Grant Closeout IT Procedures

Grant closeout IT procedures govern the systematic handling of technology assets, data, and access rights when donor-funded projects reach completion. These procedures ensure compliance with donor data retention requirements, proper disposition of grant-purchased equipment, and orderly termination of project-specific system access while preserving audit trails and organisational knowledge.

The IT closeout process begins 90 days before the grant end date and concludes within 30 days after final financial reporting. This timeline allows sufficient time for data archiving, asset disposition decisions, and coordination with finance and programme teams on donor compliance requirements.

Prerequisites

Before initiating grant closeout IT procedures, confirm the following requirements are satisfied:

Obtain written confirmation from the grants management team that closeout has been authorised. Premature closeout actions create compliance risks; delayed closeout actions result in unnecessary costs and potential data retention violations.

Procedure

Grant closeout proceeds through five phases: data handling, system access termination, asset disposition, documentation, and final verification. Each phase has dependencies on previous phases and coordination requirements with other departments.

+---------------------------------------------------------------------------+
|                          GRANT CLOSEOUT TIMELINE                          |
+---------------------------------------------------------------------------+
|                                                                           |
|   Day -90        Day -60        Day -30         Day 0         Day +30     |
|      |              |              |              |              |        |
|      v              v              v              v              v        |
| +---------+    +---------+    +---------+    +---------+    +---------+   |
| |Initiate |    | Archive |    |Terminate|    | Grant   |    | Final   |   |
| |& Plan   |    | Data    |    |Access   |    | Ends    |    | Verify  |   |
| +---------+    +---------+    +---------+    +---------+    +---------+   |
|     |               |              |              |              |        |
|     |   Asset       |   Staff      |   Final      |   Audit      |        |
|     |   inventory   |   offboard   |   backups    |   ready      |        |
|     |   review      |   begins     |              |              |        |
|                                                                           |
+---------------------------------------------------------------------------+

Figure 1: Grant closeout timeline showing IT activities relative to grant end date

Phase 1: Initiation and planning

Initiation establishes the closeout scope and identifies all IT components requiring action. This phase runs from day -90 to day -75.

1. Request the grant agreement and any amendments from the grants management team. Extract all IT-related provisions including:

   • Equipment purchase and disposition clauses
   • Data retention requirements (duration and format)
   • Reporting requirements for IT assets
   • Transfer or return obligations
   • Intellectual property provisions affecting software or data

   Document these requirements in the closeout plan as binding constraints.

2. Generate the asset report for this grant from the asset management system. Filter by funding source code and verify against original purchase records. The report must include:

   Asset ID | Description | Purchase Date | Cost | Location | Current User | Condition

   Reconcile discrepancies between the asset register and physical inventory before proceeding. Missing assets require incident documentation regardless of value.

3. Compile the complete data inventory in collaboration with the project team. For each data repository, record:

   • Repository name and location (server path, cloud service, application)
   • Data classification (per organisational data classification scheme)
   • Approximate volume (GB/TB)
   • Contains personal data (yes/no, with categories if yes)
   • Contains donor-reportable data (yes/no)
   • Retention requirement source (donor clause, legal requirement, organisational policy)
   • Recommended disposition (archive, delete, transfer)

   Project data commonly resides in 5-15 distinct locations including shared drives, cloud storage, email, project management tools, data collection platforms, and local devices.

4. Identify all system access granted specifically for this project. Query the identity provider for:

   • Users with project-specific group memberships
   • Service accounts created for project integrations
   • External collaborator accounts (partner staff, consultants)
   • Application-specific roles tied to the project

   Cross-reference with HR records to identify staff departing at project end versus staff continuing on other projects.

5. Schedule the closeout planning meeting with:

   • Project manager
   • Grants manager
   • Finance representative
   • HR representative (if staff departures involved)
   • IT closeout lead

   Use the meeting to confirm the closeout timeline, assign responsibilities for each phase, and resolve any conflicts between donor requirements and organisational capacity.

Phase 2: Data handling

Data handling ensures project information is retained according to requirements, transferred where appropriate, and securely deleted when no longer needed. This phase runs from day -75 to day -30.

1. Determine the retention period for each data category by applying the most restrictive requirement from:

   • Grant agreement explicit terms
   • Donor standard terms (if not specified in agreement)
   • Regulatory requirements (GDPR, sector-specific)
   • Organisational retention policy

   Common donor retention requirements:

   Donor type	Standard retention	Notes
   USAID	3 years after final expenditure report	May extend if audit pending
   FCDO	7 years from programme end	Includes all financial records
   EU	5 years from final payment	7 years for infrastructure projects
   UN agencies	7 years minimum	Agency-specific variations exist
   Private foundations	Per agreement, commonly 5-7 years	Check each agreement

   When the grant agreement is silent on retention, apply the donor’s standard terms. When no donor requirement exists, apply organisational policy.

