Before you pay for one — or write one off — here's what a real nonprofit digital audit covers, what you walk away with, and how to read your own score.
First, the part most articles like this leave out: I sell these. A digital audit is one of the things MissionAssist does for money, and I get paid when a nonprofit hires me to run one — so weigh that as you read. It's also exactly why I'm writing the method down: my goal is to show you enough that you could run the audit yourself. Score well across the board and you don't need to hire anyone — me included — and I'll say so again at the end.
The short version: a digital audit is an honest look at how your nonprofit uses technology — website, communications, data, systems, AI, and strategy — scored so you can see where you stand and what to fix first. A good one ends with a prioritized, costed roadmap you can take to your board. Not a jargon report that sits in a drawer.
Key takeaways
- An audit isn't about spending more. Better-targeted spend often matters as much as a bigger budget.
- A real audit covers six areas, not just your website — and this piece hands each one to a guide that goes deeper.
- A low score is usually your fastest opportunity — except security, backups, and donor-data gaps, which are liabilities to treat as urgent.
- Be wary of an audit that steers you to software the auditor profits from. The test is whether they stay neutral about tools. Nobody's neutral about selling the audit itself, including me.
1. What an audit is — and why bother
It's a structured look at how you use technology to advance your mission. For most nonprofits the fastest gains come from spending what you already have on the right things, and an audit finds those things before you commit staff time or dollars. (More money is rarely the fastest fix; Digital Strategy on a Budget makes that case in full.)
An audit turns "we should probably do something about digital" into a short, ranked list of what to do first.
2. The six areas a real audit covers
An audit needs a fixed set of areas so your score means the same thing year over year, and whether you self-assess or hire out. These are ours — each links to a guide that goes deeper than this page should.
- Website & foundations — fast, mobile, accessible, editable by your own team. Depth, including the ADA/WCAG angle, lives in the Website Checklist — and you can scan your own site free with the Accessibility Check.
- Digital communications — email and social that are planned and consistent, reaching supporters where they already are.
- Data & measurement — impact and donor reporting on demand, from one source you trust.
- Tech capacity & systems — a clear tech owner, integrated tools, and security, backups, and donor data actually handled. (The one area where a low score isn't good news — more below.)
- AI readiness — using AI on purpose, with a simple written policy. We keep this light here; the AI Policy Template has a one-pager to get you started.
- Strategy & alignment — a written plan, tied to your mission, that leadership and board actually agree on.
(These are the six the free Readiness Scorecard scores — a mini-audit you can run yourself in minutes.)
If accessibility keeps scoring low, it's rarely a rebuild. The fixed-scope Accessibility Trust Review audits your site against WCAG 2.1 AA / 2.2, hands you a prioritized, developer-ready fix list, and can remediate the highest-risk issues — the defensible paper trail if a demand letter ever lands. See the Accessibility Trust Review →
3. What you walk away with
- Findings — plain-language what's working and what isn't.
- A scorecard — where you stand in each area, on a fixed scale so it's comparable year over year.
- A prioritized, costed roadmap — what to do, in what order, at what cost, matched to your budget.
- A board-ready presentation — an honest assessment your leadership can stand behind because it's honest, not a fundraising pitch dressed up as diligence.
If an audit gives you findings but no prioritized plan, you bought a problem statement, not a solution.
4. How to read your scorecard
Here's the actual mechanic. We score each of the six areas from 0 to 5:
- 0–2 — act this quarter. A real gap holding you back. Your roadmap starts here.
- 3 — functional but fragile. It works, but it'll break under growth or turnover. Shore it up when you can.
- 4–5 — strong. Maintain. Don't spend new money here; protect what's working.
A worked example — made up, but typical. Say an org scores 1 on Data & measurement: board reporting eats two days a quarter, pulling numbers by hand from three spreadsheets. The finding usually isn't "buy a $30k CRM." It's "these three spreadsheets should be one." Consolidate into a single sheet you already own, and the next board report takes ten minutes. New spend: zero. That's what a low score is for — it points at the cheapest high-impact fix first.
One caution, because a blanket "low is good" would be dishonest: in Tech capacity — security, backups, donor-data handling — a low score is a liability, not an opportunity. Treat those gaps as urgent, and don't drop documented security weaknesses into a slide deck that circulates to funders.
Otherwise, don't panic at a low number. Treat it as a baseline to beat next year.
5. Who actually does the work?
The most common fear I hear: "I'll get a beautiful list I still can't act on." Fair. A good roadmap is written so you can do the low-effort items yourself, hand others to a freelancer with clear specs, or grant-fund the big ones. Which is which is its own question — Choosing Help — DIY, Freelancer, or Agency walks through it. If your budget is genuinely near zero, the Digital Divide essay is a more honest starting point than any sales page, including mine.
6. How it's run, and my conflict of interest
How it works. An audit means inspection rather than guesswork; that's what separates it from the free self-assessment. We take read-only access to your analytics, CRM, and website, plus one short staff interview. We sign a confidentiality agreement and don't feed your donor data into third-party AI tools. Gathering access — orphaned logins, a departed staffer's old Gmail — is usually the slowest part, so budget a little patience.
My conflict. "Vendor-neutral" doesn't mean I don't sell the audit — I do. It means the audit never steers you toward software I profit from. I take no referral fees and resell nobody's CRM. If a free tool only ever concludes you should pay its maker, that's the trap this article is warning you about, and I'd rather lose your business than be it.
7. Red flags: how to spot a bad audit
- Steers you to the auditor's own software — or tools they get paid to resell. A sales process in a lab coat.
- The auditor also sells the fix and won't say so. If they do the implementation too, ask them to name the guardrail out loud.
- A free tool that only ever concludes you should pay. No honest audit can rule out "you're fine."
- Jargon only the author understands. Can't present it, can't decide on it.
- No prioritization — 40 problems, no order, is anxiety on paper.
- No costs — a plan you can't budget isn't a plan.
- Ignores your real constraints — recommends a $30k CRM to an org with a $5k tech budget.
FAQ
How long does it take? About 30 days end to end, plus a few hours of your team's time and the access-gathering above. Self-assessment: minutes.
How much should it cost? The self-assessment is free. A full board-ready engagement is a flat fee agreed up front — no hourly surprises. See the Digital Clarity page for current pricing; that's the source of truth, not this article.
Do we need to be technical? No. The whole point is that a non-technical leader can decide confidently.
Who should be involved? Your ED, plus whoever touches the website, data, and communications.
Take the free Scorecard first. It scores you on the same six areas in minutes, and for a lot of orgs it's all you need. If it turns up gaps you'd rather hand to an outside eye with a board-ready output, Digital Clarity delivers the four things in Section 3 within 30 days, yours to keep. And if you score well across the board, don't hire anyone. Go do the mission.
Author: Weston Cox — founder of MissionAssist, a decade in nonprofit digital, Portland, OR. I also run a small build studio, Tomorrow Labs; a MissionAssist audit roadmap never routes work to it by default, and if implementation ever comes up I'll say so plainly — the roadmap is yours to take anywhere.