Days 1–30: listen and map; change almost nothing. I will meet everyone individually in the first fortnight — the engineer first and longest, then the center coordinators, the head, and the treasurer — asking the same four questions of each: what are you working on, what is the most frustrating part of your week, what would you fix first, and who else should I talk to? By day 21 I will produce the three-list map of the estate: machines (every server, database and service, and which of the three centers and the website each serves), labels (what is tagged with an owner and a purpose — I expect much of it is not, and untagged spend is my first suspect for the surprise bill), and money (last six months of invoices, broken down until the doubling has a name). Two changes I will make immediately, because they are protective rather than reorganising: budget alerts at sensible thresholds with the treasurer and me as recipients — this organization must never again learn about spend from the invoice — and a request, made as a question, for a backup restore test of the student database, booked with a date. Everything else waits until I can tell which oddities are problems and which are load-bearing.

Days 31–60: find the real risks, by asking. The reliability sweep: when did we last restore a backup (now answered), what are the RTO and RPO for the student database and the website, and who signed off on them? If the answer is a shrug, I will convene the hour in which we decide — those two numbers are business decisions, so they are mine to insist on, with the engineer costing the options. The security sweep: who has access to production, is MFA on every account without exception, and would we know if something unusual happened? I expect the honest answers to center on one person, which brings me to the risk I will name in writing to the board: our engineer is a single point of failure — every credential, every piece of knowledge, one phone. The bridge is documentation and shared access this quarter; the fix is a resourcing decision I will bring costed in month three — a second engineer, part-time or shared with a sister organization if the budget cannot carry a full hire. The compliance question also lands this month, and the frame is Thai law first: under the PDPA, what personal data do we hold on our 2,000 students, under what stated purpose, could we delete one student completely on request, and could we tell the PDPC within 72 hours what a breach had taken? For records that include documentation status, these questions are not paperwork; they are the difference between an incident and a catastrophe for the families involved.

Days 61–90: deliver one visible thing, and answer the board honestly. My quick win, chosen because it is visible, valuable and deliverable without adding to the engineer's load: fix the bill and fix the nights — the untagged and orphaned spend found in month one gets deleted or tagged, which on the industry's numbers should claw back a meaningful slice of the doubling, and the noisiest useless alerts come off the engineer's phone. Both are things I can drive myself with a few hours of the engineer's confirmation. I will also start the decision rhythm if I have not already: a weekly thirty-minute review of spend, incidents and decisions, and a one-page decision doc for anything irreversible. Then the board's AI question, answered with the three questions rather than enthusiasm. What does a wrong answer cost? In tutoring, a correction — tolerable. What data leaves us? Nothing may: no pilot sends student names, histories or status to any API, full stop — that is a PDPA obligation before it is a preference. What does it cost at ten times the users? A per-token API pilot for one subject at one center should cost tens of dollars a month, and I will report the number, not an estimate of the number. No fine-tuning, no rented GPUs — at our scale the API is the only defensible answer, and an idle GPU is the most expensive idleness a charity can buy.

Day 90, to the board, in unit terms. What we own and what it costs per student per month; what the bill-doubling was and what it is now; the two risks I found, one fixed (tested backups, tripwired budget) and one costed for decision (the second pair of hands); our PDPA position in three sentences; and one small, honestly-priced AI pilot with its exit criteria. Then the habits continue: the restore test quarterly, the spend review weekly, the questions asked warmly and on a schedule rather than after a scare. That is the whole job on one page — translation, questions, and sequence.