skip to content

Vendor Evaluation

Running a real selection: RFI and RFP, weighted scoring, proof-of-concept bake-offs, reference checks, and assessing vendor viability. The part candidates forget is the exit strategy — what happens when you need to leave.

part ofSoftware design & architectureoverview, primer and where to startread it →
on this pageshow

questions

6

In vendor selection, what is the difference between an RFI (Request for Information) and an RFP (Request for Proposal), and why do organizations typically issue an RFI before an RFP?

level: juniorimportance: must knowfreq 70%

answer

  1. RFI = broad filter, RFP = detailed compare
  2. funnel: 15-30 -> 3-6 -> contract
  3. RFQ = pricing-only follow-up
  4. fixed template = apples-to-apples
  5. skip RFI only with strong market knowledge

basics

~20 s

RFI asks vendors 'tell us about yourselves and your product' to narrow a long list. RFP asks the shortlisted vendors 'here's exactly what we need, give us a formal, priced proposal.' RFI happens first so you don't waste a detailed RFP on unqualified vendors.

solid answer

~40 s

An RFI (Request for Information) is a broad, low-effort questionnaire sent to a wide pool of potential vendors to gather general capability, market-position, and rough-fit data; it filters a long list (10-30 vendors) down to a manageable shortlist (3-6). An RFP (Request for Proposal) is a detailed, formal document sent only to that shortlist, containing specific requirements, technical/functional/non-functional criteria, pricing structure requests, SLAs, and often a mandatory response template so proposals can be compared apples-to-apples. Issuing RFI first saves effort: vendors don't waste time on a heavyweight proposal they'd lose anyway, and the buying org doesn't build detailed scoring criteria for vendors that were never realistic contenders. Skipping straight to RFP with a huge vendor list burns procurement cycles and often produces inconsistent, hard-to-compare responses.

go deeper

for a junior

Should know the basic definitions and ordering - RFI narrows a wide list cheaply, RFP is the detailed formal ask sent to the shortlist - and be able to say roughly what kind of info goes in each.

for a middle

Should be able to design a basic RFI questionnaire and explain why skipping it can waste RFP effort, and should know an RFQ typically follows for pricing.

for a senior

Should be able to justify when to skip the RFI stage, design RFP scoring criteria tied to actual system constraints rather than generic templates, and catch requirements that won't differentiate vendors.

for a principal

Should treat the RFI/RFP funnel as one input to a broader vendor risk process - tying it to procurement policy, audit trail requirements, and how the process interacts with contract negotiation leverage.

## The funnel, not a single step Vendor selection for significant purchases follows a funnel, not a single step. An **RFI (Request for Information)** is the entry point: a short, structured questionnaire sent to a broad market scan of vendors (anywhere from 10 to 30+) asking about: - company size, years in business - product capabilities at a high level - target customer profile - integration options - rough pricing tier It's cheap to answer (a few hours of a vendor's sales-engineering time) and cheap to evaluate (a spreadsheet skim), by design. An **RFP (Request for Proposal)** is the next stage, sent only to the shortlist that survives RFI filtering (typically 3-6 vendors). It's a formal, detailed document: - specific functional and non-functional requirements - mandatory vs nice-to-have features - SLA expectations - security/compliance requirements - implementation timeline asks - a fixed response template so every vendor answers the same questions in the same structure, enabling line-by-line comparison Some organizations add an **RFQ (Request for Quote)** as a further narrowing step focused purely on pricing once functional fit is established. ## Why two stages The two-stage structure exists to **manage cost and risk on both sides of the table**. Writing a rigorous RFP — with weighted criteria, security questionnaires, reference requirements, and legal terms — is expensive: it can take a solution architect and a procurement lead days of work, and evaluating five or more full RFP responses in that depth is a multi-week effort. If that cost is spent against a wide field, most of it is wasted on vendors that were never going to win. The RFI acts as **a cheap filter**: it eliminates vendors that don't meet baseline criteria before anyone invests in the expensive comparison — - wrong company size - no relevant integrations - unsupported deployment model - obviously wrong price tier It also protects vendors' time and goodwill — a vendor who spends two weeks on a detailed proposal for a deal they had zero chance of winning is a vendor who deprioritizes the buyer next time. ## What the funnel costs The cost of the two-stage approach is **time and process overhead**: running an RFI adds calendar weeks to a project before RFP work even starts, which is a real problem under schedule pressure. Some organizations skip the RFI when the market is already well understood (e.g., there are obviously only three viable vendors for a given enterprise capability) and go straight to RFP — a legitimate shortcut, not a mistake, when the buyer already has strong market knowledge. The opposite failure is treating the RFI as a formality and inviting everyone who responds well into the RFP stage regardless of fit, which defeats the purpose of the filter and just moves the wasted effort one stage later. ## Where it goes wrong 1. **RFP fatigue driving lazy comparison** is the most common process failure: after weeks of vendor demos and hundreds of pages of proposals, evaluators default to gut feel or to whichever vendor's sales team built the best rapport, rather than to the criteria defined up front. 2. Another failure is an RFP whose **requirements were written generically** (copied from a template) rather than from the actual system's constraints, so every vendor scores similarly and the document produces no real signal. 3. A third, more expensive failure **surfaces only after signing**: the RFI/RFP process asked about current capabilities but never asked about roadmap, financial stability, or exit terms, so the org discovers post-contract that the product doesn't do something it assumed, or that the vendor is being acquired and the roadmap is about to change. ## A worked example A mid-size company needs a new customer data platform. They send an RFI to 15 vendors ranging from point-solution startups to full suite players, asking about deployment model (SaaS vs self-hosted), data residency options, and rough annual cost. Eight responses come back; five are eliminated immediately because they're SaaS-only and the company has a hard on-prem requirement for one region, and three more are eliminated for being priced far outside budget. The remaining seven go to a quick capability call, narrowing to four. Those four receive the full RFP: - a 40-requirement scored questionnaire - a security/compliance annex - a request for three reference customers of similar size and industry - a fixed-format pricing table Only at that point does the team invest in multi-week evaluation — because the funnel already removed vendors that would have failed on hard constraints, the RFP stage is spent comparing genuinely viable options rather than filtering out obviously wrong ones.

