Identify and maintain practical organisational policies.
On this guide Browse sections
Which policies your NGO needs, and when
Short answer: Every NGO needs a short set of written policies that match its real work, adopted by the governing body and actually followed. Start with finance and procurement, conflict of interest, and complaints or whistleblowing. Add safeguarding if you work with children or vulnerable adults, HR policies once you employ staff, and data protection when you hold personal information. Keep a register of each policy’s owner, approval date and next review, and drop any policy you cannot implement.
Which policies, in which order?
| Your situation | Adopt first | Add next |
|---|---|---|
| Newly registered, volunteers only | Finance and banking, conflict of interest | Complaints, data handling |
| First paid staff | HR basics (hiring, leave, conduct), payroll approval | Workplace complaints procedure |
| Work with children or vulnerable adults | Safeguarding with a named focal person, before the programme starts | Code of conduct for visitors and volunteers |
| Applying for CSR or institutional grants | Procurement, anti-fraud, whistleblowing | Asset, travel and data protection policies |
Funders’ due-diligence forms ask two things about each policy: is it adopted, and is there evidence it is used. A board resolution, a training attendance sheet and one logged complaint answer both better than a forty-page PDF nobody has opened.
Signs a policy is decorative
- It names a committee that does not exist.
- It was copied from another NGO and still carries their name in one paragraph.
- No one can say when it was last reviewed.
Related: how the governing body adopts and reviews policies, financial controls (the finance policy in practice), and beneficiary data. Editable policies and the register are part of the Complete NGO Documentation Toolkit; for funder checks, see the CSR due-diligence templates and due diligence checklist.
By Vekho P. Ringa, Editor. Last verified 22 Oct 2026. Sources: practice guidance; legal requirements for particular policies depend on your legal form, staff numbers and sector, and on funder agreements, which prevail. General information only, not legal advice.
An NGO policy is not useful because it exists as a PDF. It is useful when the organisation has decided that the policy applies, adapted it to real operations, approved it through the competent authority, assigned an owner and trained the people who need to follow it.
The right policy set depends on legal form, staff, programmes, funders, safeguarding risk, data handled and geography.
Make NGO policies usable: register, approve, publish and verify implementation
Use these registers to move from downloading generic policy PDFs to a controlled organisational policy system. Distinguish whether a topic is legally required, imposed by a particular funder, appropriate for a programme risk or simply a voluntary internal practice. A draft becomes organisational policy only after it is validly adopted by the actual governing authority.
20 suggested policy subjects and 24 editable fields. Each entry begins as Candidate — Not Adopted; no fictional approval or review date is filled in.
20 empty change/approval records with 21 fields for draft version, prior approved version, approving body, decision evidence, effective date and controlled copies.
20 example checks and 22 fields for responsible roles, actual evidence, independent review, exceptions, corrective action and verified closure.
The three files are Excel-compatible CSVs and can be edited locally. They do not collect or store your internal policies or staff information on NGOGrant. Keep incident, complainant, child, employee and donor records in restricted systems—not in a publicly shared register.
1. The six-stage policy lifecycle
| Stage | Who should act | Evidence to preserve |
|---|---|---|
| 1. Assess need and applicability | Programme owner, Secretary and appropriate legal/HR/finance reviewer | Law or donor clause, organisational risk, why policy needed or not needed. |
| 2. Draft around actual operations | Assigned policy owner with staff implementing it | Draft version, real roles, forms/registers, escalation route, required source review. |
| 3. Review conflicts and specialist requirements | Authorised adviser/reviewer | Alignment with governing instrument and funder, legal issues and unresolved corrections. |
| 4. Approve through actual authority | Competent governing body or legally delegated authority | Meeting/resolution reference, approval date, version and effective date. |
| 5. Communicate and implement | Manager, HR or programme lead | Controlled issued copy, staff induction, tools, acknowledgements and access restriction. |
| 6. Monitor, revise and archive | Policy owner plus independent reviewer as appropriate | Review evidence, exceptions, training updates and old-copy withdrawal record. |
A board signature does not prove that a policy operates. Link each requirement to a real form, a responsible person and a review method, then correct gaps found in use.
2. Worked example — a procurement policy changes
The finance officer notices that purchase records lack reliable supplier bank-change verification. The current approved procedure is Version 1.0. Staff draft Version 1.1, adding independent bank-change verification and a record of who checked it. First verify whether any grant contract sets stricter controls or the governing body reserved this amendment.
The competent authority reviews and then approves the revised wording. The approval tracker holds the genuine resolution ID, approval/effective date and the reference to the controlled Version 1.1. Staff receive the replacement and acknowledge the new steps. A reviewer later samples purchases to verify that the bank-change check actually occurred.
Important: Version 1.1 is not in force merely because a draft file has that filename. Nor does updating an internal policy retrospectively approve an unauthorised past payment.
