Ask vendors to demonstrate exceptions, permissions and administration using the same buyer-controlled scenario. Our proposed demo script tests whether the system remains useful when work is late, disputed, incomplete or technically interrupted.
| Test | Observable acceptance condition |
|---|---|
| Overdue remediation | Escalation follows the agreed rules; accountability remains visible |
| Disputed risk score | Original assessment, challenge, approval and final rationale remain traceable |
| Failed connector | Failure is visible; stale data does not silently appear current |
| Restricted evidence | An unauthorised user cannot retrieve the file through search, reports, notifications or AI |
| Owner departure | Reassignment preserves previous actions and approvals |
| Changed control | Historical testing remains associated with the correct version |
| Administrator change | Your administrator changes a field or approval step and demonstrates its controlled release |
| Bulk export | Records, relationships and agreed supporting material can be reconciled outside the platform |
For every test, record the outcome, configuration used, workarounds, elapsed user effort and unresolved assumptions. Ask the vendor to explain anything prepared outside the visible session.
After the vendor-led demonstration, let an occasional control owner complete a task and let your administrator repeat a configuration change. Treat this as evaluation, not free implementation: keep the dataset synthetic or properly redacted and the scope bounded.
Carry the successful scenarios into contractual acceptance testing. A polished demonstration should become a reproducible acceptance test—not merely a favourable impression.