From 7b4339823bd98e9bee2e7a18c04bdd787bc6d11c Mon Sep 17 00:00:00 2001 From: shedquartersbot Date: Sat, 15 Aug 2026 10:56:53 -0400 Subject: [PATCH 1/3] docs(board): add director onboarding checklist --- .../director-onboarding-checklist.md | 160 ++++++++++++++++++ 1 file changed, 160 insertions(+) create mode 100644 board/processes/director-onboarding-checklist.md diff --git a/board/processes/director-onboarding-checklist.md b/board/processes/director-onboarding-checklist.md new file mode 100644 index 0000000..0213dc7 --- /dev/null +++ b/board/processes/director-onboarding-checklist.md @@ -0,0 +1,160 @@ +# RevolutionVA Director Onboarding Checklist + +Use this checklist for each new RevolutionVA director. Store the completed internal checklist and signed records in the restricted directors folder in Google Drive. Publish only appropriate public records in the `RevolutionVA/Organization` repository. + +## 1. Candidate preparation + +- [ ] Confirm the candidate has a meaningful connection to the 757 through residence, employment, community service, or sustained involvement. +- [ ] Discuss the expected time commitment and the requirement to attend at least 75% of board meetings annually, allowing reasonable excused absences. +- [ ] Discuss the expectation to actively support at least one RevolutionVA program, event, or board committee each year. +- [ ] Discuss the expectation to support fundraising and sponsor relationships; clarify that there is no required personal donation or fixed fundraising quota. +- [ ] Explain that board service is entirely volunteer and unpaid, with reimbursement available only for reasonable, documented, pre-approved expenses. +- [ ] Confirm that the candidate can uphold RevolutionVA's mission, fiduciary duties, confidentiality requirements, nondiscrimination commitment, and Code of Conduct. +- [ ] Identify potential conflicts involving employers, businesses, family relationships, vendors, sponsors, or other organizations. + +## 2. Pre-invitation materials + +Provide the candidate with current or proposed copies of: + +- [ ] RevolutionVA mission, history, and program overview. +- [ ] Articles of Incorporation. +- [ ] Bylaws. +- [ ] Written board-member expectations. +- [ ] Conflict of Interest Policy. +- [ ] Whistleblower Policy. +- [ ] Document Retention and Destruction Policy. +- [ ] Organization-wide Code of Conduct and nondiscrimination commitment. +- [ ] Most recent approved board minutes available for candidate review. +- [ ] Current board roster and officer roles. +- [ ] Current financial overview and explanation of the annual and event-budget process. +- [ ] D&O insurance summary when coverage is obtained. + +## 3. Formal invitation and acceptance + +- [ ] Send a written invitation describing the proposed role, transition period, formal term dates, and expectations. +- [ ] Receive the candidate's written acceptance. +- [ ] Confirm the candidate has had an opportunity to ask questions before appointment. +- [ ] Confirm the candidate still wishes to serve after reviewing all governance materials. + +## 4. Board appointment action + +- [ ] Place the appointment on a properly noticed board-meeting agenda or written-consent action. +- [ ] Confirm that appointing the director receives a two-thirds vote of directors currently serving. +- [ ] Record each director's vote in the minutes or written consent; director appointments are not anonymous officer elections. +- [ ] Record the appointment's immediate effective date. +- [ ] Record the applicable formal term anchor: January 1 or July 1. +- [ ] Record the formal three-year term's start and end dates. +- [ ] Mark any period before the term anchor as a transition period that does not count toward the two-consecutive-term limit. + +## 5. Required DocuSign package + +Before the appointment becomes effective, obtain: + +- [ ] Written consent to serve as a RevolutionVA director. +- [ ] Board expectations acknowledgment. +- [ ] Confidentiality acknowledgment. +- [ ] Conflict-of-interest disclosure. +- [ ] Conflict of Interest Policy acknowledgment. +- [ ] Code of Conduct acknowledgment. +- [ ] Fiduciary-duties acknowledgment. +- [ ] Any media, data-access, or other role-specific agreements that are genuinely necessary. + +For every completed DocuSign envelope: + +- [ ] Save the completed signed document in Google Drive. +- [ ] Save the DocuSign completion certificate alongside it. +- [ ] Confirm access is limited appropriately for confidential records. + +## 6. Access and records + +- [ ] Add the director to the internal board contact list. +- [ ] Give the director read access to governance records in Google Drive. +- [ ] Give the director read access to board financial reports and approved budgets. +- [ ] Give access to