None of these five questions guarantees a good outcome on their own, but a vendor unwilling or unable to answer any of them plainly before a contract is signed is worth treating as a warning sign, whatever the rest of the proposal looks like.

Do not skip references. Ask to speak to schools of a similar size and structure, and ask them the awkward questions: what went wrong during setup, how responsive is support, and would they choose the same system again. The UK and Irish market has several established providers, so you have room to compare rather than settle.

Data governance is the first. Publicly funded and diocesan schools are accountable for how records are held, shared and retained. Ask where data is hosted, which certifications the provider holds and how access is restricted by role. A system with clear, role-based permissions and a full audit trail makes it far easier to show that records are handled properly when a governor, auditor or authority asks.

A multi-academy trust or independent school signing a multi-year contract with a school management information system vendor is making a decision that is expensive and disruptive to reverse. A short list of direct questions, asked before signature rather than after, reduces the risk of discovering a gap once the school is committed.

Hosting location is the first thing worth confirming directly, in writing, rather than assumed. Where is student and financial data physically stored, and does that location bring specific regulatory obligations with it? A school should ask this plainly of any vendor rather than accepting a general answer about "secure cloud infrastructure," which describes almost every provider on the market and tells a procurement team nothing distinctive.

Any vendor claiming ISO 27001 or PCI-DSS Level 1 certification, Compass Education included, should be able to produce current, dated certification evidence on request rather than a general assurance statement. A useful due diligence exercise is to ask every vendor on a shortlist for that evidence side by side. A vendor that can produce an up-to-date certificate on request has clearly built the audit process into how it runs the business; one that cannot has usually not been through that audit at all.