Scope and model-type fit
Evidence for the exact models, uses, jurisdiction, and materiality in scope.
MRM vendor evaluation scorecard
Score evidence, not brand familiarity. Adjust the weights to match the engagement, enter a 0 to 5 score for each criterion, and capture the evidence behind the number.
Weighted score0.0 / 5.0Weights total 100%
Method and validation depth
Defensible tests, assumptions, challenge, reproducibility, and limitations.
Framework and policy precision
Current, exact citations and a traceable requirement-to-control mapping.
Independence and conflicts
Clear separation, disclosures, escalation, and credible challenge.
Workflow and evidence
Approvals, findings, exceptions, history, workpapers, and complete export.
Security and privacy
Identity, least privilege, encryption, logs, retention, deletion, incidents, and subprocessors.
Integrations and portability
APIs, identity, data, monitoring, reporting, migration, and exit.
Implementation and support
Named team, plan, dependencies, training, administration, service levels, and continuity.
Commercial terms and TCO
Complete three-year cost, assumptions, renewal, services, environments, and change fees.
Scoring rule. A high total does not override a failed security, independence, legal, or mandatory capability gate. Define pass/fail gates before vendor demos and record who approved each score.