the public `RevolutionVA/Organization` repository as appropriate. +- [ ] Add the director to board calendar invitations and board communications. +- [ ] Explain that legal, personnel, donor-private, whistleblower, and executive-session records are restricted to people with a legitimate need for access. +- [ ] Do not grant bank, QuickBooks, DocuSign administration, repository write, or other privileged access unless the director's assigned responsibilities require it. +- [ ] Update the internal director roster, including contact information, appointment date, term anchor, formal term dates, and officer or committee assignments. +- [ ] Update the public board roster after the appointment is effective. + +## 7. Formal orientation + +Complete before the director's first voting meeting when practical and no later than 30 days after appointment. + +### Organization + +- [ ] RevolutionVA's history, founders, 501(c)(3) status, mission, and long-term vision. +- [ ] The 757 geographic focus. +- [ ] Current and planned programs, including 757tech, the Hampton Roads Community Board Map, DevFest, the planned RevolutionConf return, and the planned job fair. +- [ ] Relationships that require careful distinction, including the independently managed 757 Developers Meetup and event-specific sponsorship of BSides Hampton Roads. + +### Governance + +- [ ] Board composition, founding seats, rotating terms, term limits, and future expansion rules. +- [ ] Quarterly meeting requirement, annual January organizational meeting, notice rules, agendas, minutes, quorum, and voting. +- [ ] Anonymous voting applies only to officer elections. +- [ ] Written-consent procedure for unanimous action between meetings. +- [ ] Executive-session rules and public-minutes practice. +- [ ] Committee authority and limits. +- [ ] Removal, resignation, vacancy, holdover, and reappointment rules. + +### Duties and conduct + +- [ ] Duty of care. +- [ ] Duty of loyalty. +- [ ] Duty of obedience to the mission and governing documents. +- [ ] Conflict disclosure, recusal, and related-party transaction procedures. +- [ ] Confidentiality and appropriate handling of restricted records. +- [ ] Whistleblower reporting and anti-retaliation protections. +- [ ] Code of Conduct reporting, response, escalation, enforcement, and appeal procedures. + +### Financial oversight + +- [ ] Cash-basis accounting and calendar fiscal year. +- [ ] TowneBank and QuickBooks Online workflows. +- [ ] Monthly bank-reconciliation requirement. +- [ ] Board financial reports: balance sheet, profit-and-loss statement, and budget-versus-actual report. +- [ ] Board-approved annual and event budgets. +- [ ] Second-director pre-approval for unbudgeted transactions of $500 or more. +- [ ] Budgeted-expense exception for approved annual and event budgets. +- [ ] Form 990 preparation and board-review process. + +### Records and risk + +- [ ] Public records in the Organization repository; signed and confidential records in Google Drive. +- [ ] Permanent and seven-year retention categories. +- [ ] Legal-hold requirements. +- [ ] General liability, event insurance, and D&O coverage when obtained. +- [ ] Indemnification and its exclusions. + +## 8. First board meeting + +- [ ] Introduce and formally welcome the new director. +- [ ] Confirm completion of all required signatures and orientation items. +- [ ] Record any initial conflict disclosures. +- [ ] Assign at least one program, event, or committee responsibility. +- [ ] Review upcoming board and event dates. +- [ ] Confirm how to request agenda items and call attention to urgent concerns. +- [ ] Record any officer or committee appointment separately from the director appointment. + +## 9. Thirty-day verification + +- [ ] Confirm orientation was completed within 30 days. +- [ ] Confirm the director can access required governance and financial records. +- [ ] Confirm no unnecessary privileged access was granted. +- [ ] Confirm all signed records and DocuSign certificates are stored correctly. +- [ ] Confirm the internal and public rosters show accurate term information. +- [ ] Ask whether the director has unresolved questions, missing context, or barriers to participation. +- [ ] Mark onboarding complete and record the completion date. + +## 10. Annual renewal + +At the January organizational meeting each year: + +- [ ] Renew the board-expectations acknowledgment. +- [ ] Renew the confidentiality and fiduciary-duty acknowledgment. +- [ ] Complete a new conflict-of-interest disclosure. +- [ ] Confirm contact information and organizational affiliations. +- [ ] Review attendance and active-participation expectations. +- [ ] Confirm program, event, or committee involvement for the year. +- [ ] Review policy or bylaw changes adopted