The buyer’s exam
Fifteen questions for any assurance platform, and what a good answer looks like
The questions in a standard request for proposal no longer separate the options in this market, because every platform answers all of them the same way. These fifteen were chosen for the opposite property: each one produces different answers from different products, and each can be answered on a screen in a single meeting by a vendor who has made the decision.
What this paper establishes
- Fifteen questions that separate an assurance platform from a content library with a progress bar on it.
- Each one is answerable on a screen with real records in it, in one meeting, with no follow-up call.
- What a good answer looks like is stated beside every question, so the exam works whoever you end up buying from.
A published review of the five leading compliance-automation platforms in May 2026 concluded that two of them are increasingly indistinguishable on technical capability, and that the procurement decision often turns on which account team a team prefers working with.
That is a problem for buyers rather than for vendors. It means the questions in a standard request for proposal have stopped doing their job: every platform answers all of them the same way, and the evaluation ends up decided on price and personality.
The fifteen below were chosen because they do not have one standard answer. Mark each vendor as you go, and insist on being shown rather than told. Every question here is answerable on a screen with real records in it.
Part one: provenance — can the platform say where a figure came from?
| Question | What a good answer looks like | |
|---|---|---|
| 01 | Pick any mapping on screen. Who says this requirement corresponds to that control — an authority that published it, or you? | The basis is on the row itself, and the two kinds are visibly different |
| 02 | Open a control rating. Show me the document, the reading, the mapping and the person it rests on, above the fold. | All four on the object’s own page, not in a tab called History |
| 03 | Is your audit record tamper-evident, and can my own auditor verify it without your cooperation? | Hash-chained, no delete path, and the verification runs on the customer’s side |
| 04 | Does the product keep “not recorded” apart from “not done”? | Two distinct states, because an auditor treats them differently |
Part two: accountability — who decided, and can a machine decide instead?
| Question | What a good answer looks like | |
|---|---|---|
| 05 | Can your agent file a control rating, a risk treatment or a breach notifiability decision without a person pressing a button? | It cannot, and there is no configuration flag that lets it |
| 06 | Show me an agent action in the audit record. Does it name the permission it was checked against? | Agent actions and human actions in one sequence, each with its permission |
| 07 | Can a machine in your product mark a control not applicable? | Never. Only a person removes a control from scope, with a reason |
| 08 | How do you measure whether your AI is any good on my records rather than on a benchmark? | It counts how many drafts the customer’s own people accept, edit or reject |
Part three: jurisdiction — does the platform know what binds you?
| Question | What a good answer looks like | |
|---|---|---|
| 09 | How many privacy regimes do you carry with their own transfer rules, breach clocks and subject rights, rather than as a checklist of articles? | The law modelled as the primary object, not as one more framework |
| 10 | Does your product distinguish DIFC from ADGM from onshore UAE, and tell three entities three different things? | Free zones are separate regimes, chosen when the entity is created |
| 11 | When was your GDPR content last checked against the instrument, and does a figure resting on lapsed content say so? | A verification date on the pack, a cadence, and an alarm when it lapses |
| 12 | Open one control and show me every requirement, across every framework and regime I am bound by, that its evidence answers. | One list, on the control, spanning frameworks and laws together |
Part four: control — what happens when the relationship changes?
| Question | What a good answer looks like | |
|---|---|---|
| 13 | Can the product run in our own data centre, in our own region, or on a network with no route to the internet? | The same build, with only the machine layer needing an outside call — and that layer able to point at a model inside the network |
| 14 | Which third-party origins execute inside a signed-in session holding our compliance evidence? | A vendor who has made this decision answers "none" in one sentence |
| 15 | What do we still hold if we stop paying — a running instance, an export, a verifiable record, or a login? | The first three. A login is not an answer |
How to run the exam
Send the fifteen to every vendor on the shortlist and ask for a screen rather than a statement against each one. Three habits make the difference between a checklist and an evaluation.
- Insist on real records. A demonstration workspace curated for a sales call will answer every question perfectly and tell you nothing. Ask for the same questions against an export of your own obligations.
- Ask the follow-up once, every time: show me where that is recorded. A vendor whose answer is a feature name rather than a screen has told you the answer.
- Write the answers down as you get them. The pattern across fifteen questions is more informative than any single response, and a vendor who is strong on provenance and weak on jurisdiction is a different purchase from one who is the reverse.
What the answers should cost you
One question deliberately not on the list is price, because a checklist is the wrong place to negotiate. It belongs in the first conversation instead, and the shape of the answer tells you as much as the number: per entity per year, packs included, the machine layer included, no per-seat charge and no surcharge for the AI — with a tier for running the whole platform on your own instance.
A model that charges per seat makes a compliance programme smaller by making its participants expensive, which is the opposite of what the programme needs. A model that charges separately for the AI prices the thing that does the work as an upgrade.
Where to take it next
Run the twenty-minute assessment on the entity you are least sure about before the first vendor meeting. It needs no call and no account, it shows the reasoning behind every obligation it applies and every one it excludes, and it prints a record you keep. Walking into an evaluation already knowing which regimes bind which entity changes what you are able to ask.
Sources
- 1Market review. “Top 5 GRC Platforms 2026: Vanta vs Drata vs Sprinto vs Secureframe vs Scrut”, guptadeepak.com, 15 May 2026. The framework lists, price bands and the observation that two leaders are increasingly indistinguishable on technical capability are that review’s.
- 2Competitor material. Framework coverage, integration counts and agent claims are the vendors’ own published figures, read from their sites in October 2026.
- 3Our own figures. Mapping, regime, tool, draft-kind and acceptance figures are measured from the code on 1 October 2026 and held to it by a test that fails the build when a published document disagrees with the catalogue.
About Conscious
Conscious is an independent assurance platform for organisations that answer to more than one authority. It carries 34 privacy regimes with their own transfer rules, breach clocks and subject rights, and 56 control frameworks, 16 of them at the authority’s own wording. Evidence, judgements and approvals sit in one hash-chained record, agents propose and named people decide, and the same instance can run in a customer’s own data centre.
Every figure Conscious publishes is measured from the running product and held to it by a test that fails the build when a document and the catalogue disagree. The verification suites run on the customer’s own instance rather than on ours, the audit record is verifiable by the customer’s own auditor, and the load figures come with the hardware printed beside them. Ask any vendor for the same and compare what comes back.
Put the same questions to us and to the platform you are already paying for. The assessment at consciousgrc.com/assess needs no call and no account, and it prints a record you keep whether or not you ever speak to us.