Blog
Scoring vendors without false precision
Dashboards love decimals. Vendor diligence rarely earns them. When a fintech desk scores a payments processor 73.4 against a KYC utility at 71.8, leadership may believe the difference is meaningful. Often it is noise dressed as science.
Prefer bands over false decimals
Three to five ordinal bands — for example Accept, Accept with conditions, Pause, Decline — usually communicate more honestly than a 100-point scale. If you must use numbers for sorting, keep them coarse and pair every score with a one-paragraph narrative floor.
Weight what you can defend
If data residency matters more than logo placement on a SOC report cover, say so in the rubric before you score. Hidden weights create arguments after the fact. Questionnaire Craft Studio participants practice writing those weights in plain language first.
Separate inherent exposure from control performance
A small analytics vendor with limited data access can score “strong controls” and still sit in a lower inherent-exposure band than a core processor. Mixing those axes into one number hides the story boards need.
When to refuse a score
Incomplete evidence is not a medium score. It is an incomplete review. Label it that way, set a date to reopen, and avoid inventing precision that will haunt you in the next audit of the audit.
More on structuring judgments appears in our course list and the topical guide to vendor due diligence audits for fintech.