on Tuesday, 6 May 2025

In Workplace laws, the responsibilities of an organisation to a volunteer are no different from their obligations to a paid employee. Yet, how do most Associations treat employees compared to a volunteer?

Employees versus Volunteers

Employees typically go through formal recruitment, onboarding, and training. They’re issued devices that are monitored, given role-based system access, and covered by policies like acceptable IT use. When they leave, their access is revoked and devices returned.

Volunteers, however, are often recruited informally and rarely go through structured onboarding. Many use personal devices and email accounts, where sensitive information like board papers, member lists, or applications may be stored or shared without protection.

Few volunteers receive any cybersecurity training, and those with system access may keep it long after they’ve stepped away. Without proper offboarding, former volunteers can retain access to systems for years, creating a persistent risk with no audit trail.

The result? Sensitive data ends up outside of secured systems, spread across personal inboxes and devices, with no way to track or delete it.

What can Associations do better?

To reduce this risk:

Formalise volunteer onboarding and offboarding
Limit system access to only what’s necessary
Provide basic cybersecurity awareness
Use organisation-controlled platforms for sensitive information

Final Thoughts

Volunteers are an important part of every Association, and yet they can also be your organisation’s greatest risks when it comes to cybersecurity.

If you treat them more like the way you treat paid employees, you’ll reduce this risk.

Tammy Ven Dange of Roundbox Consulting is a former Association President, charity CEO, Not for Profit Board Member and IT Executive. Today, she helps Associations with their strategic IT decisions, including reducing cybersecurity risks.