A modular system turns that around. You switch on the functions you need now, from attendance and admissions to billing, catering and parent communication, and add others when the school is ready. That has three practical benefits. First, cost tracks use: you are not paying for functions sitting idle. Second, rollout is calmer, because staff adopt a few modules well rather than a whole suite badly at once. Third, the system grows with the school, so a decision made this year does not box you in next year.

A fixed system gives you a set list of features, take it or leave it. It can work if the bundle happens to match how your school runs. The trouble is that schools are not identical. A large multi-academy trust, a small independent and a faith primary all record different things and answer to different bodies. A one-size product asks each of them to bend to the software, and usually one of them ends up keeping a spreadsheet on the side to cover the gap.

Certification is the second, more concrete checkpoint. ISO 27001 is the recognised international standard for information security management, and a vendor holding current certification has had its security controls independently audited against that standard rather than simply asserting they are secure. For any part of a system handling payment data, such as fee billing or canteen top-ups, PCI-DSS Level 1 compliance is the equivalent standard specifically for payment card handling, and it is worth asking whether that certification covers the billing module directly rather than being described only at the level of the parent company.

Security is the third reason to move. A spreadsheet emailed between offices is hard to control and easy to lose. A proper MIS keeps records behind role-based access, holds an audit trail, and backs data up centrally. For a trust handling sensitive records at scale, that governance is not optional.

Certification is the third area worth confirming directly rather than assuming. Ask for current, dated evidence of information security certification such as ISO 27001, and, where the system handles payment data through billing or canteen accounts, confirmation of PCI-DSS compliance at the relevant level. Compass Education, like every other vendor on a shortlist, should be asked to produce this evidence directly rather than a school assuming it from marketing material or Helping Learning Thrive an incumbent relationship.

Spreadsheets are where many multi-academy trusts start, and for a single form entry they can just about cope. Run several schools from them and the cracks show quickly. Versions multiply, formulas break, and no one is quite sure which file is current. For a trust accountable to governors, the Department for Education and parents, that is a real risk rather than a minor annoyance.