2. Execute data archiving for all data requiring long-term retention. The archive must satisfy these criteria:

   • Immutable storage (write-once or versioned with deletion protection)
   • Encryption at rest using AES-256 or equivalent
   • Geographic redundancy (minimum two locations)
   • Documented retrieval procedure
   • Retention period enforcement (automatic or procedural)

   Create the archive structure:

   /archive/grants/[grant-reference]/
   ├── programme-data/
   │   ├── beneficiary-records/
   │   ├── activity-reports/
   │   └── monitoring-data/
   ├── financial-records/
   │   ├── transactions/
   │   └── supporting-docs/
   ├── correspondence/
   └── metadata/
       ├── manifest.json
       └── retention-policy.txt

   The manifest file records: archive date, source locations, file counts, total size, classification level, retention expiry date, and authorised accessor list.

3. Execute data transfer for data being handed to successor projects, partner organisations, or donors. Before transfer:

   • Confirm the data sharing agreement covers this transfer
   • Verify recipient’s data protection capabilities match data classification
   • Remove data not authorised for transfer (staff personal data, third-party confidential data)
   • Generate transfer manifest listing all items
   • Obtain recipient acknowledgment

   For transfers to partners with lower technical capacity, consider providing data on encrypted physical media rather than electronic transfer. Include decryption credentials via separate secure channel.

4. Execute secure deletion for data not subject to retention requirements and not being transferred. Secure deletion means:

   • For cloud storage: use provider’s secure delete function, verify retention policies do not preserve deleted items
   • For on-premises storage: overwrite or cryptographic erasure depending on media type
   • For SaaS applications: use in-app deletion, verify backup retention periods, request written confirmation from vendor if required
   • For email: delete from mailboxes and purge from recoverable items; archive anything subject to retention before deletion

   Document all deletions with timestamps, data descriptions, deletion method, and operator identity.

5. Handle personal data according to data subject rights and legal requirements. Project closure does not automatically authorise deletion of personal data if retention obligations exist. Conversely, project closure does not extend the legal basis for processing personal data beyond original purposes.

   For beneficiary data:

   • Retain for audit purposes per donor requirements
   • Do not retain for purposes beyond original consent/legal basis
   • Apply pseudonymisation or anonymisation where full identification is no longer required
   • Update privacy notices if data controller responsibilities transfer

   Document all personal data disposition decisions for GDPR accountability.

Phase 3: System access termination

System access termination removes project-specific access rights while preserving access needed for ongoing organisational roles. This phase runs from day -45 to day 0, coordinated with HR offboarding for departing staff.

1. Categorise all users with project access into disposition groups:

   Category	User type	Access action	Timing
   A	Staff departing organisation	Full offboarding	Per departure date
   B	Staff continuing, no project role	Remove project access only	Day -7
   C	External collaborators	Account termination	Day -14
   D	Service accounts	Disable after final data operations	Day 0
   E	System administrators	Remove project-specific privileges	Day +7

   Category A users follow standard offboarding procedures with enhanced attention to project data handover. Category B users require careful separation of project access from organisational access.

2. For Category A (departing staff), coordinate with HR on departure timeline and initiate standard offboarding procedures. Ensure project-specific handover occurs before departure:

   • Passwords and credentials for project-specific services
   • Documentation of project-specific configurations
   • Data locations and access methods
   • Vendor contacts and account information
   • Pending issues or unfinished work

   Complete knowledge transfer before the final working day. Last-day handovers fail.

3. For Category B (continuing staff), remove project-specific access without disrupting other access:

   • Remove from project security groups/distribution lists
   • Revoke project application roles
   • Remove from project file shares and cloud folders
   • Update any shared credentials (rotate if shared with departing staff)
   • Communicate changes to affected users with rationale

   Execute 7 days before grant end to allow issue identification while project team remains available.

4. For Category C (external collaborators), terminate accounts entirely unless other active projects require continued access:

   • Disable accounts 14 days before grant end
   • Allow 7-day window for data retrieval requests
   • Delete accounts 7 days before grant end
   • Notify external users of termination with adequate notice
   • Provide export of any personal data they created

   Document all external account terminations for audit trail.

5. For Category D (service accounts), disable after final data operations are complete:

   • Identify all automated processes, integrations, and scheduled tasks
   • Ensure final backups and data exports complete successfully
   • Disable service accounts on grant end date
   • Delete service accounts 30 days after grant end (allows for unexpected needs)
   • Rotate any credentials that were shared across projects

   Test that dependent systems fail gracefully when service accounts are disabled.

