How to spot risk in school management, ERP, and SIS

Look for risk at the handoff

Risk is often easiest to spot where one person, team, or system hands work to another. Follow an application into enrollment, a student into a class, a fee into a receipt, or an assessment into a published report. Ask what happens when the value is missing, duplicated, late, or wrong.

A feature list may not reveal that the school relies on a private spreadsheet, one experienced administrator, an unreviewed export, or a permission that is broader than the workflow requires.

Use five warning signals

These signals do not prove a product is unsafe. They identify questions that need evidence before the school proceeds.

• No named owner for a record, decision, correction, or support route.
• A successful demo that excludes permissions and exceptions.
• A metric or claim without a baseline, definition, or review date.
• A manual copy whose access, retention, and deletion are unclear.
• A launch date that ignores academic-calendar pressure and practice time.

Turn signals into controls

Write the risk, affected workflow, likelihood, consequence, current control, evidence needed, owner, and decision date. Keep a hold rule for identity, privacy, access, payment, assessment, or family-visibility failures.

GOV.UK procurement guidance recommends attention to data protection by design, minimum necessary data, access control, security, subprocessors, incident handling, and data return or deletion. The U.S. Department of Education data governance resources add quality, lifecycle, sharing, disposal, and monitoring prompts.

Review risk as work changes

Risk is not finished at contract signature. Review it at discovery, migration, testing, launch, and 30, 60, and 90 days afterward. A new campus, integration, role, report, family channel, or data field can change the original decision.

Make the next step specific

Use this guidance to improve one bounded part of how to spot risk in school management software. Name the person who owns the decision, the record or workflow affected, the evidence needed, and the date for review. A short test with real operators is more useful than a broad claim that the whole school has been transformed.