since the prior acknowledgment. From a0b7f0ff97cab8633d07a5a5a281925ef56c8b11 Mon Sep 17 00:00:00 2001 From: shedquartersbot Date: Sat, 15 Aug 2026 10:57:04 -0400 Subject: [PATCH 2/3] docs(board): add offboarding checklist --- board/processes/offboarding-checklist.md | 183 +++++++++++++++++++++++ 1 file changed, 183 insertions(+) create mode 100644 board/processes/offboarding-checklist.md diff --git a/board/processes/offboarding-checklist.md b/board/processes/offboarding-checklist.md new file mode 100644 index 0000000..747c660 --- /dev/null +++ b/board/processes/offboarding-checklist.md @@ -0,0 +1,183 @@ +# RevolutionVA Director, Officer, and Volunteer Offboarding Checklist + +Use this checklist whenever a director, officer, committee member, volunteer, contractor, or account administrator leaves RevolutionVA or changes responsibilities. Adjust the scope to the person's actual access and role. + +Store the completed internal checklist in RevolutionVA's restricted Google Drive records. Do not publish credentials, security details, private contact information, conflict reports, or sensitive departure information. + +## 1. Identify the offboarding event + +- [ ] Record the person's name and current roles. +- [ ] Record whether this is a resignation, term expiration, removal, completed assignment, contractor separation, or role change. +- [ ] Record the effective date and time. +- [ ] Identify whether access must end immediately or can be transitioned on an agreed schedule. +- [ ] For a planned director resignation, confirm whether 30 days' written notice was provided when practical. +- [ ] Preserve the written resignation, board action, term record, or other documentation establishing the change. +- [ ] Determine whether legal counsel, the insurer, accountant, bank, registered agent, or another adviser must be notified. + +## 2. Immediate safety, legal, and records review + +- [ ] Determine whether litigation, an audit, an investigation, a whistleblower matter, a Code of Conduct matter, or a credible legal claim is pending or reasonably anticipated. +- [ ] If so, place relevant records under legal hold before changing or deleting anything. +- [ ] Preserve relevant email, chat, documents, logs, financial records, and account history. +- [ ] Do not delete or alter records merely because the person is departing. +- [ ] Restrict sensitive departure records to people with a legitimate need for access. +- [ ] Coordinate with Pierce Legal or another qualified adviser when the departure is disputed, disciplinary, or legally sensitive. + +## 3. Approvals and governance record + +For directors and officers: + +- [ ] Document the resignation, removal, term expiration, or role change in approved minutes or unanimous written consent. +- [ ] If an officer role is vacant, schedule the board election of a replacement for the remainder of the one-year officer term. +- [ ] If an ordinary rotating director seat becomes vacant, begin the two-thirds appointment process for a replacement. +- [ ] Record the replacement's immediate appointment date and next January 1 or July 1 formal term anchor when selected. +- [ ] If a founding seat becomes vacant, document its conversion to an ordinary rotating seat. +- [ ] Update quorum calculations and the list of directors currently in office. +- [ ] Update committee assignments and identify any committee leadership vacancy. +- [ ] Confirm whether signing authority, delegated authority, or contract authority ended with the role. + +## 4. Same-day access review + +Review every category even if the expected answer is "no access." + +### Identity, email, and communications + +- [ ] Remove or modify access to shared RevolutionVA email accounts. +- [ ] Remove forwarding rules, delegates, recovery addresses, application passwords, and active sessions that are no longer authorized. +- [ ] Preserve and transfer organization-related messages and files subject to retention requirements. +- [ ] Remove the person from internal board or team mailing lists. +- [ ] Remove the person from private board chats, workspaces, and communication channels. +- [ ] Update emergency and official-communications contact lists. + +### Google Drive, calendar, and DocuSign + +- [ ] Remove or modify Google Drive access according to the person's new role. +- [ ] Transfer ownership or stewardship of organization documents before account access ends. +- [ ] Remove the person from restricted directors, finance, legal, personnel, donor-private, whistleblower, and executive-session folders as applicable. +- [ ] Remove or modify board and event calendar access. +- [ ] Cancel or transfer future calendar meetings owned by the departing person. +- [ ] Remove or modify DocuSign permissions. +- [ ] Preserve completed signed