FUSION PRACTICES LTD

GrantsNow Ethics & Risk Management System

Simple Ethics & Risk Management, with unique capability to configure your own forms for Researchers or Students. Fully automated approval workflows, Risk Categorisation, hierarchies, and terminology. Approval workflows to individuals/committees and provides extensive reporting suite for all progress and status reporting. Docusign for online signatures.

Features

• Simple & intuitive Cloud solution
• Create your own online forms, approvals, and reports
• Risk categorisation for each application
• Audit trail of actions taken, storage of previous versions
• Reviews & approvals for ethics committees with online approvals,notes/actions
• Capability to edit and resubmit applications
• Notification of approvals/rejection to all participants
• Full Document Management Capabilities

Benefits

• Full visibility of the status of applications at every stage
• Fully automated workflows removes manual processes.
• This saves time and increases level/quality of Ethical Governance
• Integration with your CRIS system
• Secure storage of contract documents, control view and edit rights

• Education pricing available
• Free trial available

Service documents

• Pricing document

  PDF

• Service definition document

  PDF

• Terms and conditions

  PDF

Request an accessible format

If you use assistive technology (such as a screen reader) and need versions of these documents in a more accessible format, email the supplier at consulting@fusionpractices.com. Tell them what format you need. It will help if you say what assistive technology you use.

Framework

G-Cloud 15

Service ID

122762219808544

Contact

Anil Passi
+442071019621
consulting@fusionpractices.com

About your service

• Service categories:

  Applications

  Enterprise resource management

  • Procurement
• Multi cloud support: No

Service scope

• Software add-on or extension: Yes, but can also be used as a standalone service
• What software services is the service an extension to: Our GrantsNow Solution is built on Oracle Cloud PaaS Solution and is an innovative extension to Oracle's Post award solution.
• Cloud deployment model: Public cloud
• Service constraints: N/A
• System requirements: Grants fund opportunity capture, Capture Multiple projects and awards

User support

• Email or online ticketing support: Yes
• Support response times: We respond to questions, tickets raised as per our SLA's defined.
• User can manage status and priority of support tickets: Yes
• Online ticketing support accessibility: WCAG 2.2 AAA
• Phone support: Yes
• Phone support availability: 9 to 5 (UK time), Monday to Friday
• Web chat support: Yes
• Web chat support availability: 9 to 5 (UK time), Monday to Friday
• Web chat support accessibility standard: WCAG 2.2 AAA
• Web chat accessibility testing: N/A
• Onsite support: Yes, at extra cost
• Support levels: This detailed in our service definition document
• Support available to third parties: Yes
• AI chatbot: No

