Implementing a grant management tool with named ownership and a working fallback

Implement a grant tool around a controlled workflow. Configure ownership, access, data, approvals and exports before moving live applications or evidence. Keep a fallback until the team has tested the full cycle.

What to take away

• Name a business owner, system administrator and information owner before moving live applications.
• Keep a fallback until the team has tested the full cycle, as a tool outage does not excuse a late application.
• Test permissions with ordinary accounts and confirm former partners lose access at the correct point.
• Treat form, formula, permission, integration and retention changes as controlled releases with recorded approval.
• After the first application, claim and report, fix errors and configuration before adding more projects.

Set ownership and scope

Name a business owner for the process, a system administrator and an information owner. Define which grants, users, data and tasks enter the first release. Leave optional integrations until the basic record works.

Write success measures such as fewer version conflicts, complete evidence links, faster review or successful exports. Capture the starting position so improvement can be measured.

Configure the workflow

Create stages for research, screening, decision, drafting, approval, submission, award, claim and close. Add owners, deadlines and evidence requirements. Preserve an unsuitable status with a reason instead of deleting rejected opportunities.

Where a funder requires its own portal, treat that as the submission record. UKRI's Innovate UK guidance states that relevant applications must use the Innovation Funding Service. Store the acknowledgement and submitted copy internally.

Apply permissions

Give access by role and project. Restrict bank details, payroll, personal data and commercially sensitive material. Remove shared administrator accounts and require strong authentication.

The NCSC small organisations guide covers account protection, devices, backups and incident preparation. The ICO guidance hub provides current UK data-protection guidance.

Test permissions with ordinary accounts. Confirm that former partners and suppliers lose access at the correct point.

Migrate controlled data

Inventory existing files, owners, versions and retention needs. Remove duplicate and obsolete material through an approved process. Map each source field to the new location and keep a migration log.

Validate record counts, key totals, attachments and dates after import. Have finance reconcile project figures independently. Do not destroy the authorised source until acceptance and retention decisions are complete.

Test real scenarios

Run a long application answer, changed budget, confidential attachment, partner review, approved variation, supplier invoice, claim export and restored backup. Record expected and actual results.

The Cabinet Office Model Grant Funding Agreement illustrates evidence and reporting provisions that can supply realistic test cases. Use the actual award for production acceptance.

Train and release

Train users by role on the live process, including correction and incident routes. Publish short instructions for naming, status, approval and export. Give support an owner and response target.

Move one suitable project first where risk permits. Keep a deadline fallback with authorised files, contacts and submission instructions. A tool outage does not usually excuse a late application.

Control configuration changes

Treat form, formula, permission, integration and retention changes as controlled releases. Record the request, reason, testing, approval and deployment date. Notify users when a change alters their work or a reported figure.

Keep separate test and live environments where the product and risk justify them. Do not experiment with a live claim or overwrite an issued report. After release, reconcile a known set of records and watch for failed imports, changed totals or lost access.

Prepare for incidents

Define how users report lost access, suspicious messages, misdirected files and incorrect data. Name the person who assesses business, data-protection, contractual and grant-reporting consequences. Keep supplier and funder contact routes available outside the tool.

Run a short exercise before a major deadline. Confirm that the team can recover authorised files, identify the last valid version and continue the submission or claim process safely.

Review and exit

After the first application, claim and report, check errors, duplicated entry, access exceptions, support and user effort. Fix the process or configuration before adding more projects.

Test a complete export and deletion route before renewal. Record contract notice dates and data ownership. This draft contains no live internal links and needs security, privacy and agreement-specific review before publication.

Before you act

• Name business owner, system administrator and information owner.
• Define which grants, users, data and tasks enter first release.
• Create workflow stages with owners, deadlines and evidence requirements.
• Test permissions with ordinary accounts and remove shared admin accounts.
• Run real scenarios including long answer, changed budget and restored backup.
• Keep a deadline fallback with authorised files and submission instructions.

Common questions

What should be configured before moving live applications or evidence?

Configure ownership, access, data, approvals and exports before moving live applications or evidence. Name a business owner, system administrator and information owner. Define which grants, users, data and tasks enter the first release. Leave optional integrations until the basic record works.

How should permissions be applied and tested?

Give access by role and project. Restrict bank details, payroll, personal data and commercially sensitive material. Remove shared administrator accounts and require strong authentication. Test permissions with ordinary accounts. Confirm that former partners and suppliers lose access at the correct point.

What should happen after the first application, claim and report?

Check errors, duplicated entry, access exceptions, support and user effort. Fix the process or configuration before adding more projects. Test a complete export and deletion route before renewal. Record contract notice dates and data ownership.