A customer portal acceptance checklist

A customer portal should make a recurring task easier to complete. Before discussing dashboard layouts, name that task: finding a document, checking a job, updating a detail or approving a request.

Then turn the task into a set of checks. The checks should cover the customer, the staff supporting them and the information each person is allowed to access.

Confirm the ordinary journey

Ask a person unfamiliar with the design to sign in and find a specific item on their phone. Check whether the labels explain the information, whether its date or status is clear and whether a download produces the expected document.

When the customer submits a request, the page should explain whether it was received. The receiving team needs a corresponding record and a way to identify who is responsible for acting on it.

Test the account boundary

Use separate test accounts representing different customers and staff roles. Check that each account can access its permitted records and cannot retrieve another customer's information by changing a link or identifier. Include documents as well as screens.

A login establishes identity; the system still needs to enforce permission for the requested record and action. OWASP's authorisation guidance explains why these checks belong on every request.

Exercise the less convenient paths

Plan controlled checks for:

• A customer who cannot sign in or recover access.
• A document that has expired or been withdrawn.
• A form sent twice or interrupted before completion.
• A staff member who changes role or leaves.
• Information that is unavailable or has not updated yet.

The expected result should be defined before the test. A vague error message and a silent failure are both difficult for customers to resolve.

Prepare for routine operation

The team needs to know who manages users, updates information and answers access questions. Document the retention, export and recovery arrangements relevant to the records held. Keep the support route visible to a customer who cannot complete the intended task.

These checks are part of a release plan, not a guarantee that every possible fault has been eliminated. They establish useful evidence about the actual journeys and boundaries in the agreed scope.

If you are still deciding whether customers need an account, read customer portal or email. Our customer portal service explains how the brief becomes a delivery scope.