Operations
Part of Small business CRM operations: owned records, safe launch
CRM quality checks on records, permissions, workflow and recovery before launch
Use this evidence-led CRM quality checklist to examine records, permissions, workflow, accessibility, resilience and exit before an England launch.
Use this small business CRM quality checklist as an evidence request. A pass needs scope, tester, date, input, observed result and defect owner. Configured is not enough.
Method: Relationship Brief assembled the checks on 6 September 2026 from the cited ICO, NCSC and W3C material. The scope is an ordinary small-business CRM service operated in England. The checklist excludes sector-specific records, legal conclusions, supplier performance and product certification. It is non-ranked, was not tested on a CRM and carries no supplier funding or affiliate relationship.
What to take away
- A pass needs scope, tester, date, input, observed result and defect owner, not just a configured setting.
- Each check should include one normal fixture and one failure fixture to test recovery.
- Automated accessibility findings alone cannot determine conformity and need human review.
- Hold launch if a non-compensating gate lacks evidence, and record the decision.
- The useful result is a defect register and accountable decision, not a high checklist score.
Purpose and record evidence
- The service owner has named each relationship purpose and eligible population.
- Intake retains source, collection date, original identifier and notice version.
- Unknown origin or purpose sends a record to a restricted queue.
- Retention, review and deletion triggers are defined by record class.
- The processing record identifies actual activities and has a maintenance owner.
The ICO's records-of-processing audit framework links processing records to operational policies and asks that responsibility for accuracy be assigned. It does not establish the correct purpose or retention period for a particular buyer.
Record evidence and purpose
- Name each relationship purpose and population
- Retain source, date, identifier, notice version
- Send unknown origin to restricted queue
- Define retention, review and deletion triggers
- Assign maintenance owner to processing record
Identity, permission and outreach
- Possible duplicates go to a human decision where matching is uncertain.
- A merge retains the old identifiers, approver and reversal route.
- Requested replies, service messages, research and promotion have separate classifications.
- Direct-marketing evidence is specific to recipient type and channel.
- Objections and suppressions propagate to every relevant sending route.
- The operator can stop a send when evidence is missing or disputed.
The ICO's electronic-mail marketing guidance describes the UK PECR framework for email and similar messages. A CRM flag cannot replace the required fact-specific assessment. Keep the page's status and any post-DUAA updates under publication-day review.
Workflow and change control
- Every state has an entry event, required evidence, owner and exit event.
- Waiting work records what is awaited and when it must be reconsidered.
- Automations have a version, approver, synthetic test and stop control.
- Configuration changes preserve the previous state and rollback instructions.
- Failed integration records create visible work rather than silent loss.
For each test, include one normal fixture and one failure fixture. A perfect-path demonstration cannot reveal whether the team can recover from a duplicate, objection or unavailable connection.
Security and supplier boundaries
- Privileged roles are limited and reviewed against current duties.
- The organisation and supplier security duties are mapped separately.
- Logging and alerts cover access and changes that matter to this service.
- An incident route preserves facts and reaches the qualified response lead.
- Export, restoration and reconciliation have been demonstrated.
The NCSC's cloud shared-responsibility guidance is the basis for checking allocation rather than assuming a hosted provider owns every control. The precise boundary depends on the service and contract.
Accessibility and usable recovery
- Critical tasks are operable with keyboard and relevant assistive technology.
- Labels, instructions, errors and recovery steps are understandable.
- Automated findings are reviewed by someone with suitable expertise.
- Disabled users are involved where the evaluation plan requires their experience.
W3C's evaluation overview states that no automated tool alone can determine accessibility and points to knowledgeable human evaluation. Record what was actually assessed; do not turn a limited check into a service-wide conformity claim.
Contract, continuity and approval
- The actual controller and processor roles have been reviewed, not assumed from labels.
- Instructions, sub-processors, security assistance, audit, return and deletion are evidenced.
- Privacy, PECR, security, accessibility and commercial gates each have a named decision maker.
- Material defects have owners, deadlines and a documented launch consequence.
The ICO's controller and processor contract guidance is under review after the 2025 Act and needs current qualified interpretation. Hold launch if a non-compensating gate lacks evidence. The useful result is a defect register and an accountable decision, not a high checklist score.
Before you act
- Name each relationship purpose and eligible population.
- Send unknown origin or purpose records to a restricted queue.
- Give every workflow state an owner and exit event.
- Map organisation and supplier security duties separately.
- Review actual controller and processor roles, not labels.
- Hold launch if a non-compensating gate lacks evidence.
Common questions
What evidence does a checklist pass require?
A pass needs scope, tester, date, input, observed result and defect owner. The article states that configured is not enough. Each test should also include one normal fixture and one failure fixture, because a perfect-path demonstration cannot reveal whether the team can recover from a duplicate, objection or unavailable connection.
Can a CRM flag prove direct-marketing consent?
No. The article says a CRM flag cannot replace the required fact-specific assessment under the UK PECR framework for email and similar messages. Direct-marketing evidence must be specific to recipient type and channel, and objections and suppressions must propagate to every relevant sending route.
What should happen if a launch gate lacks evidence?
Hold launch if a non-compensating gate lacks evidence. Privacy, PECR, security, accessibility and commercial gates each need a named decision maker, and material defects need owners, deadlines and a documented launch consequence. The useful result is a defect register and an accountable decision, not a high checklist score.
