30 questions for your rostering shortlist.

Start with the scheduling rules and planning workflow your operation requires.

1. How does the system update a roster when demand, availability or a constraint changes?

   Why it matters Assess the options for re-optimisation, preserving assignments and reviewing the effect of a change.

2. Which hard constraints and preferences can the system apply to our operation?

   Why it matters A written rule list helps identify required configuration, unsupported rules and development work.

3. How are conflicting constraints and rule violations presented to planners?

   Why it matters Planners need to identify affected assignments and understand the options for resolving a conflict.

4. Can you demonstrate an infeasible scenario and explain the resulting warnings or unfilled shifts?

   Why it matters Exception handling is part of evaluating the planning workflow.

5. What performance results are available, and what inputs, hardware and time limits were used?

   Why it matters Compare timings only with their roster size, constraint set, environment and solution quality.

1. Which customer references or published case studies are available, and what can we verify?

   Why it matters References and studies provide different kinds of evidence; review their relevance and scope.

2. Who produced, reviewed or published the supporting evidence?

   Why it matters Distinguish original measurements, vendor analysis, third-party publication and independent assessment.

3. For each reported result, what was measured, simulated or extrapolated, and on what sample?

   Why it matters The method, baseline and sample determine how relevant a result is to your operation.

4. What product limitations affect our requirements, and how can we test them?

   Why it matters Document gaps and dependencies before agreeing the implementation scope.

1. Which identity and authentication protocols are supported?

   Why it matters Review compatibility with your identity policies and the security of the implementation.

2. How does federation with our identity provider work, including account lifecycle and fallback access?

   Why it matters Confirm the login flow, credential handling, offboarding and recovery arrangements.

3. How is tenant isolation implemented and tested across application, database, storage and backup access?

   Why it matters Assess the combined controls and test evidence for the proposed deployment architecture.

4. How are user and service permissions enforced on internal service calls and background jobs?

   Why it matters Review privileged service contexts as well as requests made directly by users.

5. What independent security assessments are available, and how are findings tracked and retested?

   Why it matters Confirm assessment scope, tested version, outstanding findings, remediation and regression coverage.

1. Can permissions distinguish individual business actions, such as approving a swap and deleting a leave request?

   Why it matters Check whether roles support the responsibilities and separation of duties your organisation needs.

2. Can read and write access be scoped independently?

   Why it matters Separate scopes can allow broad visibility while limiting who can change records.

3. How is access enforced for direct API requests and individual records?

   Why it matters Test restricted accounts through the API as well as the user interface.

4. Can temporary role assignments expire automatically on an agreed date?

   Why it matters Time-limited access supports leave cover and secondments while reducing manual revocation work.

1. Which hosting options are supported, and how do release, feature and support policies differ?

   Why it matters Confirm the operational responsibilities and lifecycle of each option.

2. What infrastructure is reserved in a dedicated environment, and what remains shared?

   Why it matters Clarify isolation, capacity, test environments and any additional infrastructure charges.

3. Where are application data, documents and backups stored and processed?

   Why it matters Review locations, subprocessors and transfer arrangements for the proposed deployment.

4. How are releases approved, deployed and rolled back in our chosen environment?

   Why it matters A repeatable release process supports change control and recovery planning.

5. What is the exit process for data export, account removal, deletion and retained backups?

   Why it matters Agree responsibilities, timing and confirmation before implementation.

1. Which changes are logged with actor, timestamp and previous and new values?

   Why it matters Confirm coverage, access, retention, export and tamper-protection requirements.

2. How are uploaded personal documents encrypted, and what are the key-management and legacy-file arrangements?

   Why it matters Review the protection applied to the documents your organisation will store.

3. What retention and deletion options apply to each category of data?

   Why it matters Align supported controls and agreed procedures with your organisation’s retention requirements.

4. How are employee data access, correction, export and deletion requests handled?

   Why it matters Confirm the workflow, responsibilities and any manual steps needed to fulfil requests.

1. How are licence, hosting, deployment, support and service charges calculated?

   Why it matters Compare recurring and one-off costs, volume bands, dependencies and assumptions on the same basis.

2. What support coverage and response commitments are included in the proposed contract?

   Why it matters Confirm operating hours, severity definitions, response targets and exclusions.

3. What data access, export and continuity arrangements apply if the vendor changes ownership or ceases operating?

   Why it matters Assess the contractual rights and practical steps available to maintain access to your data.