The starter pack of NGO policies
Which written policies a small NGO needs first, which can wait, and how to write short policies your team will actually follow.
Short answer
A starter pack for a small NGO has about eight short policies: conflict of interest, finance and procurement, anti-fraud and whistleblowing, safeguarding and a code of conduct, HR basics, data protection, and document retention. Start with finance and conflict of interest. Each policy needs an owner, an approval date and a review date. Short policies that staff follow beat long ones nobody reads.
Key points
- Start with the policies that protect money and people: finance, conflict of interest, safeguarding.
- A policy must describe a workflow, who does what, not just principles.
- Adopt it at board level, share it with staff, and train people on it.
- Keep a register with each policy's owner, approval date and review date.
- Do not copy another NGO's thresholds. Set limits that fit your size.
Why do small NGOs need written policies?
A policy is a written rule for how your organisation makes decisions and protects people and money. Donors expect to see key policies during due diligence. More importantly, policies help your team act the same way when the director is away, when staff change, or when a hard case comes up.
Leadership changes, especially on boards, so written policies keep practice steady when people move on.
Which policies come first?
You do not need thirty policies on day one. The right set depends on your situation. This table is EMPO's simple guide. Adapt it to your legal form and funders.
| Your situation | Adopt first | Add next |
|---|---|---|
| New group, volunteers only | Finance and banking, conflict of interest | Complaints, data handling |
| First paid staff | HR basics: hiring, leave, conduct; payroll approval | Grievance procedure |
| Work with children or at-risk groups | Safeguarding, with a named focal person, before the programme starts | Code of conduct for visitors and volunteers |
| Applying for institutional grants | Procurement, anti-fraud, whistleblowing | Asset, travel and data protection |
What is in the starter pack?
- Conflict of interest. How people disclose a personal or financial link, and step out of the decision. Record each case in the minutes. See managing conflict of interest.
- Finance and procurement. Budgets, approval levels, cash and bank rules, travel and expenses, purchasing steps. Read financial policies every NGO needs and writing a procurement policy.
- Anti-fraud and whistleblowing. What counts as fraud, who receives reports, how reporters are protected. Our guide on fraud prevention has a one-page response plan.
- Safeguarding and code of conduct. How you protect children and adults from harm, and how staff and partners must behave. See safeguarding basics.
- HR basics. Recruitment, contracts, leave, performance, discipline and grievance. See HR policies a growing NGO needs.
- Data protection and confidentiality. What personal data you collect, who can see it, how long you keep it and how you delete it. Include photos and beneficiary lists.
- Document retention. What you keep, where, for how long, and who owns it. Check donor and national requirements, and do not assume one retention period fits all.
- Asset and IT use. Who owns the official email and domain, password rules, backups, and what happens to access when staff leave.
The US National Council of Nonprofits names written conflict of interest, whistleblower protection and document retention policies, and a gift acceptance policy, as basic governance policies. CommunityNet Aotearoa's checklist adds finance, HR, health and safety, and client complaint procedures. Different regulators ask for different things, so match your list to your legal form and funders.
How do you write a policy people follow?
Keep each policy to one to three pages. Use this structure:
- Purpose. One or two sentences on why the policy exists.
- Scope. Who it applies to: board, staff, volunteers, partners.
- Rules. Short, numbered, using "must" and "must not".
- Process. The steps, who does them, and the forms used.
- Responsibility. The policy owner and who to ask.
- Review. Approval date and next review date.
A good policy has a workflow, not only principles. Do not promise what you cannot deliver, for example a confidential hotline you do not have. Do not borrow thresholds, such as the purchase amount that needs three quotes, from another NGO or donor and call them law. Set your own, and check donor rules.
How do you roll policies out?
- Have the board approve the core policies and record this in the minutes.
- Present each policy in a short staff session, in English or Burmese as the team needs. Use real examples.
- Ask every staff member and board member to sign that they have read the policies, and repeat this each year.
- Include the policies in staff induction.
- Keep a policy register: title, owner, approval date, next review date, location of the file.
- Review each policy at least every one to two years, and sooner if a donor, law or risk changes.
If you cannot implement a policy yet, do not adopt it. Drop it or simplify it. A policy that exists only on paper is a weakness during an audit.
How EMPO can help
EMPO is a trusted, Yangon-based training and consultancy provider and one of Myanmar's leading names in practical training for NGOs and CSOs, with 1,200+ people trained and 15 partner organisations. Our organisational development service helps teams draft, adopt and roll out policies, in English and Burmese, remotely or in person. See our services or contact us to plan support.
Sources
- Good Governance Policies for Nonprofits — National Council of Nonprofits (USA)
- Checklist of policies and procedures — CommunityNet Aotearoa, 2020
Questions people ask
How many policies does a new NGO need?
Start with four to six short ones, based on what you do. Add more as you hire staff, work with children, hold personal data or receive larger grants.
Can we copy a template from another organisation?
You can use a template as a draft, but adapt it. A policy that promises a reporting channel or approval level you do not have creates risk.
Who should approve policies?
The board or governing body approves the main policies. Management can approve detailed procedures under them.
