Compliance Management Software Selection: How to Run the Two-Week Commitment Fortnight

You have picked a favourite. The demo went well, the shortlist is down to one, and the salesperson wants a signature by month end. Here is how to spend the next two weeks so the thing you sign actually protects you.

This is the commitment fortnight, the gap between choosing and signing, and it is where Compliance Management Software Selection is really settled. Not in the demo. The demo is the least reliable signal of the whole process, because a good demo shows you a clean sample tenant on the vendor's best day. The contract shows you what happens on your worst day. Work the fortnight as a deliberate checklist and you settle seven items in writing before you commit. Rush it as a procurement form and you inherit whatever the standard agreement happened to say.

Why Compliance Management Software Selection turns on the fortnight, not the demo

Most software you can walk away from. Compliance software you cannot, at least not cleanly, because your obligation to produce the records outlives the vendor relationship. The Fair Work Ombudsman requires Australian employers to make and keep time and wages records for seven years, in a legible form, in English, and readily accessible to a Fair Work Inspector. That is the single fact that reshapes this purchase. If the records live in a system you exit in year three, you still owe those records in year seven. So the export clause, the ownership clause and the exit window are not fine print here. They are the point.

The other reason to slow down is that the surface has genuinely got riskier. The OAIC reported 1,113 data breach notifications in 2024, the highest annual total since the Notifiable Data Breaches scheme began in 2018. Your compliance platform holds training records, policy acknowledgements, incident reports and often personal information about every worker. Before you sign, you want to know where that data sits and what the vendor commits to tell you if it is exposed.

None of this is about distrust. A good vendor is happy to be asked every one of these questions and to put the answers in the agreement. Sentrient, for what it is worth, takes exactly that stance, including on export and exit. The point of the fortnight is not to catch anyone out. It is to make the invisible parts of the deal visible while you still have leverage, which is now, before you sign.

How to run the commitment fortnight, day by day

Give yourself the full two weeks and treat each item as a task with a written output. You are not collecting reassurance. You are collecting artefacts you can file, so that in a year, when the person who ran this process has moved on, the next person can open a folder and see exactly what was agreed. Here is the stage-by-stage sequence.

The commitment-fortnight checklist

Step	What you do	The written output you should hold at the end
1. Request the contract terms	Ask for the full agreement, not the order form. Read the data-storage and data-ownership clauses first. Confirm where data is stored and processed, and that a clause states you own all data and content while the vendor holds it only to provide the service.	A copy of the agreement, plus a one-line note confirming storage location (and whether any processing happens overseas, which engages APP 8 cross-border disclosure) and the ownership clause reference.
2. Test the export	During the trial, ask an admin to export everything and open the real file, not a demo of the button. Check that policy version acknowledged comes through, not just completion dates.	A saved export file you have opened yourself, and a note of the format, plus the exit terms: defined format, defined timeframe, no exit fee, and a stated post-termination retrieval window.
3. Run the reference call	Ask for one organisation of similar size and sector, live more than two years. Ask six questions: time from signature to first useful report, what needed cleaning before migration, what line managers say, what cost extra, what happened at first renewal, what they would check again.	Dated notes from the call against those six questions, kept with the vendor's name and the referee's role (not their personal details).
4. Settle the renewal mechanism	Get the pricing behaviour in writing, not the year-one figure. Ask what the price does at renewal, whether increases are capped, whether the term is fixed, and what triggers a new tier, usually headcount or number of sites.	A renewal clause showing any cap, the term length, and the specific triggers for a price tier change.
5. Confirm implementation scope	Ask what implementation actually includes, in writing. Migration, configuration, integrations, number of training sessions, and what counts as chargeable extra.	A written scope statement listing what is included and, just as important, what is billed separately.
6. Agree support terms	Confirm support hours in Australian time, a response target by severity, and a named escalation path.	A support schedule with hours, severity-based response targets, and the escalation contact or process.
7. Agree breach-notification terms	Ask the vendor to commit to telling you within a stated number of hours if your data is exposed, with enough detail for you to assess whether it is notifiable under your own obligations.	A breach-notification clause with a stated timeframe and a description of the detail you will receive.

