Field notes on data
and grant readiness.

Most organisations assume they lose grants because their proposal writing is weak, or because competition is fierce, or because the funder simply chose someone else. Sometimes that is true. More often, the organisation was disqualified before a human being ever read the technical proposal, quietly, automatically, at the administrative eligibility stage.

Funders like GIZ and FCDO run checklists before anything else happens. Does the organisation have a valid SCUML certificate. Does it have three years of externally audited accounts. Does it require two signatories on every financial transaction, the Four-Eye Principle, rather than relying on one person's approval. Miss any of these and the application is set aside, no explanation given, no feedback offered. The organisation walks away believing its proposal was not strong enough, when the proposal was never actually assessed at all.

This is why we built the Grant Compass around these specific checks rather than generic advice. A SCUML certificate is a legal requirement for every Nigerian NGO, not an optional credential, and international funders check for it directly. Audited accounts matter less for the number they show and more for the fact that an external ICAN or ACCA-qualified auditor was willing to put their name behind your organisation's finances. The Four-Eye Principle tells a funder that money cannot move without two people agreeing, which is exactly the kind of control that prevents the fund mismanagement stories every funder has heard before.

None of these fixes happen overnight. But they are fixable, in a way that "write a more compelling proposal" is not. Start with whichever one your organisation is missing. It is very likely the reason behind more than one rejection you never got an explanation for.

A surprising number of proposals use "Theory of Change" and "M&E framework" as though they mean the same document. They do not, and a reviewer who has sat through enough due diligence sessions will notice the substitution within the first page.

A Theory of Change explains the logic of why your programme should work. If we do X, under these assumptions, then Y should follow, leading eventually to Z. It is a narrative and a diagram. It belongs at the start of a proposal, setting up the case for the intervention.

An M&E framework is a different animal entirely. It is the operational plan for proving whether the Theory of Change actually held true in practice. It names specific indicators, defines exactly how each one will be measured, states the frequency of data collection, and assigns responsibility for who collects it. Where the Theory of Change tells a funder what you believe, the M&E framework tells them how you will know if you were right.

The organisations that struggle here usually have one without the other. A beautiful Theory of Change with no indicator table behind it. Or a spreadsheet of indicators with no underlying logic connecting them to anything. Funders read both documents specifically to see whether they talk to each other, whether the indicators in the M&E framework actually measure the assumptions named in the Theory of Change. If your baseline survey does not capture the data your logframe claims to track, that gap shows up immediately to anyone who has reviewed enough of these to know what to look for.

If your organisation only has one of the two documents right now, that is the more useful thing to build next, not a longer proposal.

Ask ten Nigerian NGOs about their data protection compliance and most will mention NDPR. Some will say they are working toward it. A few will say a funder specifically asked about it during due diligence. Almost none of them will know that the law they are referencing stopped applying in September 2025.

The Nigeria Data Protection Regulation was replaced by the Nigeria Data Protection Act 2023, and more specifically by its General Application and Implementation Directive, which took effect on 19 September 2025. This was not a rebrand. The NDPA created the Nigeria Data Protection Commission as an independent enforcement body with real investigative and penalty powers, something the old framework never had. The GAID then turned the Act's broad principles into specific, checkable obligations. Organisations are no longer working toward vague guidance. They are working toward a compliance framework with deadlines, registration requirements, and named consequences for falling short.

Most of the coverage of this shift has focused on banks, insurance companies, and fintechs, and for good reason. In September 2025 the Commission issued compliance notices to 1,368 organisations, the majority of them financial institutions. But the Act applies to any organisation that determines how personal data is processed, and a development organisation collecting household survey data, health indicators, protection case data, or beneficiary registration details is doing exactly that. In some respects the exposure is higher, not lower. The data NGOs collect is often more sensitive than a bank transaction record, and it frequently concerns people with the least power to raise a complaint if it is mishandled.

The consequences are not abstract. Non-compliance can mean fines of up to 2 percent of annual gross revenue or ₦10 million, whichever is greater, and public listing on the Commission's non-compliance register. For an organisation applying for international funding, that second consequence matters more than the first. A funder doing due diligence does not need to ask whether you are compliant if your organisation's name is already sitting on a public list that answers the question for them.

It is worth checking whether your own data protection policy, your proposal boilerplate, and your standard responses to funder due diligence questions still say NDPR. A surprising number of organisations, and the tools built to assess them, have not caught up to the change yet. The ones that update first are the ones a sharp-eyed funder notices for the right reason.

Most survey failures do not happen because the questionnaire was badly designed. They happen because nobody checked the phones. Since 2026, new releases of KoboCollect, the mobile app most Nigerian field teams use for KoboToolbox surveys, require Android 8.0 or higher. Devices running Android 5.1 through 7.1.2 stop receiving app updates entirely. If your enumerators are using older, budget Android devices, which is common on a tight field budget, this is not a hypothetical risk. It is a scheduling problem waiting to happen.

Here is where it actually bites. A team pilots a form on a handful of newer phones weeks before deployment, everything works, and nobody thinks to check the actual devices the full enumerator team will carry. Two weeks later, half the team is issued older tablets pulled from storage, the app will not update, and someone is troubleshooting in the field instead of collecting data. The fix costs nothing if it happens before deployment. It costs a day of lost fieldwork if it happens after.

This is one small example of a broader habit worth building into every digital data collection plan: audit the actual hardware before you audit the form. Check the Android version on every device that will be used, not just the ones available during design. Confirm offline storage capacity if the survey includes photos, GPS, or audio. Test the app update process on a device that has been offline for a week, since that is exactly the condition many field devices will be in.

None of this is exciting work, and that is exactly why it gets skipped. A well-built questionnaire with skip logic, validation rules, and multi-language support can still fail in the field for reasons that have nothing to do with the form itself. The form design gets the attention. The device fleet rarely does, right up until it is the reason a deployment loses a day.