vendor_scorecards v1.0.0

name: "vendor_scorecards" description: "Score and review third-party vendors with weighted scorecards, risk flags, and tiered review cadence. Triggers when comparing vendors for a purchase, running a quarterly business review, or setting up ongoing vendor performance monitoring."

Vendor Scorecards

Purpose

Turn vendor comparisons and ongoing reviews into numbers you can defend: weighted criteria, go/no-go minimums, risk flags, and a review cadence matched to vendor tier.

Workflow

1. Tier the vendors (critical / important / standard) by data access and replaceability. The tier sets the review rhythm; see references/cadence.md.
2. Set go/no-go minimums first: certifications, budget ceiling, non-negotiable contract terms. Agree criteria, weights, and method before the tender and tell the suppliers what they are.
3. Build criteria.csv from references/criteria-library.md: pick 8-12 criteria, weight by failure mode (heaviest weight = the failure that hurts most), and for every numeric metric set a threshold (scores 0) and a target (scores 100). Never score the same capability twice.
4. Collect evidence, not impressions. Every row in scores.csv cites its source. Graded criteria use the 0-10 rubric: 0 no control, 3 claimed or self-attested only, 6 documented and tested, 8 independently verified, 10 verified and proven in production.
5. Score it: python3 bin/scorecard.py score --criteria criteria.csv --scores scores.csv --flags flags.csv --output report.md
6. Log risk flags in flags.csv using the codes in references/risk-flags.md. A critical flag or a failed minimum blocks the award until cleared.
7. Selection: report the ranked table with per-dimension breakdowns and recommend preferred / backup / HOLD. Ongoing reviews: re-run the same scorecard on the tier's cadence, open each QBR with the trend and last quarter's action items, and use the templates in assets/.

Tooling

• bin/scorecard.py init --out DIR: writes template criteria.csv, scores.csv, flags.csv.
• bin/scorecard.py score --criteria C --scores S [--flags F] [--output R]: two-point metric scoring, 0-10 graded scoring, weight normalization, go/no-go check, flag integration, ranked markdown report.
• assets/qbr-agenda-template.md, assets/review-memo-template.md: fill-in templates for reviews.
• examples/payment-processor/: full three-vendor run; see references/worked-example.md for the walkthrough.

Output Contract

A comparison delivers: ranked scores out of 100 with per-dimension breakdowns, go/no-go status, open risk flags with required actions, evidence citations per score, and a recommendation (preferred / backup / HOLD). A review cycle delivers the same plus the trend against last period and the status of prior action items.

Operating Rules

1. Set criteria and weights before seeing vendor data. Never after.
2. Thresholds and targets come from real requirements. A threshold tuned to flatter the incumbent is rigging.
3. No score without evidence. Unverifiable claims are cut or flagged, never scored.
4. Weights need not sum to 100; the tool normalizes. Heaviest weight goes to the dimension whose failure predicts the most downstream damage.
5. A failed minimum or a critical flag stops the award conversation, no matter how high the score.
6. Keep it lean: 8-12 criteria. When everything is important, nothing is.
7. Re-score on cadence. A scorecard run once is a snapshot, not a control.