Strategy
Part of A small business CRM strategy for 2027, defined around the work
Completing a CRM planning template, from decision header to acceptance tests
Complete a CRM planning template for an England-based small business, covering workflow, evidence, controls, costs, testing, recovery and approval.
This small business CRM planning template turns an idea into an auditable decision. Leave a field blank when evidence is unavailable. A blank critical field means the plan remains on hold; it is not an invitation to insert an industry average.
The template was prepared on 5 September 2026 for an organisation operating in England. It contains no supplier price, performance benchmark or assumed legal conclusion. UK legal and regulatory questions, plus security, accessibility, tax, finance and contract interpretations, need named qualified reviewers.
What to take away
- Treat the decision date as fixed, because an open review invites scope creep.
- Write the exclusion list before the first supplier meeting, so out-of-scope channels stay out.
- Ask for a written export and deletion commitment rather than a verbal assurance.
- Put a number on the baselinerecord count, period and query version.
- Retire each acceptance test at its expiry date, or re-run it.
Decision header
Field / Entry
- Decision to be made
- [retain, repair, configure, procure or stop]
- Accountable owner
- [name and authority]
- Decision date
- [date]
- Relationship event
- [one observable event]
- Eligible population
- [who or what can enter the measure]
- England rule
- [business, team, customer or event location]
- Current arrangement
- [people, records, tools and rules]
- Evidence period
- [start, end and timezone]
- Explicit exclusions
- [populations, channels and processes outside scope]
Worked example of the same header:
Field / Worked example
- Decision to be made
- Replace the shared inbox tracker with a per seat sales CRM
- Accountable owner
- Sales operations manager, with authority to stop the route
- Decision date
- 12 October 2026
- Relationship event
- Two renewals lost where no contact record existed
- Eligible population
- 24 sales users in the England sales team
- Evidence period
- 1 January 2026 to 30 June 2026, Europe/London
- Explicit exclusions
- The Northern Ireland support desk and the partner portal
Attach two or more authorised recent cases. Note selection method and missing records. The plan should describe the work as it occurs, not an ideal diagram.
Decision Header Fields
- Decisionretain, repair, configure, procure, stop
- Accountable ownername and authority
- Relationship eventone observable event
- Eligible populationwho can enter
- England rulebusiness, team, customer, event
- Evidence periodstart, end, timezone
- Explicit exclusionspopulations, channels, processes
Problem and proposed mechanism
Observed problem: [fact, source, record owner and retrieval date]
Problem to Expected Chain
- Observed problem: fact, source, owner, date
- Proposed change: role, rule, record, tool
- Expected chain: change leads to effect
- Assumption: why the effect should occur
- Alternative explanations: other possible causes
- Evidence gaps: unknown mechanism, population, baseline
Proposed change: [specific alteration to a role, rule, record or tool]
Expected chain: [change] may lead to [operational effect] because [assumption].
Alternative explanations: [other changes that could affect the outcome]
Evidence gaps: [unknown mechanism, population or baseline]
Evaluation planning should begin before implementation so that suitable baseline and monitoring evidence can be retained. That principle appears in the 2026 Magenta Book, although the publication addresses government interventions rather than commercial CRM projects.
Workflow and data controls
For every hand-off, complete one row:
Hand-off Row Controls
Input and source
- Minimum data
- minimum permitted data
- Personal data
- purpose and lawful basis
- Marketing route
- channel and subscriber category
Owner
- Minimum data
- role
- Personal data
- retention
- Marketing route
- UK GDPR and PECR
Decision rule
- Minimum data
- versioned rule
- Personal data
- correction
- Marketing route
- rule version
New state and evidence
- Minimum data
- record, time, approver
- Personal data
- access and deletion
- Marketing route
- suppression behaviour
| Input and source | Owner | Decision rule | New state and evidence | Exception and recovery |
|---|---|---|---|---|
| [minimum permitted data] | [role] | [versioned rule] | [record, time and approver] | [queue, deadline and escalation] |
| Web enquiry form, hosted in England | Sales administrator | Create a contact only where a named person and a recorded basis for contact exist | Contact record created, timestamped and assigned to the England sales owner | Unassigned records queue for two working days, then escalate to the sales operations manager |
Add purpose, lawful-basis assessment, retention, correction, access and deletion references for any personal data. The ICO says data protection should be designed into processing from the outset. A reviewer must still decide what is necessary and lawful for the actual activity.