6. For Category E (administrators), remove project-specific administrative privileges 7 days after grant end:

   • Remove from project administration groups
   • Revoke delegated permissions for project systems
   • Maintain standard IT administrative access
   • Ensure closeout documentation is complete before removing access

Phase 4: Asset disposition

Asset disposition determines the final destination of equipment purchased with grant funds. Donor agreements commonly restrict disposition options; organisational policy governs when donor terms are silent. This phase runs from day -60 to day +14.

+------------------------------------------------------------------------------------+
|                            ASSET DISPOSITION DECISION                              |
+------------------------------------------------------------------------------------+
|                                                                                    |
|                         Asset disposition entry                                    |
|                                   |                                                |
|                                   v                                                |
|                 +-----------------+-----------------+                              |
|                 |      Donor requires return        |                              |
|                 |      or specifies disposition?    |                              |
|                 +-----------------+-----------------+                              |
|                                   |                                                |
|                        +----------+----------+                                     |
|                        |                     |                                     |
|                       YES                    NO                                    |
|                        |                     |                                     |
|                        v                     v                                     |
|           +-----------------------+ +-----------------------+                      |
|           | Follow donor          | |      Asset value      |                      |
|           | requirements          | |      > threshold?     |                      |
|           | exactly               | |    (usually $5,000)   |                      |
|           +-----------------------+ +-----------+-----------+                      |
|                                                 |                                  |
|                                       +---------+---------+                        |
|                                       |                   |                        |
|                                      YES                  NO                       |
|                                       |                   |                        |
|                                       v                   v                        |
|                            +-------------------+ +-------------------+             |
|                            |   Obtain donor    | |      Apply        |             |
|                            |   approval for    | |  organisational   |             |
|                            |    disposition    | |      policy       |             |
|                            +---------+---------+ +---------+---------+             |
|                                      |                     |                       |
|                        +-------------+-------------+       |                       |
|                        |             |             |       |                       |
|                        v             v             v       |                       |
|                  +-----------+ +-----------+ +-----------+ |                       |
|                  |   Return  | |  Transfer | |   Keep    | |                       |
|                  |   Donor   | |  Partner  | |   Org     | |                       |
|                  +-----------+ +-----------+ +-----------+ |                       |
|                                                            |                       |
|                                             +--------------+--------------+        |
|                                             |              |              |        |
|                                             v              v              v        |
|                                       +-----------+  +-----------+  +-----------+  |
|                                       |   Keep    |  |  Transfer |  |  General  |  |
|                                       |   Org     |  |  Partner  |  |  Disposal |  |
|                                       +-----------+  +-----------+  +-----------+  |
|                                                                                    |
+------------------------------------------------------------------------------------+

Figure 2: Asset disposition decision tree based on donor requirements and value thresholds

1. Review grant agreement asset provisions. Common disposition frameworks:

   US Government grants (USAID, State, CDC): Equipment with acquisition cost over $5,000 requires written disposition instructions from the awarding agency. Options typically include: continued use on other federal projects, transfer to another federal recipient, return to federal government, or sale with proceeds returned. Equipment under $5,000 may be retained without approval.

   UK Government grants (FCDO): Assets generally remain with the implementing organisation unless the agreement specifies otherwise. Transfer to partner organisations or successor projects is common. Disposal of high-value assets may require notification.

   EU grants: Durability obligations may require maintaining assets in project use for a specified period (commonly 5 years for infrastructure). Equipment purchased with EU funds may require prior approval for disposition.

   Private foundations: Requirements vary significantly. Review each agreement.

2. For assets requiring donor approval, submit disposition requests at least 60 days before grant end:

   ASSET DISPOSITION REQUEST
   
   Grant Reference: [number]
   Grant End Date: [date]
   
   Asset Details:
   - Description: [item]
   - Asset ID: [number]
   - Acquisition Date: [date]
   - Acquisition Cost: [amount]
   - Current Condition: [good/fair/poor]
   - Current Location: [location]
   - Current User: [name/role]
   
   Requested Disposition: [return/transfer/retain/sell/dispose]
   Justification: [explanation]
   
   If transfer/retain: Proposed use: [description]
   If sell: Estimated fair market value: [amount]
   
   Submitted by: [name]
   Date: [date]

   Track request status and follow up if no response within 30 days.