Onboarding and offboarding

• Getting started: We help users start using the service through a structured onboarding and training approach tailored by role (academics/PIs, research office, finance, and system administrators):; ; Implementation workshops & guided onboarding: We run initial setup and discovery workshops, then use iterative show-and-tell sessions so users see configured processes early and can provide feedback before go-live.; ; Blended training delivery (onsite + online): Training can be delivered through a mix of onsite/classroom sessions (where required) and online sessions (to support distributed teams and flexible attendance).; ; Role-based training & train-the-trainer: We provide role-specific, hands-on training for end users, plus train-the-trainer sessions for super users and administrators so knowledge is retained in-house.; ; User documentation & learning materials: We supply practical materials such as quick reference guides, role-based user guides, FAQs, and step-by-step process guidance (and, where helpful, short videos for common tasks).; ; In-system guidance: We support adoption with contextual guidance within the application (for example, prompts and tooltips) to help users complete tasks confidently.; ; Go-live support & hypercare: We provide hypercare after go-live to resolve early queries quickly, stabilise the service, and ensure users embed the new processes into day-to-day working.
• Service documentation: Yes
• Documentation formats: PDF
• End-of-contract data extraction: At the end of the contract, users can extract all their data securely and in full from GrantsNow through several supported methods:; ; Standard data export: Users can export data in common formats such as CSV, Excel, or XML for records, transactions, and configurations.; ; Database extract: For large volumes, a full database export or data dump can be provided, ensuring all project, grant, financial, and audit data are included.; ; API-based extraction: If the organisation has integrations in place, data can be extracted securely via APIs, maintaining structure and relationships between entities.; ; Document and attachment retrieval: All uploaded files, documents, and supporting attachments can be packaged and provided in an accessible format.; ; Audit and configuration reports: Configuration and audit logs can be exported to provide a complete record of system settings and historical activity at the time of contract closure.; ; Support during transition: Fusion Practices provides assistance throughout the extraction and handover process to ensure data integrity, traceability, and compliance with the organisation’s data retention and governance requirements.
• End-of-contract process: End-of-contract process; ; Contract closure planning: We agree an end-of-contract plan with the customer, covering timelines, responsibilities, and any transition requirements.; ; Data extraction and handover: Users are supported to extract all required data (including grants, projects, financial data, audit logs, and documents) in agreed formats. This ensures the organisation retains full ownership and access to its data.; ; Knowledge transfer: Where required, we support handover activities to an incoming supplier or internal team, including documentation and clarification of system configuration.; ; Access wind-down: User access is managed and decommissioned in line with agreed security and data protection requirements.; ; System decommissioning: After confirmation that data extraction is complete, the environment is securely decommissioned in accordance with Oracle PaaS standards and data protection policies.; ; What’s included in the contract price; ; Standard end-of-contract support, including exit planning and coordination.; ; Standard data exports using supported formats and tools.; ; Secure decommissioning of the application environment.; ; Reasonable support time to answer questions and assist with the transition.; ; Additional costs (if required); ; Bespoke or non-standard data extraction requests (for example, complex transformations or additional formats).; ; Extended support beyond the standard exit period.; ; Additional consultancy for detailed knowledge transfer or support to a replacement supplier.; ; Any specialist reporting or analysis requested
• Documentation accessibility standard: WCAG 2.2 AA

Using the service

• Web browser interface: Yes
• Supported browsers:
  • Microsoft Edge
  • Firefox
  • Chrome
  • Safari
  • Opera
• Application to install: No
• Designed for use on mobile devices: Yes
• Differences between the mobile and desktop service: No difference
• Service interface: Yes
• User support accessibility: WCAG 2.2 AAA
• Description of service interface: N/A
• Accessibility standards: WCAG 2.2 AAA
• Accessibility testing: N/A
• API: Yes
• What users can and can't do using the API: All major transactions in the system can be conducted through the API including transfer of master data and creation of objects/transactions in the system
• API documentation: Yes
• API documentation formats: Open API (also known as Swagger)
• API sandbox or test environment: Yes
• Customisation available: Yes
• Description of customisation: Admin can customise/personalise the system. The core functionality remains the same however through configurations business processes can be customised.

Scaling

• Independence of resources: GrantsNow guarantees independence of resources through its deployment on Oracle PaaS, which provides logical isolation and scalable cloud resources for each customer environment. Each customer operates within a dedicated, securely segregated environment, ensuring that data, processing, and configurations are not shared with other users. Oracle PaaS manages capacity, performance monitoring, and auto-scaling to prevent contention between tenants, so demand from one customer does not negatively impact others. Fusion Practices manages the application configuration and service usage within this isolated environment, while Oracle is responsible for the underlying infrastructure resilience and performance.

Analytics

• Service usage metrics: Yes
• Metrics types: Yes. We provide service usage metrics that give visibility of how GrantsNow is being used across the organisation. This includes information such as user activity, volumes of transactions and workflows processed, and system usage by role or function. These metrics help organisations monitor adoption, identify training needs, and support service reviews.
• Reporting types:
  • Real-time dashboards
  • Regular reports
  • Reports on request
• Resource tagging: Yes
• FOCUS resource tagging: No

Resellers

• Supplier type: Not a reseller

Staff security

• Staff security clearance: Conforms to BS7858:2019
• Government security clearance: Baseline Personnel Security Standard (BPSS)