Keep requested information, service communication, genuine research and direct marketing in separate rows. Record the channel and subscriber category for any marketing route, together with the UK GDPR and PECR analyses, evidence, rule version and suppression behaviour.
These duties come from UK wide law, so they bind an England based organisation and any customer records it holds.
- ICOkeep a record of processing, a data protection impact assessment for high risk work, and a named lawful basis for each purpose.
- UK GDPRanswer subject access, correction, erasure and objection requests within one month.
- PECRhold consent or soft opt in evidence for email and text marketing, and apply suppression at the point of send.
- NCSCapply the Cyber Essentials controls for patching, access and malware protection, and request the supplier's shared responsibility statement.
Options and whole-life resources
Use the same columns for the manual baseline, current-service configuration, new procurement and stop or narrow route:
Whole-life Route Comparison
Manual baseline
- Required work
- discovery through closure
- Evidence confidence
- high, medium or low
- Critical gates
- pass, fail or unknown
- Whole-life cost basis
- currency, period, VAT, units
- Exit evidence
- export, deletion, continuity, owner
Current-service configuration
- Required work
- discovery through closure
- Evidence confidence
- high, medium or low
- Critical gates
- pass, fail or unknown
- Whole-life cost basis
- currency, period, VAT, units
- Exit evidence
- export, deletion, continuity, owner
New procurement
- Required work
- discovery through closure
- Evidence confidence
- high, medium or low
- Critical gates
- pass, fail or unknown
- Whole-life cost basis
- currency, period, VAT, units
- Exit evidence
- export, deletion, continuity, owner
Stop or narrow
- Required work
- discovery through closure
- Evidence confidence
- high, medium or low
- Critical gates
- pass, fail or unknown
- Whole-life cost basis
- currency, period, VAT, units
- Exit evidence
- export, deletion, continuity, owner
Required work
- [route]
- [discovery through closure]
- Configure the existing service (worked example)
- Discovery, data model changes, two integrations and role based training
Evidence confidence
- [route]
- [high, medium or low with reason]
- Configure the existing service (worked example)
- Medium, because one integration has no test environment
Critical gates
- [route]
- [pass, fail or unknown]
- Configure the existing service (worked example)
- Configuration and integration tests pass, and the export test passes before go-live
Whole-life cost basis
- [route]
- [currency, period, VAT treatment, units and exclusions]
- Configure the existing service (worked example)
- 36 month period, ex VAT, per seat subscription at the supplier's current published rate for the named edition, plus a one off implementation fee, excluding internal staff time
Exit evidence
- [route]
- [export, deletion, continuity and owner]
- Configure the existing service (worked example)
- Full contact and activity export by file and API, deletion confirmation and a named continuity owner
Do not compare a monthly licence with the full economic cost of another option. Include implementation, integrations, data cleaning, training, support, assurance, incidents, renewal and exit. Quote a supplier only from its current first-party record for the exact edition and term.
Supplier routes include a per seat subscription bought direct from a vendor such as HubSpot, Pipedrive or Zoho CRM, a module inside an accounting suite such as Sage, and an open source system with a paid support contract.
Whole-life cost categories, with what fixes each one:
- Licence or subscriptionseats, edition, term and indexation.
- Implementationdiscovery, data model changes, integration build and testing.
- Data workdeduplication, cleansing, migration rehearsal and reconciliation.
