A capable product and a capable delivery partner are different propositions.
Use evidence proportional to the consequence
| Dimension | Evidence question | Decision consequence |
|---|---|---|
| Delivery | Who will do the work, where, and with what capacity? | A proposal team is not necessarily the assigned delivery team. |
| Integration | Who owns interfaces, testing and support across suppliers? | Unowned dependencies delay acceptance. |
| Security / data | What assurance applies to this exact service and scope? | A certificate may exclude the product or location being purchased. |
| Financial resilience | What specialist review and continuity safeguards are appropriate? | Financial weakness can change exposure even when service is good. |
| Support | How are priority, coverage and escalation defined? | A response target may not promise restoration. |
| Commercial / exit | Can demand change and data be moved at a tolerable cost? | An initially attractive offer can create long-term dependency. |
Use a risk-based review. A low-risk commodity purchase and a business-critical hosted service do not need the same diligence. Separate legal and regulatory requirements from preferences, and use qualified specialists for judgments outside the sourcing team’s competence.
Ask references about comparable work
A useful reference resembles your scale, complexity and operating environment. Ask what changed between the proposal and delivery, which buyer resources were required, how escalations worked, and what the reference would put in the contract differently. Supplier-selected references are informative but not a random sample.
For professional services, validate the proposed people rather than only the firm’s credentials. For managed services, understand which delivery locations and subcontractors will actually serve the account. For software, distinguish product capability from the implementation partner’s ability.
Treat risk as a decision with an owner
Record the risk event, potential consequence, evidence, mitigation, residual exposure and owner. “Supplier risk: medium” says little about what to do. “The only integration specialist is a subcontractor with no committed availability” identifies a problem that can be resolved or consciously accepted.
Do not invent universal weightings. An operationally critical service may require continuity gates, while a replaceable pilot may permit a limited experiment. The sponsor should see the remaining exposure, not only a color-coded summary.
Keep evaluation alive after selection
A supplier that passes diligence can still change ownership, staffing, financial condition or service architecture. Define review triggers appropriate to the relationship and refresh the assessment when a change could alter the original decision.
Sources & context
- CIPS · Supplier evaluation ↗Supplier assessment is an ongoing activity and can use different forms of evidence.
The decision frameworks and illustrative examples are original editorial guidance. Sources support the stated context; they do not endorse this guide.