Workflow and business process management software in Australia

Choosing and rolling out a workflow tool

Eight steps, in the order they usually matter. The first one is the one most organisations skip.

1. Map the process you actually have

   Write down the real steps before you look at any software. Who starts the job, who signs it off, where it waits, and what gets re-keyed by hand. Most organisations find two or three processes that only exist in one person's head. A tool built on a process you have not mapped will automate the mess rather than fix it.

2. Decide between a general tool and a vertical one

   A general workflow tool is configured by you to suit any process. A vertical tool arrives already shaped around one trade or function, such as field service, work health and safety, or an accounting practice. The general tool is cheaper to buy and dearer to maintain, because the configuration becomes your responsibility. The vertical tool fits faster but fights you at the edges, so check how it handles the parts of your work that are unusual.

3. Check it fits what you already run

   List the systems the workflow has to touch: accounting, payroll, rostering, CRM, point of sale, email. Ask whether the integration is built and supported by the vendor, built by a third party, or something you assemble yourself with an automation tool. Confirm which direction data flows and how often it syncs. A nightly one-way export is a different product to live two-way sync, and vendors describe both as an integration.

4. Set out permissions and approvals

   Work out who may see each record, who may approve, and what happens when that person is on leave. Check whether approval limits can be set by dollar value, by site, or by role, and whether the tool keeps an audit trail you could show an auditor or an insurer. Ask whether a delegate can approve in someone else's name, and whether that is logged. Weak delegation is the most common reason an approval workflow gets bypassed in practice.

5. Work out where the data sits and who can reach it

   For most software-as-a-service products, hosting region is a configuration choice at sign-up, not a fixed property of the vendor. A United States vendor may well be able to put your tenant in an Australian region, and an Australian vendor may host in Singapore. So the question is not where the company is from. The question is which region your tenant is in, whether that can be changed later, and whether support, engineering or sub-processors access the data from outside Australia.

6. Pilot one process, not the whole business

   Pick a single process with a clear start and finish, a willing team, and a result you can measure. Run it for a few weeks alongside the existing method. Count the handovers, the time to approval, and the number of times someone works around the tool. If the pilot process does not improve, a wider rollout will not rescue it.

7. Train people and expect the process to change

   Budget time for training and for a second round of training a month later, once people have hit the real edge cases. Name someone inside the business who owns the configuration, because workflow tools drift without an owner. Tell staff what is being measured and why. A workflow tool that staff read as surveillance gets filled in badly, and bad data is worse than no data.

8. Plan the exit before you sign

   Ask how you get your data out, in what format, and whether that includes attachments, comments and the audit history or only the current records. Check whether export is self-service or a paid request. Check how long the vendor keeps your data after you cancel, and how you make them delete it. Also ask whether your process definitions are exportable, because a process you can only read inside the vendor's screens has to be rebuilt from scratch somewhere else.

Directory of workflow and process products

Products relevant to Australian buyers, grouped by what they are usually bought for. Australian-developed products are listed first. Inclusion is not an endorsement.

Questions to put to the vendor in writing

Ask these before you sign, and keep the answers. Sales staff answer these differently to the people who run the platform, so ask for it in writing.

• Which region will our tenant be hosted in, and can it be moved later? Hosting region is a configuration choice for most software-as-a-service products, not a property of the vendor. The useful answer names a region and says whether migration is possible after you go live, because many vendors cannot move an existing tenant at all.
• Who can access our data from outside Australia, and under what circumstances? A tenant hosted in Sydney can still be read by support or engineering staff overseas. If the vendor discloses personal information to an overseas recipient, Australian Privacy Principle 8 requires the disclosing entity to take such steps as are reasonable in the circumstances to ensure the recipient does not breach the Australian Privacy Principles. Section 16C of the Privacy Act 1988 goes further: where the entity discloses personal information overseas and the recipient does something that would breach the Australian Privacy Principles, that act is treated as having been done by the Australian entity and as a breach by it. In short, you stay accountable.
• Who are your sub-processors, and will you tell us when they change? Workflow tools sit on other people's infrastructure and bolt on other people's services for email, analytics, storage and increasingly AI features. The sub-processor list is where your data actually travels. A vendor that will not publish the list, or will not give notice of changes, is asking you to accept an obligation you cannot see.
• What happens if there is a data breach, and when do you tell us? The Notifiable Data Breaches scheme applies to entities covered by the Privacy Act 1988. Where a data breach involving personal information is likely to result in serious harm, the entity must notify the affected individuals and the Office of the Australian Information Commissioner. If you are the covered entity, the obligation is yours even when the failure was the vendor's, so the contract needs to require prompt notice to you, with enough detail to assess the harm.
• Does the Privacy Act apply to us at all, and has that changed? The small business exemption in section 6D of the Privacy Act turns on annual turnover, and some small businesses are covered regardless of turnover — health service providers and businesses that trade in personal information among them. The government has agreed in principle to remove the exemption, and the Act has been amended in tranches, so the position has genuinely moved. Confirm the current turnover figure and your own status with the Office of the Australian Information Commissioner rather than relying on a figure quoted anywhere else, including here.
• How do we get our data out, and what is included? Ask for the export format and whether it covers attachments, comments and the audit history or only the current records. Ask whether export is self-service or a paid professional services request. Ask how long data is retained after cancellation. Also ask whether process definitions are exportable, or whether you would be rebuilding the configuration from scratch.
• Are you IRAP assessed or certified under the Hosting Certification Framework? This matters only if you are a government buyer or a supplier to one. An Infosec Registered Assessors Program assessment is a point-in-time assessment of a system against the Australian Government Information Security Manual; it is not a pass mark or a general-purpose security badge. The Hosting Certification Framework applies to data centre and hosting providers for Australian Government data rather than to workflow software itself, and its status and administration have changed over time, so confirm the current position with the responsible agency. A commercial buyer gains little from either, and vendors sometimes offer them in place of answers to the questions above.