Vendor Risk Evaluation: Delivery Risk vs. Lock-In Risk
The Trap
Compressing vendor risk into a single score or an overall gut feeling.
The Reframe
Vendor risk isn't one thing. It's at least two separable dimensions that need to be evaluated independently, because they don't move together.
The Two Dimensions
1. Delivery / Competency Risk
Is what you need from this vendor within their core competency, or is it an edge capability they can technically do but isn't their main business?
Example: a steakhouse's core competency is cooking steak, so the risk there is low. Asking them to cook Chinese food is something they could attempt, but it's outside the norm and carries higher risk.
Applied to vendor selection: is this vendor's core business what you're hiring them for, or a side capability they're stretching into?
2. Lock-In / Replacement Risk
Separate from whether they can deliver, how hard is it to leave if you need to?
If the vendor goes out of business, raises prices sharply, or underperforms, what does replacing them actually cost in time, data migration, retraining, or lost leverage?
Why Keep Them Separate
A vendor can be excellent at delivery (low risk on the first dimension) but brutal to exit (high risk on the second), or the reverse. Collapsing both into one score hides which kind of risk you're actually carrying.
How to Use This
- Build a Feature Comparison Table first to establish the shortlist and baseline requirements.
- For each finalist, score delivery risk and lock-in risk separately. Don't average them into one number.
- Decide which risk your organization is more able to tolerate (short-term delivery misses vs. long-term lock-in exposure) and weight the decision accordingly.