documents and their DocuSign completion certificates. + +### 1Password and credentials + +- [ ] Remove the person from RevolutionVA 1Password vaults that are no longer required. +- [ ] Review the vault activity and item-access history when available and appropriate. +- [ ] Rotate credentials the person knew, copied, exported, or could access when the risk warrants rotation. +- [ ] Replace recovery codes, backup codes, API keys, application tokens, and shared secrets when necessary. +- [ ] Confirm that critical credentials remain accessible to at least two authorized administrators. +- [ ] Confirm that recovery information is organization-controlled rather than tied solely to a departing person's personal account or phone. + +### Website, domain, GitHub, and technical systems + +- [ ] Remove or modify access to domain registrars, DNS, hosting, content-management systems, analytics, forms, newsletters, and other web services. +- [ ] Remove or modify GitHub organization, team, repository, bot, deploy-key, personal-access-token, and CI/CD access. +- [ ] Transfer ownership of repositories, integrations, automation, documentation, and deployment processes. +- [ ] Revoke active sessions and rotate privileged tokens when appropriate. +- [ ] Confirm that website and domain administration still has at least two authorized administrators. + +### Social and community accounts + +- [ ] Remove or modify access to RevolutionVA, 757tech, DevFest, RevolutionConf, and other controlled social accounts. +- [ ] Remove access to social scheduling, link-management, community-management, and analytics tools. +- [ ] Remove or modify administrative access to online community spaces. +- [ ] Revoke sessions and rotate shared credentials when appropriate. +- [ ] Confirm that each critical account still has at least two authorized administrators and working recovery methods. + +### Financial systems + +- [ ] Remove or modify TowneBank access and signing authority when applicable. +- [ ] Remove or modify QuickBooks Online access. +- [ ] Remove access to payment processors, expense tools, ticketing systems, donation platforms, sponsor invoicing, and financial reports. +- [ ] Remove or modify access to tax, accounting, payroll, insurance, and vendor portals. +- [ ] Cancel organization-issued cards or purchasing authority. +- [ ] Collect outstanding receipts, reimbursement requests, invoices, deposits, and financial records. +- [ ] Confirm that no recurring payment, autopay, or financial notification depends solely on the departing person's account. +- [ ] Notify the accountant, bank, insurer, or payment provider when required. + +### Physical property and records + +- [ ] Recover keys, badges, equipment, storage devices, cards, check stock, paper files, banners, signage, and other RevolutionVA property. +- [ ] Confirm deletion or return of confidential local copies when legally and operationally appropriate. +- [ ] Preserve organization records subject to the retention policy; do not demand deletion of materials under legal hold. +- [ ] Document returned property and unresolved items. + +## 5. Transfer responsibilities + +- [ ] Inventory active projects, deadlines, events, sponsor conversations, vendor relationships, and pending decisions. +- [ ] Assign a new owner for every active responsibility. +- [ ] Transfer relevant contacts, files, contracts, notes, and status information. +- [ ] Reassign Code of Conduct, whistleblower, communications, financial, or emergency-response responsibilities. +- [ ] Reassign recurring operational tasks and scheduled communications. +- [ ] Confirm that no program, account, or process has become dependent on one person. +- [ ] Record unresolved obligations and the director or officer accountable for follow-up. + +## 6. Public and internal updates + +- [ ] Update the internal board, officer, committee, volunteer, and authorized-user rosters. +- [ ] Update the public board or leadership page when applicable. +- [ ] Update the `RevolutionVA/Organization` repository with appropriate approved public records. +- [ ] Update website biographies, contact pages, governance pages, and public committee listings. +- [ ] Remove the person from future board calendar invitations and internal distributions. +- [ ] Issue an official public communication only when appropriate and through the authorized communications process. +- [ ] Keep personnel, disciplinary, legal, whistleblower, and sensitive separation details confidential. + +## 7. Government, banking, insurance, and vendor updates + +When applicable: + +- [ ] Update Virginia corporate or charitable-registration records. +- [ ] Update registered-agent or principal-office records. +- [ ] Update IRS responsible-party or tax records when legally