Asset protection

• Knowledge of data storage and processing locations: Yes
• Data storage and processing locations: United Kingdom
• User control over data storage and processing locations: No
• Datacentre security standards: Complies with a recognised standard (for example CSA CCM version 4.0)
• Penetration testing frequency: At least once a year
• Penetration testing approach: Another external penetration testing organisation
• Protecting data at rest:
  • Physical access control, complying with SSAE-18 / ISAE 3402
  • Encryption of all physical media
• Data sanitisation process: Yes
• Equipment disposal approach: Complying with a recognised standard, for example CSA CCM v4.0, CAS (Sanitisation) or ISO/IEC 27001
• Data sanitisation type:
  • Deleted data can’t be directly accessed / Cryptographic Erasure
  • Data Erasure

Data importing and exporting

• Data export approach: Users can export their data from GrantsNow using standard, secure export tools. Data can be extracted in commonly used formats such as CSV or Excel for reporting and archiving, with larger or more complex datasets provided through structured database extracts where required. Documents and attachments can also be exported as part of the process. Fusion Practices supports users during data export to ensure completeness and data integrity, while Oracle manages the underlying platform security as part of Oracle PaaS.
• Data export formats:
  • CSV
  • Other
• Other data export formats:
  • Excel
  • PDF
• Data import formats:
  • CSV
  • Other
• Other data import formats: Excel

Data-in-transit protection

• Data protection between buyer and supplier networks: TLS (version 1.2 or above)
• Data protection within supplier network: TLS (version 1.2 or above)

Availability and resilience

• Guaranteed availability: GrantsNow is delivered on Oracle PaaS and inherits Oracle’s high-availability cloud infrastructure. Oracle provides a service availability target of 99.9% or higher per month for the underlying platform services, excluding scheduled maintenance, as defined in Oracle Cloud Infrastructure SLAs.; ; Availability is monitored continuously by Oracle, with built-in redundancy, fault tolerance, and automated recovery to minimise service disruption. Fusion Practices monitors the application layer and works with Oracle to resolve incidents promptly.
• Approach to resilience: GrantsNow is designed for resilience by leveraging Oracle PaaS and Oracle Cloud Infrastructure, which provides built-in high availability, fault tolerance, and disaster recovery capabilities. The service is hosted in Oracle-managed datacentres with resilient power, cooling, and network connectivity, and is deployed across redundant infrastructure to minimise single points of failure.; ; Data is protected through automated backups, secure replication, and Oracle-managed recovery processes, ensuring services can be restored quickly in the event of an incident. Continuous monitoring and proactive incident management are used to detect and address issues early.; ; Fusion Practices manages application-level resilience, including configuration best practices and controlled change management, while Oracle is responsible for datacentre and infrastructure resilience. Further technical details on the datacentre architecture and resilience measures can be provided on request.
• Outage reporting: Outages for GrantsNow are reported through a combination of Oracle and Fusion Practices communications:; ; Public dashboard: Oracle provides a public service status dashboard showing the availability and health of Oracle Cloud services, including the underlying platform used by GrantsNow.; ; Email alerts: Oracle issues email notifications for major incidents and planned maintenance affecting the platform. Fusion Practices also communicates directly with customers by email for application-level incidents, updates, and resolution progress.; ; API: Oracle provides service health information via APIs for customers who wish to integrate status monitoring into their own tools.

Identity and authentication

• User authentication needed: Yes
• User authentication:
  • Multi-Factor Authentication (MFA)
  • Username or password
• Access restrictions in management interfaces and support channels: Access to management interfaces and support channels for GrantsNow is tightly controlled using role-based access controls and principle of least privilege. Only authorised personnel are granted access based on their job role, with approvals required before access is provisioned.; ; Administrative access protected through strong authentication mechanisms, access rights are reviewed regularly and revoked promptly when no longer required. Support channels are restricted to named customer contacts and authorised Fusion Practices staff, with all access and activities logged and monitored. Infrastructure-level access controls are enforced by Oracle as part of Oracle PaaS, while Fusion Practices manages application-level and support access controls.
• Access restriction testing frequency: At least once a year
• Management access authentication:
  • Multi-Factor Authentication (MFA)
  • Identity federation with existing provider (for example Google Apps)
  • Username or password

