Audit scheduling software RFP: a template with 40 questions
A scheduling software RFP template for certification and inspection bodies: 40 questions on rules, optimisation, integration, security, users and delivery.
Key takeaways
- Write requirements as open questions that force specific, evidenced answers.
- Put compliance rules first: competence, accreditation, impartiality, rotation and audit windows.
- Ask every vendor to prove key answers on a sample of your own audits.
- Score answers against weights agreed before the responses arrive.
A good scheduling software RFP for a certification or inspection body asks about 40 questions in six areas: scheduling rules and compliance, optimisation, integration and data, security and AI, planners and users, and delivery. Ask vendors to answer with evidence from your own data, then confirm the best answers in a proof of concept before you decide.
What should a scheduling software RFP cover?
A scheduling software RFP for a certification, inspection or accreditation body has one job: to find out which vendor can produce compliant audit plans from your data, connect to your systems and be trusted with your records. Generic software RFPs spend pages on features and little on the rules that make audit scheduling hard.
The 40 questions below are grouped into six sections. Copy them, delete what does not apply, and add scheme-specific rules. Keep the questions open, so vendors must explain how they meet each requirement.
How do you run a scheduling software RFP?
The process matters as much as the questions. A tight sequence stops the decision drifting towards the best presenter.
- Measure your baselineRecord planner hours, utilisation, subcontracted days, travel and missed due dates so vendors can respond to real numbers.
- Agree weights firstDecide how much each section counts before any response arrives.
- Send a data sampleShare an anonymised quarter of audits and auditors so answers can refer to your cases.
- Shortlist two or threeRemove vendors whose answers stay vague on compliance or integration.
- Run a proof of conceptTest the shortlist on your own data. Our proof of concept guide explains how.
Section A: how does the engine apply compliance rules?
| # | Question | A strong answer shows |
|---|---|---|
| 1 | How do you model auditor competence by standard, technical area, role and expiry date? | A data model that matches your competence matrix, with dates. |
| 2 | How do you apply the accreditation body per standard and per auditor? | Accreditation applied as a rule in every allocation. |
| 3 | How are conflicts of interest recorded and checked for each allocation? | A hard check with the reason stored per allocation. |
| 4 | How do you apply our rotation policy using previous auditors per client? | Configurable rules using imported history. See auditor rotation rules. |
| 5 | How do you schedule inside surveillance and recertification windows? | Windows and due dates as hard constraints with warnings before they close. |
| 6 | How do you form teams for integrated and multi-site audits? | Team selection covering the full scope with a qualified lead. |
| 7 | How are trainees and witnessed audits planned? | Trainees placed only alongside a qualified auditor. |
| 8 | What record shows why each auditor was chosen? | An explanation per allocation that an assessor could read. |
If a vendor cannot explain an allocation, an assessor will not accept it either.
Section B: how well does it optimise the plan?
| # | Question | A strong answer shows |
|---|---|---|
| 9 | Is the engine deterministic, giving the same result for the same data? | Yes, with an explanation of how. |
| 10 | How many audits can you plan in one run, and how long does it take? | Evidence at your volume, ideally from a reference. |
| 11 | How do you reduce travel and cluster nearby audits? | Clustering of multi-day trips and team travel across weeks. |
| 12 | How do you balance internal auditors against subcontractors? | A configurable goal with reporting on internal share. |
| 13 | What happens when an auditor becomes unavailable at short notice? | Re-planning that shows the knock-on effect before approval. |
| 14 | What does the planner see when no valid allocation exists? | The specific rule that blocked the audit. |
| 15 | Can planners lock allocations and re-optimise the rest? | Yes, without disturbing locked audits. |
Section C: how does it connect to your systems and data?
