The board handoff, records, and account security workbook

1. Transfer the institution, not just a box of files

Prepare an index of governing documents, financial records, tax filings, insurance, contracts, reserve information, maintenance history, meeting records, and active requests. Note the authoritative version and where it is stored. A folder full of unnamed scans is less useful than a smaller, well-indexed set with clear gaps.

Add a decision and commitment register. What did the board approve? Which contracts renew? Which owner issues remain unresolved? Separate a future proposal from an authorized commitment. Record the person responsible and the next review date so the incoming board does not have to reconstruct the association’s obligations from memory.

2. Keep retention and disclosure separate

A record may need to be retained without being available to every resident or volunteer. Identify the appropriate access level for financial, owner, personnel, legal, and security information. Have the association’s adviser confirm retention schedules, access rights, redactions, and any legal hold. Do not delete material merely because a routine retention period appears to have ended.

Massachusetts condominium law and Washington’s common-interest records provisions illustrate how jurisdiction-specific rules can address manager handoff and protected information. They are examples, not national deadlines. Preserve the documents needed to explain both a decision and the association’s authority to make it.

3. Use an account handoff instead of a password handoff

List each service, its association owner, named administrators, recovery method, billing contact, and renewal date. Keep secret recovery information in a secure password-management process, not public minutes or an ordinary spreadsheet. Where a service supports named users, transfer roles rather than sharing one person’s login.

The FTC recommends account protection, multifactor authentication, backups, and planning for incidents. Apply those ideas to board email, banking, document storage, domain administration, and software. Coordinate revoking outgoing access after the authorized transfer and verification, so the association does not either lose access or leave unnecessary privileges in place.

4. Prove that the successor can operate

Have the incoming authorized person find a governing document, retrieve a financial report, identify an open task, and recover an account using the approved process. Verify access without exposing secrets in the signoff record. A successful test is stronger evidence than a checkbox marked “password sent.”

Keep a handoff exception list with missing records, unresolved balances, disputed responsibilities, and inaccessible services. Assign an owner and a follow-up for each. Preserve the signoff and schedule a short review after the first month, when practical use often reveals gaps that the initial inventory missed.

The working process

1. Index the authoritative records and identify missing versions or legal holds.
2. List decisions, recurring obligations, contracts, and unfinished work.
3. Map accounts, named administrators, secure recovery, and authorized successors.
4. Transfer access through each provider’s approved process and test critical tasks.
5. Record exceptions, remove unnecessary access appropriately, and review after the first month.

A worksheet to use with your board

Copy these prompts into your working plan, or use the writing space in the PDF. Keep private owner information and account secrets out of a broadly shared worksheet.

• Record category / authoritative location / missing item
• Decision or obligation / evidence / next date
• Service / association administrator / secure recovery location
• Successor task / tested by / result
• Exception / responsible person / resolution date

Before you call it complete

• Authoritative records indexed
• Retention and legal holds reviewed
• Private material has restricted access
• Commitments and renewals documented
• Named access used where available
• MFA and recovery reviewed
• Successor tasks tested
• Exceptions have an owner and date