- Trainingrole based sessions, refresher training and champion time.
- Support and assuranceresponse targets, security review and penetration testing.
- Incidents and exitdowntime, rework, export, parallel running and termination.
Acceptance tests
| Test | Fixture | Expected result | Evidence | Failure action | Expiry |
|---|---|---|---|---|---|
| role and access | [synthetic accounts] | [least access needed] | [log or screenshot owner] | [disable and redesign] | [date] |
| duplicate and correction | [synthetic conflicting records] | [approved resolution] | [reconciliation record] | [hold migration] | [date] |
| suppression | [synthetic suppressed contact] | [no prohibited route executes] | [rule and log] | [stop sending] | [date] |
| export and recovery | [synthetic dataset] | [usable restored state] | [test record] | [reject or remediate] | [date] |
| duplicate and correction (worked example) | Two synthetic records for the same contact, one carrying a stale email address | The newer verified record survives and the stale address is suppressed | Merge log and the reconciliation report signed by the data owner | Reject the migration until the merge defect is fixed | 31 March 2027 |
| role and access (worked example) | Synthetic sales user, sales manager and support user accounts | Sales user sees only assigned accounts; manager sees team pipeline; support user has no export right | Access log from the CRM admin console, owner named as sales operations manager | Disable the account until the role is corrected | 30 June 2027 |
| export and recovery (worked example) | Synthetic dataset of 500 contacts and 1,200 activities | A full CSV export and an API export both restore into a clean test instance with row counts matching | Test record with file hash, row count and restore timestamp | Keep the current service running for one billing period and re-test before termination | 30 September 2027 |
Run the tests on a non-production copy of the chosen system, using synthetic records only. For a HubSpot, Pipedrive or Zoho CRM route, export a CSV and an API extract and compare row counts. A test with no named evidence owner stays open.
The NCSC's cloud provider selection guidance gives buyer-side questions about security and shared responsibility. Use it to request evidence, not to infer that a hosted product is safe.
Measure, decide and revisit
Define the measure: population [ ], numerator [ ], denominator [ ], unit [ ], period [ ], timezone [ ], source/query version [ ], exclusions [ ], uncertainty [ ], owner [ ].
Set the continuation threshold [ ], stop condition [ ], recovery action [ ] and authority to decide [ ]. List the date-based review and triggers such as a new purpose, channel, integration, contract, supplier dependency, incident or unexplained data shift.
Worked recovery rule: if duplicate rates exceed 5 percent in the first month, pause migration, restore the last verified export, and review the merge rule within 5 working days.
The approval block needs signatures from the accountable owner and every applicable specialist gate. If evidence is missing or a non-compensating gate fails, record the hold and the action needed to reopen the decision.
For a CRM decision in England, the approval gates are the accountable owner, data protection lead, security lead, finance lead and contract reviewer. Each signature line records role, name, date and evidence pack version. A gate without a named person is a hold.
A typical approval cycle is 5 to 9 working days, to be confirmed by the accountable owner.
Before you act
- Attach two or more authorised recent cases and note the selection method.
- Record purpose, lawful basis, retention, correction, access and deletion for personal data.
- Quote supplier prices only from current first-party records for the exact edition and term.
- Run acceptance tests with synthetic fixtures and name an evidence owner.
- Set continuation threshold, stop condition, recovery action and decision authority.
- Obtain signatures from the accountable owner and every applicable specialist gate.
Common questions
How should the options table treat costs across different routes?
Use the same columns for the manual baseline, current-service configuration, new procurement and stop or narrow route. Take the cost categories from the options section and apply the same period, currency, VAT treatment and exclusions to every route.
What should the acceptance tests cover before the plan proceeds?
Tests cover role and access, duplicate and correction, suppression, and export and recovery. Each test needs a fixture, expected result, evidence, failure action and expiry date. For example, a synthetic suppressed contact should show that no prohibited route executes, with the rule and log as evidence.