  • If your organization already knows there are only two realistic vendors for a capability, is it still worth running a formal RFI?
    Usually no - a full RFI adds weeks of process for a market you already understand, so it's reasonable to go straight to RFP with those two vendors. The exception is when you want the RFI's byproduct of a paper trail showing you considered the market broadly, which matters for procurement compliance or audit in regulated industries.
  • How should the RFP's fixed response template be designed so vendors can't game it?
    Ask for evidence, not just claims - require named reference customers, specific version numbers, and yes/no answers to hard constraints before free-text elaboration. Score each requirement independently rather than letting a strong overall narrative compensate for a missing hard requirement.
  • What's a sign the RFP stage is being rushed and will produce a weak signal?
    Requirements copied from a generic template rather than derived from the actual system's integration points, data volumes, and compliance needs; when every vendor scores within a point of each other, the criteria weren't specific enough to differentiate real capability.

It's like dating apps before a first date: RFI is swiping through profiles to filter out obvious mismatches cheaply, RFP is the structured first date where you both ask the same set of serious questions before deciding to go steady.

saying these in an interview costs you the question

  • Treats RFI and RFP as the same document just sent to different lists
  • Can't explain why the shortlist was narrowed to specific vendors
  • Never mentions asking for reference customers or roadmap in the RFP
  • Assumes RFI/RFP only applies to huge enterprise purchases
  • No idea what an RFQ is or conflates it with RFP

context

open as a page

How does a weighted scoring matrix work for comparing vendor proposals, and what's the most common way teams misuse it to justify a decision they'd already made?

level: middleimportance: must knowfreq 65%

basics

~20 s

You list the things that matter (price, features, support...), give each a weight based on importance, score every vendor on each item, multiply and add up. The misuse: picking the weights AFTER seeing the favorite vendor score well, to make the math match a decision already made.

open as a page

What concrete forms does vendor lock-in take beyond 'it's hard to switch,' and what should an exit strategy documented during vendor selection actually contain?

level: seniorimportance: must knowfreq 60%

basics

~20 s

Lock-in isn't just a feeling - it's specific things like your data being stuck in a proprietary format, custom code that only works with that vendor's API, or contract penalties for leaving. An exit strategy written down before you sign lists exactly how you'd get your data out, how long it would take, and what it would cost, so you're not stuck figuring it out under pressure later.

open as a page

When running a proof-of-concept 'bake-off' between two or three shortlisted vendors' products, what design choices keep the comparison fair, and what commonly makes POC results look good in the trial but misleading once the product is actually in production?

level: seniorimportance: must knowfreq 55%

basics

~20 s

Give every vendor the same test, same data, same amount of help, and same success criteria decided beforehand - otherwise whoever gets more attention or an easier task wins unfairly. POCs often look great because vendors hand-hold and use small clean data, which doesn't reflect real production scale, messy data, or the support you'll get after you've already paid.

open as a page

When you call the reference customers a vendor gives you, why is that alone not enough to trust reference checks, and what should you actually do to get more honest signal?

level: middleimportance: should knowfreq 50%

basics

~20 s

The vendor obviously hands you their happiest customers, so those calls will sound great almost by design. To get honest signal, find some references yourself, ask specific pointed questions about problems and support response times instead of 'are you happy,' and talk to people who actually use the product day to day.

open as a page

What signals indicate a vendor might not be viable long-term, financially or strategically, and how should that risk change how you structure the contract and architecture around their product?

level: principalimportance: should knowfreq 45%

basics

~20 s

Watch for things like the vendor burning cash with no clear path to profit, losing key customers or executives, being a tiny player in a market big companies are entering, or getting acquired by a competitor of yours. If a vendor looks risky, you build in ways to leave fast, like source-code escrow, shorter contracts, and less deeply integrated architecture, rather than betting everything on them surviving.

open as a page