Use non-negotiable gates first, weighted scoring second. A high feature score should not offset a failed mandatory security, residency or access requirement.
Which gates should precede scoring?
Require the selection team to approve:
- Security, residency, retention and access arrangements for the proposed deployment.
- A first critical workflow that works in the proposed, commercially available configuration.
- Permissions and separation of responsibilities appropriate to the programme.
- A feasible migration and historical-record access plan.
- A demonstrated export and transition approach.
- Named implementation and operating owners.
- AI controls, where AI functionality is in scope.
How should weights vary by buyer?
These are proposed starting weights, not empirically validated benchmarks. Each column totals 100%.
| Evaluation criterion | CRO-led bank | SOX/internal-audit-led | CISO-led programme |
|---|---|---|---|
| Risk model, hierarchy and reporting | 20% | 10% | 10% |
| Specialist controls and assurance workflow | 15% | 25% | 15% |
| Evidence and integration behaviour | 10% | 15% | 25% |
| Migration, history and exit | 15% | 10% | 10% |
| Contributor usability and administration | 15% | 15% | 15% |
| Security and AI assurance beyond mandatory gates | 10% | 10% | 10% |
| Three-year cost and delivery confidence | 15% | 15% | 15% |
Score observed performance from 0–5 against agreed anchors. Keep not demonstrated separate from cannot meet. Do not present a final numerical ranking while material weighted criteria remain untested.
For each score, retain:
requirement → business owner → scenario → observed result → configuration dependency → implementation cost → acceptance owner
Which demonstration scenarios expose meaningful differences?
| Scenario | What a useful pass should demonstrate |
|---|---|
| Overdue remediation | Correct ownership, escalation, revised due dates and visible history |
| Disputed risk score | Original assessment, challenge, rationale and authorised approval remain traceable |
| Shared control failure | Appropriate impact on each linked risk or obligation without indiscriminate propagation |
| Failed integration | Failure detection, stale-data visibility, reconciliation and recovery |
| Restricted evidence | Unauthorised users cannot retrieve the item through search, reporting, AI or export |
| Administrator change | Buyer staff can make and test a supported change using the agreed release process |
| Bulk export | Records, relationships and required evidence can be reconstructed outside the platform |
| AI uncertainty | Missing evidence is acknowledged rather than converted into a confident conclusion |