There is no standard frequency for checking whether HR software still fits the company — «once a year» is a comfortable answer, but not a particularly useful one. What actually should trigger a review is specific changes inside the company, not the calendar.
The risk of not reviewing is not «ending up with outdated software» in the abstract. It is more specific than that: continuing to apply a setup that stopped being correct the day something changed, and not noticing until there is a calculation error or a penalty attached to it.
When someone's corporate role changes
A very concrete example: if someone becomes a company director, their income tax stops being calculated the same way as everyone else's. Under Spain's general regime, income tax withholding is progressive; for company directors, a fixed rate applies, with a reduction available for smaller companies. HR usually knows about this change the day it happens, but in practice it is easy to forget to update it in the payroll system until someone reviews a payslip and the numbers do not add up. This kind of corporate role change should always trigger a review of how that person is configured in the system. This isn't a change tied to company size: it can happen in a 10-person company just as easily as in a 200-person one.
When headcount grows or a new location opens
Going from 20 to 60 people, or opening a second site, changes what is needed: separate team calendars per location, more absence types with their own approval rules, or health-and-safety tracking that can no longer depend on one person «remembering everything». If the system is still set up the way it was on day one, headcount has outgrown the configuration. None of this requires switching providers: it's often just a matter of turning on the absence types or calendars that weren't needed before.
When the rules change
Time-tracking requirements, labor-inspection standards, or remote-work caps are not static — Spain, in particular, has seen its working-time and labor-inspection rules evolve. Every relevant regulatory change is a good excuse to ask: is what we are doing in the system today still what the law requires, or what it required two years ago?
What to check at each review
A useful review doesn't require going through the whole system top to bottom. It's enough to check three things: whether roles and permissions still reflect who does what today, whether absence types and their approval rules still fit the current workforce, and whether payroll calculations — tax, overtime, remote-work caps — are still applying the right rules to each person, not the ones that applied a year ago.
A review does not have to be a full audit every time. It is enough to treat it as a natural consequence of any change in role, size or regulation, not as a calendar task that keeps getting postponed indefinitely.