Reviews
Part of Reviewing community products and providers with an evidence hierarchy and repeatable tests
Community management review methodology in England: five provider checks, from Companies House to Cyber Essentials
Review community software and providers in England: Companies House identity, ICO fee, Cyber Essentials, WCAG 2.2 AA and the DMCC Act review rules.
A credible review states what was examined, by whom, under which conditions and what the evidence cannot show. For community software and services in England, five named checks give the method a fixed base: identity, data protection, security, accessibility and review law. Run the same checks for every provider.
What to take away
- Identitylook the provider up in the Companies House register and record the registered name and address.
- Data protectionorganisations that use personal information need to pay an ICO data protection fee, unless exempt.
- SecurityCyber Essentials is aligned to five technical controls, from firewalls to malware protection.
- Accessibilitypublic sector buyers expect WCAG 2.2 AA and an accessibility statement.
- Review lawSchedule 20 of the DMCC Act 2024 bans fake reviews and concealed incentives.
Check 1: who you are reviewing
Start every provider review with identity. GOV.UK gives free company information such as registered address and date of incorporation, plus current and resigned officers and previous company names. Record the search date and any mismatch between trading and registered name.
Define the member task, service boundary and audience first. A review of community management providers should say how they were found and why others were left out. An agency review should say whether any supplier contact shaped the findings.
Check 2: data protection
Under the Data Protection (Charges and Information) Regulations 2018, organisations (including sole traders) that use personal information need to pay a data protection fee, unless they are exempt. The ICO keeps a register of fee payers that you can search.
Community platforms hold member data by design. Record whether the provider appears in the register, and keep the result with the date. A missing entry is a question to put to the provider, not a verdict.
Check 3: security evidence
Cyber Essentials is the minimum standard of cyber security recommended by the Government for organisations of all sizes. The scheme is aligned to five technical controls: firewalls, secure configuration, security update management, user access control and malware protection.
Ask each provider whether it holds the certification and for the certificate date. Score the answer as evidence held or not held. Do not infer security quality from a logo.
Check 4: accessibility
GOV.UK guidance for public sector bodies says a website or mobile app meets the legal requirements if it meets the WCAG 2.2 AA standard and publishes an accessibility statement. A public sector buyer of community software will expect the same of the platform.
Test joining, search, posting, reporting and moderation with a keyboard and a screen reader, and record what failed. A quality checklist keeps access, safety and price as separate checks.
Check 5: review law and disclosure
Paragraph 13 of Schedule 20 to the Digital Markets, Competition and Consumers Act 2024 bans submitting or commissioning a fake consumer review, and a review that conceals the fact it has been incentivised. It also bans publishing reviews without reasonable and proportionate steps to prevent and remove them.
The CMA fake reviews guidance, ref. CMA208, was published on 4 April 2025 and helps publishers meet their legal obligations. Apply it through a disclosure policy that states every payment, free access and supplier contact.
Put the checks into one method
| Check | Named source | Evidence to keep |
|---|---|---|
| Identity | Companies House company information | Registered name, address, officers |
| Data protection | ICO data protection fee and register | Register result and date |
| Security | NCSC Cyber Essentials | Certificate or a written "not held" |
| Accessibility | WCAG 2.2 AA, accessibility statement | Test notes per task |
| Review law | DMCC Act 2024, Schedule 20, paragraph 13 | Origin and incentive status of each review |
Use repeatable tasks for software: joining, search, contribution, reporting, moderation, appeal, administrator succession and export. Run the same tasks for every product and record what was not tested. For a managed service, follow the operations and delivery practice you are judging, not only the brochure.
State limits and freshness
Give each review an expiry date and say what would trigger an earlier recheck, such as a pricing change or a new owner. The reviews and comparison methods page sets the common frame for dated results.
Do not add unrelated points into one rating. A reader can reproduce a result only when each check, its evidence and its date are written down.
Before you act
- Write the review question, scope and search date.
- Look up each provider in the Companies House register.
- Search the ICO register of fee payers for each provider.
- Record Cyber Essentials status as held or not held.
- Test accessibility against WCAG 2.2 AA and note failures.
- Log the source and incentive status of every quoted review.
Common questions
Do review rules apply to a small review site?
Paragraph 13 of Schedule 20 bans publishing consumer reviews without reasonable and proportionate steps to prevent fake reviews. The CMA guidance is written for businesses that publish reviews or information about reviews.
What counts as an incentivised review?
A review is incentivised in this sense when someone was commissioned to write it and that fact is not made apparent, whether through the review itself or otherwise.