3. Which policy topics need extra legal review?
Workplace harassment prevention: Check the Sexual Harassment of Women at Workplace (Prevention, Prohibition and Redressal) Act, 2013, including the employer’s obligations and the Internal Committee / Local Committee routes for the actual workplace circumstances. Do not simply copy the “ten employees” phrase as though it replaces the Act’s detailed duties.
Child safeguarding: Organisations working with children should map supervision, staff conduct, safe recruitment where appropriate, reporting and confidentiality to their real work and relevant child-protection obligations. The NCPCR publishes official POCSO and child-safety resources; a generic safeguarding policy cannot override mandatory reporting or safe referral steps.
Digital personal data: The DPDP Rules, 2025 were notified on 13 November 2025 and have staged commencement: Rules 1, 2 and 17–21 took effect upon publication; Rule 4 was scheduled for one year later, and Rules 3, 5–16, 22 and 23 for eighteen months later. The Act itself also has phased commencement. Verify amendments and the provisions actually in force for the organisation before describing a specific duty as already mandatory.
Finance, donor and grant controls: Set genuine approval authorities and procurement rules under the NGO’s governing framework, and check any specific donor, sanction or employment contract. Policy text cannot override controlling legal or grant obligations.
4. Implementation check before calling a policy operational
The checkboxes are temporary browser inputs, not a policy-adoption workflow or audit certification. Completed registers must be controlled privately by the NGO.
5. Sources and adjacent practical tools
- MeitY — Digital Personal Data Protection Rules, 2025 (final notification and commencement).
- MeitY — DPDP Act commencement notification.
- India Code — Sexual Harassment of Women at Workplace Act, 2013.
- NCPCR — child-safety and POCSO guidance.
Editorial source review: 9 October 2026. These are illustrative planning and governance resources, not Government-approved forms, statutory compliance certificates or professional advice. NGOGrant is independent; the NGO’s governing authority, appropriate professionals and current applicable law control adoption and implementation.
1. Build a policy register before writing policies
Create a register with:
- policy ID;
- title;
- purpose;
- scope;
- owner;
- approving authority;
- version;
- approval date;
- effective date;
- review date;
- related law/agreement;
- training/communication requirement;
- superseded version;
- current status.
This becomes the control centre for organisational policies.
2. Separate governing documents from policies
Governing documents may include:
- Society memorandum/rules;
- trust deed;
- Section 8 memorandum/articles;
- registered amendments.
Policies operate underneath those instruments. A finance policy cannot give staff powers that the governing instrument reserves to the governing body.
3. Core governance policies
Depending on the organisation:
Conflict of interest
Disclosure, participation, voting/decision handling, recordkeeping and related-party review.
Delegation of authority
Who can approve finance, staffing, contracts, grants and operational decisions.
Meeting/decision procedures
Only where additional internal procedure is useful and consistent with the governing instrument.
Document retention / records
What is retained, owner, location, access and disposal—without inventing a universal statutory retention period.
4. Finance policies
Common areas:
- budgeting;
- procurement;
- payment approval;
- bank/cash;
- advances;
- travel;
- payroll;
- assets;
- grants;
- donor receipts;
- fraud/whistleblowing;
- reserves/investments where relevant.
A good policy contains a workflow, not only principles.
5. Procurement policy
Define:
- purchase planning;
- thresholds/selection routes adopted by the NGO;
- quotation/tender process where used;
- emergency procurement;
- conflict handling;
- approval;
- documentation;
- donor/sanction override;
- vendor bank-change control.
Do not copy thresholds from another NGO/funder and claim they are law.
6. HR and workplace policies
Where the NGO has staff or regular workers, consider:
- recruitment;
- appointment/contract;
- induction;
- attendance/leave;
- performance;
- payroll change;
- grievance;
- disciplinary process;
- prevention of harassment / POSH where applicable;
- workplace safety;
- separation/handover;
- IT/access.
Legal requirements depend on workforce and jurisdiction and should be verified separately.
7. Safeguarding / child protection
If the NGO works with children or vulnerable persons, safeguarding may need to be a core operational policy.
A useful system can cover:
- code of conduct;
- recruitment checks where appropriate;
- supervision;
- photography/media;
- one-to-one contact;
- transport/overnight activity;
- complaint/report route;
- incident response;
- confidentiality;
- escalation to authorities where legally required.
Do not write a policy that promises reporting routes the NGO has not set up.
8. Data protection and confidentiality
Policies should reflect the information the NGO actually collects.
Possible areas:
- beneficiary data;
- donor data;
- employee records;
- photographs/videos;
- health/sensitive programme data;
- portal credentials;
- payment/bank information;
- partner data.
Define access, purpose, retention, sharing, incident response and deletion.
The Digital Personal Data Protection Act, 2023 and DPDP Rules, 2025 have phased commencement. Check the latest official commencement notifications to establish which provisions apply before relying on a specific legal obligation.
9. Programme and beneficiary policies
Depending on work:
- beneficiary eligibility/selection;
- grievance;
- inclusion/non-discrimination;
- distribution;
- cash-transfer controls;
- consent/media;
- field safety;
- monitoring/evidence;
- complaints.