Audit information for users

• Access to user activity audit information: Users have access to real-time audit information
• How long user audit data is stored for: At least 12 months
• Access to supplier activity audit information: Users contact the support team to get audit information
• How long supplier audit data is stored for: At least 12 months
• How long system logs are stored for: Between 6 months and 12 months

Security governance

• Named board-level person responsible for service security: Yes
• Security governance certified: Yes
• Security governance standards:
  • CSA CSM version 4.0
  • ISO/IEC 27001
• Information security policies and processes: Fusion Practices operates a formal information security governance framework covering all services, including GrantsNow. We maintain documented information security policies and procedures aligned to recognised standards such as ISO/IEC 27001, covering areas including access control, data protection, incident management, risk management, change management, and supplier security.; ; Security governance is overseen by a named board-level sponsor, with day-to-day responsibility delegated to senior management and the information security function. Clear reporting lines are in place to escalate security risks, incidents, and compliance issues to the appropriate level of management.; ; Adherence to policies is ensured through mandatory staff training, role-based access controls, secure onboarding and offboarding processes, regular risk assessments, internal reviews, and independent external audits.
• Software Security Code of Practice: Yes

Operational security

• Configuration and change management standard: Complies with a recognised standard, for example CSA CCM v4.0 or SSAE-18 / ISAE 3402
• Configuration and change management approach: Fusion Practices follows a controlled configuration and change management approach for GrantsNow, aligned with recognised IT service management and information security practices.; ; All service components (application configurations, integrations, and environment settings) are formally documented and version-controlled, with changes tracked throughout their lifecycle from initial configuration through to retirement. Configuration items are recorded in controlled repositories, ensuring traceability, auditability, and repeatability across environments.; ; All changes are raised through a defined change process, where they are assessed for business and technical impact, including security impact. This assessment considers data protection, access control, segregation of duties, and potential risk introduced by the change.
• Vulnerability management type: Complies with a recognised standard, for example CSA CCM v4.0 or SSAE-18 / ISAE 3402
• Vulnerability management approach: Fusion Practices follows a structured vulnerability management process for GrantsNow. Potential threats are identified through regular vulnerability scanning, independent penetration testing, internal security reviews, and continuous monitoring. Findings are assessed based on severity and risk to the service.; ; Patches are prioritised by risk, with high and critical issues addressed as quickly as possible through controlled change management, and lower-risk items included in planned releases. Platform and infrastructure patching is managed by Oracle as part of Oracle PaaS, while Fusion Practices remediates application-level vulnerabilities. Threat intelligence is sourced from Oracle security advisories, third-party security specialists, penetration test results.
• Protective monitoring type: Complies with a recognised standard, for example CSA CCM v4.0 or SSAE-18 / ISAE 3402
• Protective monitoring approach: Fusion Practices applies protective monitoring for GrantsNow using a combination of application-level logging and Oracle PaaS security monitoring. Potential compromises are identified through audit logs, security alerts, and monitoring of unusual system or user activity.; ; When a potential compromise is detected, it is immediately triaged, investigated, and contained in line with incident management procedures. Appropriate remediation is applied, and customers are notified where required. High-severity security incidents are responded to immediately, with continuous action until resolution. Oracle is responsible for infrastructure-level monitoring and alerts, while Fusion Practices manages application-level monitoring and incident response.
• Incident management type: Complies with a recognised standard, for example, CSA CCM v4.0 or ISO/IEC 27035:2011 or SSAE-18 / ISAE 3402
• Incident management approach: Fusion Practices follows a structured incident management process for GrantsNow, aligned with recognised IT service management practices. Pre-defined procedures are in place for common incident types, including service outages, security events, and access issues, ensuring consistent and timely handling.; ; Users can report incidents via the agreed service desk channels (for example, email or ticketing system), where incidents are logged, prioritised, and tracked through to resolution. Incident progress and resolution updates are communicated during the incident, and formal incident reports, including root cause and corrective actions, are provided to customers where appropriate, particularly for major or security-related incidents.
• Post-quantum cryptography secure: No

Secure development

• Approach to secure software development best practice: Independent review of processes (for example CESG CPA Build Standard, ISO/IEC 27034, ISO/IEC 27001 or CSA CCM v4.0)

Public sector networks

• Connection to public sector networks: No

Pricing

• Discount for educational organisations: Yes
• Free trial available: Yes
• Description of free trial: Vanilla version of the application with limited access features include FEC cost model, preset workflow approvals, pricing contracts & ethics module.