3. For assets to be returned to donor, coordinate logistics:

   • Confirm shipping address and contact
   • Wipe all organisational data from devices
   • Reset devices to factory configuration where possible
   • Package securely for transport
   • Obtain shipping confirmation and receipt acknowledgment
   • Retain proof of return for audit file

4. For assets to be transferred to partner organisations:

   • Confirm donor approval if required
   • Execute transfer agreement documenting:
     • Asset details and condition
     • Transfer date
     • Acknowledgment of receipt
     • Any continuing obligations (maintenance, return conditions)
   • Wipe organisational data, provide clean installation if applicable
   • Update asset register to reflect transfer
   • Retain signed transfer documentation

5. For assets to be retained for organisational use:

   • Confirm donor approval if required
   • Reallocate in asset management system (change funding source, cost centre)
   • Reassign to new user or pool
   • Update configuration for new use context
   • Remove project-specific data, accounts, and configurations
   • Document retention decision and approval

6. For assets to be disposed:

   • Confirm donor approval if required
   • Follow organisational disposal procedures including:
     • Secure data destruction (certificate required for storage devices)
     • Environmental compliance for electronics disposal
     • Donation to qualified organisations if appropriate
     • Sale with proceeds handled per donor requirements
   • Document disposal method, date, and any proceeds

7. Update the asset register to reflect all dispositions. Final asset report for the grant should show:

   Asset ID	Description	Acquisition cost	Disposition	Date	Evidence reference
   IT-2021-0142	Laptop Dell Latitude 5520	$1,200	Retained - reassigned	2024-03-15	Internal memo ref
   IT-2021-0143	Projector Epson EB-X51	$650	Transferred to Partner X	2024-03-10	Transfer agreement
   IT-2022-0089	Server Dell PowerEdge R450	$8,500	Returned to donor	2024-03-20	Shipping receipt

Phase 5: Documentation and verification

Documentation creates the audit trail demonstrating compliance with donor requirements and organisational policies. This phase runs from day -14 to day +30.

1. Compile the IT closeout file containing:

   • Closeout plan (from Phase 1)
   • Data handling documentation:
     • Archive manifest and location details
     • Transfer records with recipient acknowledgments
     • Deletion certificates with timestamps and methods
     • Personal data disposition register
   • Access termination records:
     • User disposition list with action dates
     • External account termination notices
     • Service account inventory and status
   • Asset disposition documentation:
     • Final asset inventory
     • Donor disposition requests and approvals
     • Transfer agreements
     • Disposal certificates
     • Return shipping receipts
   • Exceptions register with approvals

2. Execute final backup of all retained project data before archive migration:

   # Example backup verification
   restic backup /project/[grant-ref]/ --tag "final-closeout"
   restic check
   restic snapshots --tag "final-closeout"

   Verify backup integrity before confirming archive migration complete. Retain backup for 30 days after archive confirmation as recovery option.

3. Generate the IT closeout summary report for inclusion in the grant closeout package:

   IT CLOSEOUT SUMMARY REPORT
   
   Grant Reference: [number]
   Grant Period: [start] to [end]
   IT Closeout Period: [start] to [completion date]
   IT Closeout Lead: [name]
   
   DATA HANDLING
   Archived: [X] repositories, [Y] GB, retention until [date]
   Transferred: [X] datasets to [recipients]
   Deleted: [X] repositories, [Y] GB
   Archive Location: [location reference]
   
   ACCESS TERMINATION
   Staff offboarded: [X]
   Project access removed: [X]
   External accounts terminated: [X]
   Service accounts disabled: [X]
   
   ASSET DISPOSITION
   Total assets on grant: [X] items, $[total value]
   - Retained: [X] items, $[value]
   - Transferred: [X] items, $[value]
   - Returned to donor: [X] items, $[value]
   - Disposed: [X] items, $[value]
   
   EXCEPTIONS
   [List any items not completed per standard procedures with explanation]
   
   CERTIFICATION
   I certify that IT closeout procedures have been completed in accordance
   with donor requirements and organisational policies.
   
   Signature: _________________ Date: _________
   IT Closeout Lead

4. Conduct final verification 30 days after grant end:

   • Confirm all user access terminated (test login attempts)
   • Verify archived data accessible and intact
   • Confirm deleted data irrecoverable
   • Validate asset register accuracy
   • Test archive retrieval procedure

   Document verification results. Any failures require immediate remediation.

5. Transfer closeout documentation to grants management for the official grant file. IT retains copies per organisational records retention policy.

Verification

Successful grant closeout completion is confirmed when all of the following conditions are satisfied:

Verification must be performed by someone other than the closeout lead to ensure independent confirmation.

Troubleshooting

See also

• Technology Handover -for structured handover of systems and knowledge
• Data Retention and Records -for organisational retention requirements
• Donor IT Requirements -for donor-specific IT compliance
• User Offboarding -for standard offboarding procedures
• Data Archiving -for archiving procedures and standards
• Disposal and Decommissioning -for asset disposal procedures