Small business CRM ninety day plan: six workflow gates

A small business CRM ninety day plan can produce a defensible decision about one defined workflow. It divides that fit assessment into six 15-day phases, each with an output and an exit condition. This is a planning method for a UK small business, not an industry norm or a promise of results.

Use the schedule to assess whether CRM software fits the selected workflow, not to develop a business-wide CRM strategy or launch a system. It makes no assumptions about suppliers, prices, results or product capabilities; legal, privacy, security, accessibility, commercial, finance and tax questions still need qualified review.

What to take away

Days 1 to 15: bound the problem

Choose one relationship event, such as an enquiry moving from receipt to an accountable owner. The process owner supplies authorised cases and exceptions for that event. The decision owner states the eligible population, relevant UK nation or nations, observation period and exclusions. A data reviewer checks necessity and minimisation.

Output: a signed problem statement, current-state map and evidence ledger. Exit only when observed records are distinguishable from assumptions. Worked ledger entry example, fictitious: case 014; enquiry received 2 October 2026; owner assigned 3 October 2026; source web form; evidence email timestamp; status verified.

Days 16 to 30: define the operating rule

For this workflow, map each hand-off with its input, decision, state, owner, completion evidence and recovery. Separate requested information, service messages, research and direct marketing where they apply. Record access, correction, suppression, retention and deletion requirements that affect the mapped work.

For a CRM workflow, identify which contact or company records are needed and how the work moves between people. For example, test whether enquiry records can be assigned an owner, moved through agreed pipeline stages, given a follow-up reminder and linked to email or reports where needed. Treat these as requirements only if the mapped work needs them.

The ICO says in its data protection by design guidance that safeguards should be integrated at the outset and throughout processing. Use it to set design questions on fields, permissions and retention, and record why each is necessary. It does not decide lawful basis or certify the plan.

UK GDPR and ICO guidance set the data-protection baseline for UK firms. A small-business controller should check whether it owes the ICO data protection fee, and whether an exemption applies, under the Data Protection (Charges and Information) Regulations 2018. Contract terms and VAT treatment are separate checks for legal and finance reviewers; ask HMRC about VAT treatment, including the current VAT registration threshold and whether quoted costs include VAT.

Output: a versioned workflow and data map for the selected event. Exit when specialist reviewers have stated any critical conditions for that workflow. If a critical condition is not met, the decision remains on hold.

Days 31 to 45: appraise routes

Compare manual repair, current-service configuration, procurement and stopping against the requirements in the versioned map, using identical criteria: workflow fit, evidence, internal work, whole-life cost, privacy role, security, accessibility, support, integration and exit. Record which requirements each route can and cannot meet.

Check only the CRM capabilities required by the mapped workflow: contact records, pipeline stages, task reminders, email synchronisation and reporting where needed. Confirm whether each is available in the candidate configuration and whether the team can use it as intended; a feature list alone does not establish fit.

Finance records currency, VAT treatment, period, units, confidence and exclusions without invented amounts. For example, a cost-basis entry might read: currency GBP; VAT excluded; 36 months; per named user; 25 users; amount left blank until a dated quote arrives. If a supplier enters the comparison, record its edition and evidence date.

A demonstration may inform the appraisal, but it does not show that a route meets the firm's mapped workflow requirements.

Output: an options table with unknowns visible. Exit when one route is testable and rejected routes remain recorded.

Days 46 to 60: test with synthetic fixtures

Create fictitious records for the exceptions identified in the map, such as duplicate identifiers, correction, suppression, access changes, failed integration, export and recovery. For each relevant test, record inputs, expected and actual results, and reproducible evidence; rehearse loss of an account or dependency where it could interrupt the selected workflow.

During this phase, use the NCSC's cloud security guidance for choosing a provider to frame service-architecture and shared-responsibility questions relevant to the candidate route. Require written answers and log unresolved points against the decision; the guidance gives no assurance about an unassessed CRM.

Output: test results and an unresolved-defect log. Exit after critical failures are fixed and retested.

Days 61 to 75: run a controlled live check

Proceed only with a recorded data purpose, population and approvals for the selected workflow. Use the smallest suitable group and retain manual recovery. Before viewing results, define population, numerator, denominator, period, timezone, source version, exclusions, owner and uncertainty. This is a controlled fit check, not a wider system launch.

Accessibility testing covers the real task, including keyboard operation, zoom, labels, error recovery and exported material. W3C accessibility standards are a technical reference, not evidence that the configured workflow passes.

Output: operational evidence, incidents, complaints and exceptions reconciled to the controlled check. Exit when records balance to the authorised input and the manual recovery route works.

Days 76 to 90: decide and assign follow-up

Use HM Treasury's Magenta Book, which recommends planning evaluation early and checking both whether an intervention was delivered as intended and what changed. For this workflow decision, apply that distinction before the controlled check; its public-sector context provides no CRM benchmark.

Choose proceed, revise, extend or stop for the defined workflow. Record the alternatives, cost basis, gaps, approvals, recovery owner and expiry. If the evidence shows only that the workflow ran, do not infer revenue or causal impact.

Set review triggers for a change that could alter this workflow decision: a new purpose, channel, population, integration, supplier term, incident, failed export or material metric shift. Pause rather than proceed if access control, suppression, export, recovery, approved purpose or reproducible evidence cannot be shown; also pause after unexplained loss, duplication or contact contrary to suppression. The ninety-day output is a controlled fit decision and a reusable evidence pack, not a declaration that a CRM project has succeeded.

Common questions

What counts as the output of the ninety day plan?

The output is a reusable evidence pack and a documented fit decision for one workflow, not a declaration that the CRM project has succeeded.

When should a route be stopped during testing?

Pause when a phase's exit condition is not met; do not proceed solely because the scheduled days have elapsed. The final review also applies the pause conditions for the selected workflow listed in the last phase.

How should cost and supplier evidence be recorded?

Finance records currency, VAT treatment, period, units, confidence and exclusions without invented amounts. If a supplier enters the comparison, record its edition and evidence date. A demonstration does not replace the firm's own test against the mapped workflow, and rejected routes remain recorded.