required. +- [ ] Update TowneBank authorized signers. +- [ ] Update insurance policies and D&O rosters. +- [ ] Update QuickBooks Online, accountant, and Form 990 contact information. +- [ ] Update contracts, venue contacts, sponsor contacts, payment processors, and key vendors. +- [ ] Retain confirmation of each completed change. + +## 8. Departure confirmation + +When appropriate and not legally sensitive: + +- [ ] Provide written confirmation of the effective departure or role-change date. +- [ ] Remind the person that continuing confidentiality, record-preservation, intellectual-property, and data-protection obligations remain in effect. +- [ ] Confirm that RevolutionVA property and organization records have been returned or transferred. +- [ ] Confirm that the person no longer represents themselves as authorized to speak, contract, spend, or act for RevolutionVA. +- [ ] Provide a contact for final reimbursement, tax-document, or record-transfer questions. +- [ ] Thank the person for their service when appropriate. + +## 9. Verification within three business days + +- [ ] Confirm that all required access was removed or adjusted. +- [ ] Confirm that critical accounts retain two authorized administrators. +- [ ] Confirm that organization-controlled recovery methods and MFA still work. +- [ ] Confirm that privileged sessions, tokens, and credentials were revoked or rotated where necessary. +- [ ] Confirm that files, email, contracts, and operational knowledge were preserved and transferred. +- [ ] Confirm that public and internal rosters are accurate. +- [ ] Confirm that financial and signing authority records are accurate. +- [ ] Confirm that legal holds and retention requirements remain intact. +- [ ] Record unresolved items, owner, and deadline. + +## 10. Closeout + +- [ ] Record the date the checklist was completed. +- [ ] Record the name of the person who performed the access review. +- [ ] Record the name of the director or officer who verified completion. +- [ ] Store the completed checklist in the restricted Google Drive directors folder. +- [ ] Schedule any remaining follow-up checks. + +--- + +**Person offboarded:** ______________________________________ + +**Role(s):** ________________________________________________ + +**Effective date and time:** _________________________________ + +**Checklist completed by:** _________________________________ + +**Completion date:** ________________________________________ + +**Verified by:** ____________________________________________ + +**Outstanding follow-up:** __________________________________ From 135e2ded7b658c63a39572966df6fb159e818930 Mon Sep 17 00:00:00 2001 From: shedquartersbot Date: Sat, 15 Aug 2026 12:32:57 -0400 Subject: [PATCH 3/3] docs(board): align onboarding checklist with governance decisions --- .../director-onboarding-checklist.md | 33 ++++++++++++++++--- 1 file changed, 28 insertions(+), 5 deletions(-) diff --git a/board/processes/director-onboarding-checklist.md b/board/processes/director-onboarding-checklist.md index 0213dc7..ded9fd2 100644 --- a/board/processes/director-onboarding-checklist.md +++ b/board/processes/director-onboarding-checklist.md @@ -39,12 +39,11 @@ Provide the candidate with current or proposed copies of: ## 4. Board appointment action - [ ] Place the appointment on a properly noticed board-meeting agenda or written-consent action. +- [ ] Consider and vote on the candidate individually rather than as part of a slate. - [ ] Confirm that appointing the director receives a two-thirds vote of directors currently serving. +- [ ] For one of the first three rotating seats, confirm that both Kevin Griffin and Linda Nichols affirmatively approve the candidate, regardless of how many initial directors are already serving. - [ ] Record each director's vote in the minutes or written consent; director appointments are not anonymous officer elections. -- [ ] Record the appointment's immediate effective date. -- [ ] Record the applicable formal term anchor: January 1 or July 1. -- [ ] Record the formal three-year term's start and end dates. -- [ ] Mark any period before the term anchor as a transition period that does not count toward the two-consecutive-term limit. +- [ ] Make the appointment effective only after the required DocuSign package is completed. ## 5. Required DocuSign package @@ -64,6 +63,10 @@ For every completed DocuSign envelope: - [ ] Save the completed signed document in Google Drive. - [ ] Save the DocuSign completion certificate alongside it. - [ ] Confirm access is limited appropriately for confidential records. +- [ ] Record the appointment's immediate effective date after all required signatures are complete. +- [ ] Record the next formal term anchor: January 1 or July 1. +- [ ] Record the formal