A policy should not promise benefits the NGO cannot guarantee.
10. Donor and fundraising policies
Possible topics:
- donation acceptance;
- restricted donations;
- donor privacy;
- receipt control;
- anonymous/unidentified donations;
- refunds;
- fundraising representations;
- third-party collectors;
- prohibited/restricted sources where applicable.
FCRA-related foreign contribution needs a separate legal/control pathway.
11. Whistleblowing and complaints
Design a realistic reporting route.
Specify:
- who receives complaints;
- alternate route if complaint concerns that person;
- confidentiality;
- anti-retaliation principle;
- triage;
- investigation responsibility;
- governing-body escalation;
- recordkeeping;
- external reporting where legally required.
12. IT and access policy
Even a small NGO should decide:
- who owns official email/domain;
- password manager/credential rules;
- MFA;
- device access;
- backup;
- departing staff access removal;
- banking/accounting access;
- cloud storage;
- personal device rules;
- incident reporting.
Never include passwords in the policy.
13. Policy drafting structure
A practical policy can use:
- Purpose
- Scope
- Definitions
- Roles/responsibilities
- Policy rules
- Step-by-step procedure
- Required records/forms
- Exceptions/escalation
- Monitoring
- Breach/non-compliance handling
- Related documents
- Approval/version/review
14. Approval process
Before adoption:
- confirm governing authority;
- review consistency with governing instrument;
- check relevant law/funder conditions;
- adapt thresholds/roles;
- circulate to implementers;
- record approval;
- issue controlled version;
- train staff;
- archive draft/superseded version.
15. Policy review triggers
Review when:
- law changes;
- organisation changes structure;
- new major donor/grant condition;
- new office/geography;
- significant incident;
- audit finding;
- staff growth;
- repeated exception;
- technology change;
- scheduled review date.
16. Policy implementation evidence
Evidence can include:
- approval resolution/minutes;
- signed acknowledgement;
- training attendance;
- completed forms;
- procurement/payment records;
- conflict declarations;
- complaint register;
- incident log;
- review notes.
A policy nobody follows is not a control.
Policy red flags
- Downloaded template still contains another organisation’s name.
- Policy threshold conflicts with donor agreement.
- No approving body/date.
- Staff do not know the policy exists.
- No form/register supports the procedure.
- Every exception is approved informally.
- Old versions remain in circulation.
- Privacy policy promises deletion/security practices the NGO cannot perform.
- Safeguarding policy has no reporting route.
Suggested policy prioritisation
Tier 1 — usually operationally important
Governance/authority, finance/procurement, bank/cash, conflict, HR basics, safeguarding if relevant, data/access.
Tier 2 — driven by programme/funding risk
Donor acceptance, grant management, beneficiary selection, media/consent, complaints, travel, field safety.
Tier 3 — maturity/scale
Reserves/investments, vendor due diligence, business continuity, detailed IT security, enterprise risk.
The exact mix must match the NGO.
Source and applicability notes
This guide is based on NGOGrant’s Governance and Finance Controls systems.
Policy questions we hear often
Which policies are legally mandatory for an NGO?
That varies with your legal form, whether you employ staff, how many, and the sector you work in; some workplace and child-protection duties apply by law once those facts exist. Check with a professional for your situation instead of trusting a one-size list. General information only, not legal advice.
Can we copy another NGO’s policies?
Use them as a reference, then rewrite for your own structure, people and programmes. A copied policy that you do not follow is worse than none in a funder review.
Who approves a policy?
Whichever body your governing document empowers, usually the governing body, by a recorded resolution. Note the date and the next review date. General information only, not legal advice.
How often should policies be reviewed?
Once a year is a good default, and straight away after a serious incident, a new funder requirement or a change in the rules that apply to you.
Do small volunteer groups need written policies?
A few, yes: money handling, conflicts of interest and how to raise a concern. Keep them to a page each.
NGOGrant boundary
NGOGrant can help prepare editable policy drafts and policy registers. The NGO must adopt policies through its genuine authority, and legal/professional review is needed where the subject requires it.
When is the free guide enough—and when might a document pack help?
Start free: For a single new policy or an occasional meeting, the free guides and CSV registers may be entirely sufficient. Start with the policy approval and implementation checklist above rather than paying for a whole office library by default.
Consider a connected system if: An NGO managing governance, accounts, donation receipts, funding applications, reporting and compliance together may prefer one coordinated set of controlled templates and manual reconciliation tools.
What the optional pack actually describes: The full paid toolkit is described as 600 unique substantive pages and 150 files: all nine standalone packs plus 60 additional integration pages, with 60 DOCX files, 10 XLSX workbooks and 30 PDF guides.
What it does not do: Do not buy the full toolkit and its included standalone packs again for the same material. It is not synchronised software, an official filing, an audit opinion or a funding award.
Compare the complete documentation toolkit →
This link opens the matching pack in NGOGrant’s document catalogue. Purchases are not available yet. You can review the listed price, contents, scope and licence, and check the Shop for availability updates. The free guidance above remains available without purchase.