Leadership Experience Case Study
A school can have clear ownership of its buildings, buses, laboratories and bank accounts while remaining surprisingly unclear about who controls its digital identity.
During one school-group advisory assignment, a series of routine tasks gradually revealed a wider governance problem. Different online profiles existed for the same institution. Legacy social-media accounts were still visible. Administrator access to digital platforms was not always held institutionally. In one instance, documents that had been created for school use were discovered to have had their ownership changed after editor access had been granted.
None of these issues, considered separately, looked like a major school-leadership problem. Taken together, they showed something more serious: the institution did not yet have a sufficiently clear digital-ownership system.
Digital Assets Are Institutional Assets
School leaders often treat websites, email accounts, social-media profiles, cloud files and platform logins as technical matters. They are governance matters.
A school’s digital estate may include:
- domains and website hosting;
- Google or Microsoft administrator accounts;
- staff email accounts;
- Google Business or map listings;
- Facebook, Instagram, LinkedIn and YouTube accounts;
- cloud drives and shared folders;
- student-information and ERP platforms;
- vendor dashboards;
- digital learning platforms;
- security, network and device-management credentials.
If control of these assets depends on one employee, agency or former vendor, the school has created an institutional vulnerability.
The Warning Signs
Several warning signs appeared during the review. Duplicate public profiles made it harder to manage reviews and created confusion about which listing represented the institution. Older social accounts still carried outdated information. Access to some systems had passed through different individuals over time. The discovery that document ownership could move away from the school highlighted an even broader issue: access had been given without a clearly enforced rule about institutional ownership.
The leadership question therefore changed from “Who knows the password?” to:
Can the institution prove that it controls its digital identity, data and administrator rights regardless of who currently works here?
Reclaiming Control Without Creating Chaos
The response was not to change every account impulsively. A safer approach is to create a digital asset register and work through it systematically.
For each important digital asset, leadership should be able to record:
- the platform or service;
- the institutional owner;
- the primary administrator account;
- the recovery email and recovery phone controlled by the organisation;
- who currently has administrator or editor access;
- which vendor, employee or former employee created the account;
- where recovery information is securely stored;
- the date access was last reviewed.
Personal Access and Institutional Ownership Are Not the Same
Employees naturally need access to do their work. A marketing employee may need social-media access. An IT administrator may need workspace privileges. A consultant may need editor rights to documents. A web agency may need access to hosting.
The governance principle is that operational access may be delegated, but institutional ownership should remain with the institution.
This means the master administrator should normally be created under an organisation-controlled identity. Recovery mechanisms should not depend solely on a personal number or personal email. When someone leaves, access should be reviewed immediately rather than months later when a problem is discovered.
A Practical Digital Governance Checklist
- Inventory: list every important digital account and platform.
- Verify ownership: confirm that the organisation—not an individual—controls the primary account.
- Review administrators: remove access that is no longer required.
- Secure recovery: use institution-controlled recovery methods.
- Remove duplication: merge, close or clearly retire duplicate public profiles where possible.
- Control document ownership: ensure important institutional files sit inside school-controlled storage.
- Create an exit protocol: staff and vendor off-boarding should include digital access removal.
- Review periodically: digital governance should be audited, not assumed.
The Leadership Learning
The experience reinforced a simple principle: a school should never discover who controls an important digital asset only when access is lost.
Digital governance is not about mistrusting staff or vendors. It is about designing continuity beyond individuals. The same institutional discipline applied to finance, safeguarding and physical assets should apply to domains, cloud data, social profiles and administrator rights.
Modern school leadership therefore needs one additional question in every governance review:
If the people currently managing our digital systems disappeared tomorrow, would the institution still remain in control?