Discount percentage by annual call-off contract value (excluding VAT)

• Less than £250,000: 10%
• Between £250,000 and £500,000: 10%
• Between £500,001 and £1,000,000: 10%
• Between £1,000,001 and £2,500,000: 10%
• Between £2,500,001 and £5,000,000: 10%
• Over £5,000,001: 10%

Non-mandatory Standards and certifications

• ISO/IEC 27001 certification: Yes
• Who accredited the ISO/IEC 27001: ANSI National Accreditation Board
• ISO/IEC 27001 accreditation date: Monday 11 September 2023
• What the ISO/IEC 27001 doesn’t cover: The Product and services are covered under ISO/IEC 27001 certification.
• ISO 28000:2022 certification: No
• ISO 9001 certification: Yes
• Who accredited the ISO 9001 certification: ANSI National Accreditation Board
• ISO 9001 accreditation date: Monday 11 September 2023
• What the ISO 9001 doesn’t cover: The technology services provided to customers covering the associated corporate functions which includes operations, Information Technology, Administration and Human Resource functions.
• Quality management systems (QMS): Yes
• CSA STAR certification: No
• PCI certification: No
• Cyber essentials: Yes
• Please provide your Cyber Essentials Certificate Number: D6a918a8-a9af-461f-a45f-80c55e93e456
• Cyber essentials plus: Yes
• Please provide your Cyber Essentials Plus Certificate Number: Dca762cb-c4a1-4732-94d0-2aa5a898182e
• Other security certifications: No

Social value

• Section B - Commitment for Future: Delivery:

  • Mission: Kick start economic growth. To secure the highest sustained growth in the G7 - with good jobs and productivity growth in every part of the country making everyone, not just a few, better off.

    Policy Outcome 1: Fair work: That offers fair wages and good working conditions. Help people get a job, stay in work, and progress in their careers, with good employment opportunities across the country. Notes: Where there is a large proportion of labour costs in the contract, commercial teams should consider MAC in Outcome 1 as a priority

    • New or retained jobs on the contract workforce in the relevant area that meet the criteria set out in MAC 1b, 1c and 1d
    • New apprenticeships on the contract workforce in the relevant area that meet the criteria set out in MAC 1b
    • Providing opportunities for, and measuring and monitoring of, staff workforce conditions over time, including employee engagement, involvement in decision-making and satisfaction and adapting to any changes in the results, with clear processes for acting on issues identified
    • Payment of more than the National Minimum Wage or National Living Wage (as appropriate) to the contract workforce
    • Monitoring and reporting of gender and ethnicity pay gaps and plans to address them where necessary
    • Understanding of in-work progression issues affecting the market, industry or sector relevant to the contract, and in the supplier’s own organisation and those of its key sub-contractors
    • Measures to support in-work progression to help people in the contract workforce, to move into higher paid work by developing new skills relevant to the contract
    • Support for the contract workforce by providing career advice, and providing opportunities for staff working on the contract with in-work progression career development into known skills shortages or high growth areas
    • Understanding of the modern slavery risks and issues affecting the market, industry, sector or country (of origin or of source) relevant to the contract, and the workforce in the supplier’s own organisation and those of its key subcontractors
    • Measures to identify, mitigate and manage modern slavery risks relating to the contract and how these will be implemented
    • Outline policies and practices to be applied to or put in place for the contract to mitigate and manage modern slavery risks, including: Pre-employment checks, recruitment practices. Workplace conditions, safeguarding plans and processes in place and regular monitoring with relevant groups considered, which may include sampling

  • Mission: Kick start economic growth. To secure the highest sustained growth in the G7 - with good jobs and productivity growth in every part of the country making everyone, not just a few, better off.

    Policy Outcome 2: Skills for growth: Supporting growth sectors and addressing skills gaps.