three-year term's start and end dates. +- [ ] Mark the period before the term anchor as a transition period that does not count toward the two-consecutive-term limit. ## 6. Access and records @@ -74,6 +77,8 @@ For every completed DocuSign envelope: - [ ] Add the director to board calendar invitations and board communications. - [ ] Explain that legal, personnel, donor-private, whistleblower, and executive-session records are restricted to people with a legitimate need for access. - [ ] Do not grant bank, QuickBooks, DocuSign administration, repository write, or other privileged access unless the director's assigned responsibilities require it. +- [ ] Grant access only through organization-controlled accounts, groups, and 1Password vaults appropriate to the director's responsibilities. +- [ ] For any critical account administered by the director, confirm multifactor authentication, organization-controlled recovery information, and at least one other authorized administrator. - [ ] Update the internal director roster, including contact information, appointment date, term anchor, formal term dates, and officer or committee assignments. - [ ] Update the public board roster after the appointment is effective. @@ -90,7 +95,10 @@ Complete before the director's first voting meeting when practical and no later ### Governance -- [ ] Board composition, founding seats, rotating terms, term limits, and future expansion rules. +- [ ] Board composition, the authorized five-, seven-, or nine-director structure, founding seats, rotating terms, term limits, and future expansion rules. +- [ ] Founding-director amendment protections, mission and existential-action consent rights, accountability, and non-inheritable succession rules. +- [ ] Individual director appointment voting, two-thirds approval, and the special requirement that both founders approve each of the first three rotating directors. +- [ ] January 1 and July 1 term anchors and the non-term transition period before an anchor. - [ ] Quarterly meeting requirement, annual January organizational meeting, notice rules, agendas, minutes, quorum, and voting. - [ ] Anonymous voting applies only to officer elections. - [ ] Written-consent procedure for unanimous action between meetings. @@ -117,6 +125,11 @@ Complete before the director's first voting meeting when practical and no later - [ ] Board-approved annual and event budgets. - [ ] Second-director pre-approval for unbudgeted transactions of $500 or more. - [ ] Budgeted-expense exception for approved annual and event budgets. +- [ ] Contract-signing authority limited to the President, Vice President, or a future Executive Director acting within delegated authority. +- [ ] Debt-free preference and the two-thirds approval requirement for debt, guarantees, or security interests. +- [ ] Board-designated operating and event-contingency reserves and the board-approval requirement for reserve spending. +- [ ] Separate tracking and purpose restrictions for donor-restricted and grant-restricted funds. +- [ ] Administrative acceptance of routine unrestricted cash donations and board review of unusual or heavily restricted gifts. - [ ] Form 990 preparation and board-review process. ### Records and risk @@ -127,6 +140,15 @@ Complete before the director's first voting meeting when practical and no later - [ ] General liability, event insurance, and D&O coverage when obtained. - [ ] Indemnification and its exclusions. +### Communications and account security + +- [ ] Public-representation rule: directors do not speak for RevolutionVA unless authorized and clearly distinguish personal views. +- [ ] Routine communications authority of the President and board approval for policy, crisis, legal, or significantly controversial statements. +- [ ] Joint President/Vice President holding-statement authority in a genuine time-sensitive crisis, subject to prompt board review. +- [ ] Shared email and 1Password practices. +- [ ] Critical-account requirements: two administrators, organization-controlled recovery information, and multifactor authentication. +- [ ] Same-day access removal when a person leaves and immediate review when responsibilities change. + ## 8. First board meeting - [ ] Introduce and formally welcome the new director. @@ -158,3 +180,4 @@ At the January organizational meeting each year: - [ ] Review attendance and active-participation expectations. - [ ] Confirm program, event, or committee involvement for the year. - [ ] Review policy or bylaw changes adopted since the prior acknowledgment. +- [ ] Complete the annual access audit for shared accounts, administrators, 1Password vaults, recovery methods, MFA, banking, QuickBooks Online, GitHub, Google Drive, DocuSign, domains, websites, and social platforms.