Use these weights as the default for a phased enterprise deployment. The anchors describe the proposed solution and operating plan, not a supplier’s reputation.
The table supplies 1, 3 and 5 anchors for every criterion. The following section explains zero scores, intermediate scores and evidence caps.
| ID and criterion | Weight | 1 — Weak | 3 — Acceptable for the agreed scope | 5 — Strong |
|---|---|---|---|---|
| C1. Operating-model and workflow fit | 15% | Generic registers; ownership and approval decisions remain outside the system | Named owners, approvals, exceptions and essential risk/control/action relationships work | Buyer reproduces end-to-end workflows, disputed decisions and entity-level roll-ups without unapproved workarounds |
| C2. Specialist depth and assurance separation | 8% | A general workflow is presented as a substitute for essential audit, controls, IT-risk or third-party-risk work | The chosen specialist use case works, including required reviewer and management separation | Specialist users complete realistic testing, challenge, review and closure scenarios with defensible evidence |
| C3. Migration, history and data quality | 12% | “Upload a CSV” with no field, relationship or historical-retention design | Approved mapping, cleansing ownership and representative reconciliation; history/archive treatment is explicit | Repeatable migration rehearsal reconciles records, attachments, relationships and retained provenance, with rollback and exception handling |
| C4. Implementation plan and delivery capacity | 12% | Generic schedule, unnamed team and unspecified buyer effort | Named delivery roles, resource assumptions, dependencies, acceptance milestones and change control | Delivery commitments and buyer capacity are corroborated; critical dependencies and cutover are rehearsed; comparable references are checked |
| C5. Integrations and evidence reliability | 10% | Connector logos or one successful data transfer | Required objects, directions, identity, mappings and error ownership are demonstrated | Buyer verifies failure detection, retry, duplicate prevention, reconciliation and recovery at representative load |
| C6. Security, privacy and resilience | 10% | Badge-led assurance; unclear access, recovery or processing arrangements | Approved architecture and supplier review; scoped access tests and recovery evidence meet buyer requirements | Permission boundaries, privileged actions and recovery arrangements withstand buyer-defined adverse scenarios; residual risks are explicit |
| C7. Business-user adoption | 8% | Specialists navigate everything; contributors need continual assistance | Representative occasional users complete assigned tasks within buyer-set limits | Unassisted users handle reassignment, rejection and escalation; measured friction and support needs fit the operating plan |
| C8. Administration and changeability | 5% | Routine changes depend on external specialists without a costed service model | Buyer administrators make agreed routine changes using documentation and controlled environments | Administrators repeat changes, regression checks, deployment and rollback; support and upgrade responsibilities are clear |
| C9. Reporting and decision traceability | 5% | Attractive dashboards with unclear definitions or off-system reconciliation | Required reports reconcile to underlying records, owners and evidence | Buyer reproduces historical reporting, exclusions and calculation logic and traces decisions without unexplained manual adjustments |
| C10. Three-year TCO and commercial terms | 10% | Subscription-only comparison, unpriced dependencies or unclear expansion costs | Comparable USD cost model fits the approved ceiling; material inclusions, assumptions and terms are agreed | Base cost fits the preferred budget, downside exposure is acceptable, and growth, renewal and change-cost mechanisms are defined |
| C11. Exit and supplier continuity | 3% | “Your data is yours” without usable extraction or transition arrangements | Representative export is usable; retention, assistance, access and charges are agreed | Buyer reconstructs selected records outside the platform; transition and disruption contingencies have owners, resources and tested steps |
| C12. AI feature assurance, if in scope | 2% | Fluent output without traceable evidence, permission testing or accountable approval | Approved use cases have source checks, permission controls, human review and disablement | Buyer-held-out tests demonstrate acceptable quality and review effort, including conflicting evidence and adversarial-document cases |
| Total | 100% |
Who should own each score?
Assign one accountable evaluator per criterion, supported by the relevant specialists:
- C1: CRO or first-workflow process owner.
- C2: audit, compliance, security or third-party-risk leader for the selected specialist use case.
- C3–C4: programme lead, supported by data owners and delivery assurance.
- C5–C6: enterprise architect and CISO respectively.
- C7: business-user representative, not only the implementation team.
- C8: the person expected to administer the production platform.
- C9: reporting owner, with audit challenge where appropriate.
- C10: finance and procurement.
- C11: procurement, records management and architecture.
- C12: AI-risk owner with the intended business users.
Record disagreements. Do not average away a security or assurance objection by counting more favourable votes from other functions.