    • Understanding of employment and relevant skills issues, and of the education and training issues relating to the contract. Illustrative examples: demographics, skills shortages, new opportunities in high growth sectors, geographic/local community and skills/employment challenges
    • Support for educational attainment relevant to the contract, including training schemes that address skills gaps and result in recognised qualifications

  • Mission: Kick start economic growth. To secure the highest sustained growth in the G7 - with good jobs and productivity growth in every part of the country making everyone, not just a few, better off.

    Policy Outcome 3: Resilient, innovative and flexible supply chains: Support economic growth through enabling resilient businesses, opportunities for small businesses and voluntary, community and social enterprises

    • Understanding of the types of businesses in the market and the level of participation by new businesses, entrepreneurs, start-ups, SMEs, VCSEs and mutuals
    • Understanding of local demographics, needs and opportunities for the co-design of the goods, services and works to be delivered under the contract
    • Methods for engaging with different parts of the community (including the education system and charities representing the community) and how communities come together to inform decisions, strategy and projects to leave a positive legacy for future generations

  • Mission: Make Britain a clean energy superpower: To cut bills, create jobs and deliver security with cheaper, zero-carbon electricity by 2030, accelerating to net zero

    Policy Outcome 4: Sustainable procurement practices: Reducing carbon footprints, minimising waste, and promoting the use of clean energy and green technologies.

    • Understanding of opportunities for additional environmental benefits delivery in the performance of the contract, including working towards net zero carbon emissions and use of clean energy and green technologies
    • Understanding of how to influence staff, suppliers, customers, communities and/or any other appropriate stakeholders through the delivery of the contract to support climate and nature protection and improvement

  • Mission: Break down barriers to opportunity: By reforming our childcare and education systems, to make sure there is no class ceiling on the ambitions of young people in Britain

    Policy Outcome 6: Employment and training: For those who face barriers to employment

    • Understanding of employment and skills issues, and of the skills and employment shortages of high growth sectors relating to the contract
    • Creation of employment opportunities particularly for those who face barriers to employment, such as prison leavers, care leavers and/or who are located in deprived areas, and for people in industries with known skills shortages or in high growth sectors
    • Delivery of training schemes and programmes to address any identified skills gaps and under-representation in the workforce for the contract (e.g. prison leavers, care leavers, kinship carers, disabled people)
    • Understanding of the issues affecting inequality in employment, skills and pay in the market, industry or sector relevant to the contract, and in the supplier’s own organisation and those of its key sub-contractors. Measures to tackle inequality in employment, skills and pay in the contract workforce

  • Mission: Break down barriers to opportunity: By reforming our childcare and education systems, to make sure there is no class ceiling on the ambitions of young people in Britain

    Policy Outcome 7: Creating a pipeline of opportunities: For the contract workforce, reducing barriers to entry for under-represented groups.

    • Understanding of the issues affecting the development of new skills by target cohort
    • Other measures to offer development opportunities for the target cohort(s) in the contract workforce
    • Advertising, promotional and outreach activities designed to raise awareness of the offer to reach the target cohort
    • Understanding of issues relating to entering the contract workforce
    • Creation of outreach activities to create a pipeline of employees for the future contract delivery
    • Advertising, promotional and outreach activities designed to raise awareness of the offer to reach the target cohort

  • Mission: Build an NHS fit for the future: That is there when people need it; with fewer lives lost to the biggest killers; in a fairer Britain, where everyone lives well for longer.

    Policy Outcome 8: Increasing productivity through physical and mental wellbeing: In the supply chain and communities in the relevant area.

    • Understanding of issues relating to health and wellbeing, including physical and mental health, in the contract workforce
    • Understanding barriers to access to health and social care services or employment opportunities e.g. digital inclusion

Service documents

• Pricing document

  PDF

• Service definition document

  PDF

• Terms and conditions

  PDF

Request an accessible format

If you use assistive technology (such as a screen reader) and need versions of these documents in a more accessible format, email the supplier at consulting@fusionpractices.com. Tell them what format you need. It will help if you say what assistive technology you use.