Why

Your real risk isn't a lead going cold — it's an order shipping before Quality has signed off the bona fide customer check, which is a regulatory failure, not a sales one. At ~20 enquiries/month two teams of 8 don't need pipeline software; they need one shared place where every enquiry has an owner, a status, and a timestamped Quality sign-off before Orders can act. Email alone can't prove that chain. A generic sales CRM dropped on top of an undefined process will give you the same mess, just searchable.

What you actually need

1. A written 1-page SOP for the enquiry → quality check → order release flow — who touches it at each stage, what evidence Quality must attach (WDA licence, ship-to verification), and what "approved" looks like in writing. Do this before any software.
2. HubSpot Free CRM (free, unlimited users) — use the shared inbox + a single deal pipeline with stages *New Enquiry → Quality Review → Quality Approved → Order Processing → Shipped*. Every stage change and note is timestamped per user, which is the closest thing to an audit log you get for free.
3. Capsule CRM — Starter around $18/user/mo (UK-built, check current GBP pricing on capsulecrm.com) as the paid alternative if HubSpot feels too sales-flavoured — it gives you shared mailbox, custom fields, and email templates with a clean per-contact history.

Do this today

Open a shared Google Doc, write the 5 stages above as columns, and list every open enquiry from the last 30 days in one column with the name of the person responsible for the next action and what Quality still needs to see. One page, 30 minutes, one owner. That document is your interim audit trail and the spec sheet for whichever tool you pick next week.

What to ignore

Anything pitched as "GDP-compliant pharma CRM" — Veeva, Salesforce Life Sciences, or HubSpot Enterprise — for 20 enquiries a month. Salesforce is built for large orgs with dedicated admins and complex multi-team process; for SMBs under 10 people it's massively over-built and costly. Validated/GxP systems matter when you're manufacturing or running clinical data, not for logging B2B enquiries from licensed wholesalers.

What doing nothing costs you

One missed bona fide check is worth more than a year of any CRM subscription — not in lost revenue, in MHRA exposure. The cost here is regulatory, not commercial, and email threads won't defend you in an inspection.

Where this leaves you

Once the SOP exists, the right tool gives you three things: a single inbox both teams see, a Quality-sign-off stage Orders can't skip, and a per-record timeline an inspector could read. Pick the tool after the process — most pharma suppliers do it backwards and end up with expensive software enforcing nothing.

When to revisit this

Revisit when monthly enquiries cross ~80, or the first time Quality and Orders disagree about whether a customer was actually approved.