---
name: "vendor_scorecards"
description: "Score and review third-party vendors with weighted scorecards, risk flags, and tiered review cadence. Triggers when comparing vendors for a purchase, running a quarterly business review, or setting up ongoing vendor performance monitoring."
---

# Vendor Scorecards

## Purpose
Turn vendor comparisons and ongoing reviews into numbers you can defend:
weighted criteria, go/no-go minimums, risk flags, and a review cadence
matched to vendor tier.

## Workflow
1. Tier the vendors (critical / important / standard) by data access and
   replaceability. The tier sets the review rhythm; see `references/cadence.md`.
2. Set go/no-go minimums first: certifications, budget ceiling,
   non-negotiable contract terms. Agree criteria, weights, and method before
   the tender and tell the suppliers what they are.
3. Build `criteria.csv` from `references/criteria-library.md`: pick 8-12
   criteria, weight by failure mode (heaviest weight = the failure that
   hurts most), and for every numeric metric set a threshold (scores 0) and
   a target (scores 100). Never score the same capability twice.
4. Collect evidence, not impressions. Every row in `scores.csv` cites its
   source. Graded criteria use the 0-10 rubric: 0 no control, 3 claimed or
   self-attested only, 6 documented and tested, 8 independently verified,
   10 verified and proven in production.
5. Score it:
   `python3 bin/scorecard.py score --criteria criteria.csv --scores scores.csv --flags flags.csv --output report.md`
6. Log risk flags in `flags.csv` using the codes in `references/risk-flags.md`.
   A critical flag or a failed minimum blocks the award until cleared.
7. Selection: report the ranked table with per-dimension breakdowns and
   recommend preferred / backup / HOLD. Ongoing reviews: re-run the same
   scorecard on the tier's cadence, open each QBR with the trend and last
   quarter's action items, and use the templates in `assets/`.

## Tooling
- `bin/scorecard.py init --out DIR`: writes template `criteria.csv`,
  `scores.csv`, `flags.csv`.
- `bin/scorecard.py score --criteria C --scores S [--flags F] [--output R]`:
  two-point metric scoring, 0-10 graded scoring, weight normalization,
  go/no-go check, flag integration, ranked markdown report.
- `assets/qbr-agenda-template.md`, `assets/review-memo-template.md`:
  fill-in templates for reviews.
- `examples/payment-processor/`: full three-vendor run; see
  `references/worked-example.md` for the walkthrough.

## Output Contract
A comparison delivers: ranked scores out of 100 with per-dimension
breakdowns, go/no-go status, open risk flags with required actions,
evidence citations per score, and a recommendation (preferred / backup /
HOLD). A review cycle delivers the same plus the trend against last period
and the status of prior action items.

## Operating Rules
1. Set criteria and weights before seeing vendor data. Never after.
2. Thresholds and targets come from real requirements. A threshold tuned to
   flatter the incumbent is rigging.
3. No score without evidence. Unverifiable claims are cut or flagged, never scored.
4. Weights need not sum to 100; the tool normalizes. Heaviest weight goes to
   the dimension whose failure predicts the most downstream damage.
5. A failed minimum or a critical flag stops the award conversation, no
   matter how high the score.
6. Keep it lean: 8-12 criteria. When everything is important, nothing is.
7. Re-score on cadence. A scorecard run once is a snapshot, not a control.