Small business CRM software selection: test a workflow first

Begin small business CRM software selection with one troublesome relationship workflow, not a vendor shortlist. If the team cannot describe the work, its exceptions and its evidence, a feature grid will reward breadth rather than fitness. Fitness is what you pay for.

An England-based firm still deals with UK-wide data-protection and electronic-marketing rules. Product availability may be global, while the contract, tax treatment and support route may depend on the buying entity. Record those scopes instead of assuming an English office means English hosting or an English supplier.

What to take away

Write the job before seeing a demonstration

Choose a narrow event, such as turning an accepted enquiry into an owned sales opportunity. Describe the input, allowed states, mandatory fields, hand-offs and closure reason. Add awkward cases: a duplicate contact, an objection to marketing, a departing user, an integration failure and a request to export a complete record.

Keep the current spreadsheet or shared inbox as the baseline. Measure its actual omissions and rework for a defined period, such as one month. That reveals whether a new system addresses a costly problem or merely relocates it.

Use exclusion gates first

Some requirements should not be traded for a pleasant interface. Reject or pause a candidate if the buyer cannot establish any of the six gates in the table. Each gate has a question to put to every candidate and an evidence type that answers it.

Data protection by design means integrating data protection into your processing activities and business practices, from the design stage and throughout the lifecycle. Map purposes and fields before migration. A supplier label does not make a deployment lawful.

The position on data protection principles is under review after the Data (Use and Access) Act, so check the UK regulations again with a qualified UK privacy reviewer at publication and again before contract signature, because things may have moved.

Name the applicable rules in the evidence sheet: UK GDPR, Data Protection Act 2018 and Privacy and Electronic Communications Regulations (PECR), and consult relevant Information Commissioner’s Office (ICO) guidance. For any restricted international transfer, check whether the UK International Data Transfer Agreement (IDTA), the UK Addendum to the EU Standard Contractual Clauses or UK adequacy regulations provide the applicable route.

Ask every candidate the same questions

Create an evidence sheet with one row per requirement, building on the vendor due diligence method. Columns should cover the exact edition, evidence URL or contract clause, publication date, buyer test, result, unresolved question, owner and expiry date. Separate supplier-published material from contractual commitments and independent assurance.

Security evidence should reflect the harm from loss, corruption or outage. The method you use when choosing a cloud provider depends on how you plan to use the service and the sensitivity of the data you plan to put in it. A public security statement is therefore a lead for investigation, not a pass mark.

Where suppliers offer them, record the scope and date of ISO/IEC 27001 certification, a Cyber Essentials certificate or a SOC 2 report. These are different forms of assurance, not automatic proof that the CRM configuration fits your risks.

Accessibility needs task-based inspection too. Include knowledgeable human assessment, not only automated scans, and where proportionate involve users with relevant access needs. Record the tasks, the assistive technology used and the result, so the evidence can be repeated.

Use WCAG 2.2 AA as a reference for web content and check whether EN 301 549 is relevant to the service. Treat standards as a basis for testing, not a substitute for a task-based check of the actual product.

Example: one listed CRM price

Salesforce Starter Suite is one candidate, listed at £20 per user per month with transaction fees applying. This is a starting figure, not the full cost for your business.

The cost gate then needs a written quote for your seats, not the starting price. As illustrative arithmetic, five users at £20 give 5 x £20 = £100 per month before any add-ons or fees. Add set-up, migration, training and the exit cost, and record each row against the quote date.

Run a controlled proof before committing data

Use synthetic records that contain no personal data. Ask ordinary users, not only administrators, to complete the scripted workflow. Capture time, errors and recovery notes, but do not turn a tiny trial into a performance claim.

Test role changes, duplicate handling, a suppression update, an export and a failed integration, then check whether the export can be opened as CSV and includes the fields and history needed to reconstruct the record. Run the quality checks on the results. Record the product version and configuration of each candidate, so the result can be repeated.

Before approval, the commercial owner should read the commercial contracts guide and calculate the full term and likely exit cost from the actual quote. A privacy specialist should verify roles and transfers; security and accessibility specialists should judge their own evidence; an English commercial solicitor should review the agreement. These are separate decisions.

The final record should say pass, fail, unknown or not applicable for every requirement. Unknown ownership, data route, renewal mechanics or export quality is not a neutral score. It is a reason to stop, obtain evidence or reduce the proposed use.

Before you act

Common questions

Why should a small business start CRM selection with a workflow rather than a vendor shortlist?

A feature grid rewards breadth rather than fitness if the team cannot describe the work, its exceptions and its evidence. Starting with one troublesome relationship workflow keeps the focus on actual needs and avoids being swayed by features nobody will use.

What should be included in a controlled proof before committing data to a CRM?

Use synthetic records with no personal data and ask ordinary users to complete the scripted workflow. Capture time, errors and recovery notes. Test role changes, duplicate handling, a suppression update, an export and a failed integration, and record the product version and configuration.

How should evidence from suppliers be treated during CRM evaluation?

Separate supplier-published material from contractual commitments and independent assurance. A public security statement is a lead for investigation, not a pass mark. Security evidence should reflect the harm from loss, corruption or outage, and accessibility needs task-based inspection.