Five CRM strategy mistakes, starting with buying before observing the work

The most damaging CRM mistakes often occur before configuration. A vague problem, mixed communication purpose or missing exit test can turn a manageable workflow issue into an expensive dependency.

What to take away

1. Buying before observing the work

A team may describe its difficulty as "no single customer view" without tracing an enquiry, service case or correction. That phrase can hide uncertain ownership, inconsistent identifiers, missing rules or unsuitable storage. Buying first may reproduce the ambiguity in a new interface.

A two-person Leeds plumbing firm may say it needs a CRM to stop losing enquiries. A trace of one enquiry might show a missed call note, a quote in a personal inbox and no named owner for follow up.

The gap is a handover rule rather than software. Any quote it receives will vary with the number of named users, the volume of records migrated and the support tier.

The SME Digital Adoption Taskforce report discusses capability, complexity, cost and switching barriers across UK SME digital adoption. It does not diagnose an individual firm. Start by listing every step from first contact to a signed quote, then name the person and the system that holds each handover. Compare repair, configure, procure and stop routes.

2. Treating one contact flag as permission for everything

A record needed to fulfil a request may still be unsuitable for promotion. Genuine research can also become direct marketing when lead generation enters the purpose. A broad "consented" tick obscures source, channel, wording, date, subscriber category and objections.

The ICO's direct-marketing planning guidance keeps UK GDPR responsibilities and PECR channel rules in view. The repair is a versioned purpose and channel decision table, separate lawful-basis and PECR assessments, and suppression that propagates across every relevant route. Software cannot make that judgement lawful on its own.

3. Giving access without durable ownership

Shared administrator credentials, dormant accounts and undocumented integrations make it difficult to establish who changed a record or recover the service. The risk is operational as well as technical: a departing staff member may be the only person who understands a critical automation.

The NCSC's using online services safely collection covers account protection, recovery and the organisation's responsibilities when using hosted services. Apply least privilege, named accounts, recovery contacts, access reviews and a tested handover. These controls do not guarantee security.

4. Declaring success from activity counts

Records created, logins or automated messages show activity. They do not establish better service, a commercial outcome or CRM causation. A rising count may reflect duplicated work.

The 2026 Magenta Book distinguishes process, impact and value-for-money questions. Define the eligible population, numerator, denominator, period, source version and baseline before intervention. Claim causal impact only with a credible counterfactual; otherwise report an observation and its uncertainty.

5. Leaving export and closure until renewal

A service can appear suitable during a demonstration yet fail the buyer's real need to extract relationship history, preserve evidence or remove data at the end. Contract wording, configuration and practical export behaviour all matter. Waiting until renewal weakens the buyer's options.

The ICO's controller and processor contract guidance addresses contract content, sub-processors and what happens to personal data when services end. It is marked under review in parts following the Data (Use and Access) Act 2025.

Before commitment, run a buyer-controlled export and restore with synthetic data, inspect deletion and support terms, name the continuity owner and obtain current legal advice. Export contacts, companies, notes, tasks, consent records and attachments as CSV files, then restore them into a clean trial account. Verify the restore by comparing row counts and spot-checking consent and suppression records.

A short correction meeting

Take one recent relationship event and ask which of the five controls is missing. Record the evidence, owner and deadline needed to resolve it.

If a privacy, PECR, security, accessibility or exit gate is unknown, keep the affected change on hold. The aim is not more documentation but to stop a decision resting on an untested assumption.

Before you act

Common questions

Why is buying a CRM before observing the work a mistake?

The mistake is committing to a tool before anyone has traced an enquiry end to end. Section 1 sets out the trace, the owner of each handover and the four routes to compare.

What does the ICO guidance say about consent for direct marketing?

The guidance keeps UK GDPR responsibilities and PECR channel rules in view. Section 2 sets out the purpose and channel table, the separate assessments and the suppression rule.

How can a firm avoid problems when leaving a CRM service?

Before commitment, run a buyer-controlled export and restore with synthetic data, inspect deletion and support terms, name the continuity owner and obtain current legal advice. The ICO controller and processor contract guidance addresses contract content, sub-processors and what happens to personal data when services end.

Research closed on 5 September 2026. Non-ranked list: an entry qualified when current UK government or regulator material supported a distinct planning control for a small English firm.

Supplier comparisons, prices, product faults and frequency claims were excluded, and no hands-on testing or provider funding. Specialist legal, privacy, PECR, security and accessibility review remains necessary, as does financial and commercial review.