| # | Question | A strong answer shows |
|---|---|---|
| 16 | Which systems do you integrate with today, and how? | Named integrations with CRMs and certification platforms, plus a documented API. |
| 17 | Do you offer a REST API and webhooks? | Public documentation and examples. |
| 18 | Which system is the source of truth for each record after go-live? | A clear map. See certification body management software. |
| 19 | How do you sync with auditors' calendars? | Two-way sync with Outlook or equivalent. |
| 20 | What data do you need for migration, and in what format? | A template and a validation report. |
| 21 | How much history do you import for rotation and competence? | At least one full certification cycle. |
| 22 | Can we export all our data at any time? | Full export in open formats. |
Section D: how are security, hosting and AI controlled?
| # | Question | A strong answer shows |
|---|---|---|
| 23 | Which security certifications do you hold? | Current ISO/IEC 27001 certificate with scope. |
| 24 | Where is our data hosted and processed? | Named regions, with sub-processors listed. |
| 25 | How do you meet GDPR for auditor and client data? | Data processing agreement and retention rules. |
| 26 | Where is AI used, and what can it change without approval? | A clear boundary, with planner approval for plan changes. |
| 27 | Are AI actions and plan changes logged? | Complete logs with who approved what. |
| 28 | How do you assess your product against the EU AI Act? | A documented view. See the EU AI Act and scheduling software. |
Section E: how will planners, auditors and clients use it?
| # | Question | A strong answer shows |
|---|---|---|
| 29 | How do planners review and approve a proposed plan? | A review screen with exceptions first. |
| 30 | What can auditors see and change? | Availability and preferences, with rules still enforced. |
| 31 | How do clients confirm or request dates? | A simple flow or email handling with planner approval. |
| 32 | What reports on utilisation, travel and due dates are included? | Standard KPIs. See certification body KPIs. |
| 33 | What training do planners receive? | Role-based training on your own data. |
| 34 | Which languages and time zones are supported? | Coverage for every country you operate in. |
Section F: can the vendor deliver and support it?
| # | Question | A strong answer shows |
|---|---|---|
| 35 | Which certification or inspection bodies use the product today? | TIC references you can call. |
| 36 | What is the implementation plan and timeline? | A dated plan with named roles on both sides. |
| 37 | What will our team need to provide? | Honest estimates of data and planner time. |
| 38 | Will you run a proof of concept on our data before contract? | Yes, with agreed success measures. |
| 39 | What support hours and response times apply? | Written service levels. |
| 40 | How is the product priced, and what drives cost as we grow? | A clear model with no hidden extras. |
How should you score scheduling software RFP responses?
Score each answer from 0 to 3: 0 for no answer, 1 for a claim, 2 for a described method, 3 for evidence on your data. Multiply by the section weights agreed at the start. Compliance and integration usually deserve the highest weights, because they are the hardest to fix later.
- ✓Weights agreed and recorded before responses open
- ✓At least two scorers per section, scoring independently
- ✓Vague answers scored as 1, however confident they sound
- ✓Key claims tested in the proof of concept
- ✓References contacted, ideally bodies of similar size and scheme mix
- ✓Final decision and reasons recorded for your management review
For the features behind these questions, see the 2026 feature checklist.
ScheduleAI is the audit scheduling software certification bodies use to plan ISO programmes from stage 1 to recertification.
ScheduleAI answers these questions with evidence: a free two-week custom demo on your own data, a REST API, webhooks, Intact and Outlook integrations, ISO/IEC 27001 certification and EU hosting.
Book a demo Estimate your savingsQuestions
How many questions should a scheduling software RFP have?
Around 30 to 50 is enough. Fewer misses key risks; more produces long, generic responses that are hard to compare.
Should we include scheme-specific rules?
Yes. Add the rules for your schemes, such as unannounced audit requirements or examination frequencies, so vendors show how they handle them.
Is a proof of concept better than an RFP?
They do different jobs. The RFP narrows the field; a proof of concept on your own data confirms the shortlist's answers.
Who should score the responses?
A planner, an operations lead, IT and quality, each scoring their own sections independently against agreed weights.
Can we share real data with vendors?
Share an anonymised sample under a confidentiality agreement. Real volumes and rules produce far more useful answers. Request a demo on your data to see this in practice.