Work these roughly in order. Steps 1 and 2 tend to surface the deal-breakers, so front-load them. If the export test fails or the ownership clause is missing, you want to know in the first few days, while you still have a shortlist to fall back to.

A note on the trial, because it feeds the checklist

Two of the steps above depend on a trial that tells you something. A weak trial uses the vendor's sample data and gets driven by the project team who already like the tool. A useful trial uses your own data, gets handed to a line manager rather than the buyer, and runs one full cycle: assign, remind, escalate, complete, report. Produce one artefact you would be comfortable handing a regulator, for example an acknowledgement list for a specific policy version as at a date. Then break something on purpose. Change a person's role and site and watch whether their assignments and reporting follow. If they do, the tool understands your structure. If they do not, you have found that out for the price of a trial rather than a contract.

This is also where you road-test total cost of ownership. Look at three years, not year one, and compare it to what your current approach quietly costs in admin time and exposure. The licence fee is rarely where the surprise sits. The surprise is usually in migration, extra training sessions, or a renewal tier you did not see coming, which is exactly why steps 4 and 5 have written outputs.

What the software can and cannot do

Worth being straight about this, because the language matters. No software makes you compliant. What good compliance software does is give you defensible evidence and a repeatable process. A workplace compliance system that holds training, policies, records, incidents and surveys in one place supports your obligations and makes it easier to produce the records when someone asks. It does not remove the obligation, and any vendor who tells you it does is selling you a demo, not a contract. Keep that line in mind as you read the agreement, and treat AS ISO 37301:2023, the compliance management systems standard, as a framework for your own system rather than something a licence delivers on its own.

If you want the strategic version of this decision rather than the fortnight tactics, the original piece on Compliance Management Software Selection sets out the full five-stage process, and the companion guide on how to choose the right compliance management software is a good next read.

When you are ready to see how the seven items above look inside a single platform, the workplace compliance system brings training, policies, records, incidents and surveys together, is Australian owned with data held in Australia, and comes with Australian-based support. It is trusted by more than 1,000 businesses across Australia and New Zealand, with compliance courses legally endorsed by Australian lawyers.

General information, not legal advice. Have any agreement reviewed by a qualified professional. Correct as at September 2026.

Frequently asked questions

1. What is the commitment fortnight in Compliance Management Software Selection?

It is the roughly two-week stage between choosing your favourite vendor and signing. It is where the real decision is made, because it is when you settle the seven contract items in writing while you still have leverage. Treat it as a deliberate checklist rather than a rushed procurement form.

2. Why is the seven-year record rule so important to this decision?

The Fair Work Ombudsman requires employers to keep time and wages records for seven years, readily accessible and in English. Your duty to produce those records outlives any single vendor relationship, so the export, ownership and exit clauses matter more here than they would for most other software.

3. What should the export test actually check?

Ask an admin to export everything during the trial and open the real file yourself. Confirm that the policy version acknowledged comes through, not just completion dates. A common failure is an export that captures who completed a task but not which version of the policy they signed off.

4. What breach-notification terms should I ask for before signing?

Ask the vendor to commit to telling you within a stated number of hours if your data is exposed, with enough detail for you to judge whether it is notifiable under your own obligations. Given the record number of breach notifications in Australia recently, this belongs in the agreement, not in a goodwill conversation.

5. Can any compliance software guarantee we are compliant?

No. No software makes you compliant. It gives you defensible evidence and a repeatable process, and it makes producing records easier. The obligation stays with you, which is why the contract terms you settle in the fortnight matter more than anything the demo showed.

Ready to work your own checklist?

Take the seven-row table above into your next vendor conversation and ask for each written output by name. If you would like to see how those items look inside one Australian-owned platform, book a free demo and bring your hardest questions, including export and exit. That openness is the whole point of the selection stage.