Vendor Review
When to use
Use this to evaluate a prospective or incumbent vendor before purchase, renewal, or replacement, when comparing shortlisted options, or when a spend needs a defensible recommendation for approval.
Not for: deep security due diligence alone (use ops-risk-assessment for that dimension), or negotiating price once the vendor is already chosen. This produces the decision, not the contract.
Method
- Frame the decision. State the need the vendor fills, the alternatives (including build and do-nothing), and the decision deadline.
- Score capability fit. Rate how well the offering meets must-have and nice-to-have requirements; note gaps. Decision: any unmet must-have is disqualifying regardless of price — flag it before scoring further.
- Compute TCO. Sum all costs over the horizon: license/subscription, implementation, integration, training, support, and exit/migration. Do not stop at sticker price.
- Assess risk. Evaluate financial stability, security/compliance posture, lock-in and data portability, SLA strength, and support responsiveness.
- Weigh trade-offs. Build a weighted scorecard across cost, fit, risk, and support; compute a total per option.
- Recommend. Give a clear choose / negotiate / reject verdict with reasoning and the conditions or contract terms to secure.
- Plan the exit. Note how to leave if it fails — data export and switching cost.
Example
Comparing Vendor A ($40k/yr sticker) vs. Vendor B ($55k/yr). TCO over 3 years: A = $180k (heavy integration + no bulk export), B = $175k (turnkey, clean export API). A fails the must-have "SSO" gap. Weighted scorecard (fit 40%, TCO 30%, risk 20%, support 10%): B wins 8.1 vs. 6.2. Verdict: choose B; negotiate a 3-year price lock and a data-export SLA. Exit: B's export API keeps switching cost low.
Pitfalls
- Anchoring on sticker price. Implementation, integration, and exit costs often dwarf the license; TCO is the real number.
- Ignoring lock-in. A cheap vendor you can't leave is expensive later — always price the exit.
- Scoring without weights. Equal-weighting a nice-to-have against a must-have produces a wrong winner; weight deliberately.
- No do-nothing baseline. Without the build/status-quo alternative, every vendor looks justified.
Output format
Need: problem + alternatives (incl. build / do-nothing) + deadline
Capability: requirement | must/nice | met? | notes
TCO table: cost line | year 1 | ongoing | total over horizon
Risk: dimension | rating | notes
Scorecard: criterion | weight | score per option | totals
Recommendation: verdict (choose/negotiate/reject) | rationale | terms
Exit plan: data export | switching cost
1---2name: ops-vendor-review3description: Evaluate a vendor on capability fit, total cost of ownership, and risk, ending in a defensible choose/negotiate/reject verdict.4---56# Vendor Review78## When to use9Use this to evaluate a prospective or incumbent vendor before purchase, renewal, or replacement, when comparing shortlisted options, or when a spend needs a defensible recommendation for approval.1011**Not for:** deep security due diligence alone (use ops-risk-assessment for that dimension), or negotiating price once the vendor is already chosen. This produces the *decision*, not the contract.1213## Method141. **Frame the decision.** State the need the vendor fills, the alternatives (including build and do-nothing), and the decision deadline.152. **Score capability fit.** Rate how well the offering meets must-have and nice-to-have requirements; note gaps. *Decision:* any unmet must-have is disqualifying regardless of price — flag it before scoring further.163. **Compute TCO.** Sum all costs over the horizon: license/subscription, implementation, integration, training, support, and exit/migration. Do not stop at sticker price.174. **Assess risk.** Evaluate financial stability, security/compliance posture, lock-in and data portability, SLA strength, and support responsiveness.185. **Weigh trade-offs.** Build a weighted scorecard across cost, fit, risk, and support; compute a total per option.196. **Recommend.** Give a clear choose / negotiate / reject verdict with reasoning and the conditions or contract terms to secure.207. **Plan the exit.** Note how to leave if it fails — data export and switching cost.2122## Example23Comparing Vendor A ($40k/yr sticker) vs. Vendor B ($55k/yr). TCO over 3 years: A = $180k (heavy integration + no bulk export), B = $175k (turnkey, clean export API). A fails the must-have "SSO" gap. Weighted scorecard (fit 40%, TCO 30%, risk 20%, support 10%): B wins 8.1 vs. 6.2. **Verdict: choose B**; negotiate a 3-year price lock and a data-export SLA. **Exit:** B's export API keeps switching cost low.2425## Pitfalls26- **Anchoring on sticker price.** Implementation, integration, and exit costs often dwarf the license; TCO is the real number.27- **Ignoring lock-in.** A cheap vendor you can't leave is expensive later — always price the exit.28- **Scoring without weights.** Equal-weighting a nice-to-have against a must-have produces a wrong winner; weight deliberately.29- **No do-nothing baseline.** Without the build/status-quo alternative, every vendor looks justified.3031## Output format32```33Need: problem + alternatives (incl. build / do-nothing) + deadline34Capability: requirement | must/nice | met? | notes35TCO table: cost line | year 1 | ongoing | total over horizon36Risk: dimension | rating | notes37Scorecard: criterion | weight | score per option | totals38Recommendation: verdict (choose/negotiate/reject) | rationale | terms39Exit plan: data export | switching cost40```