CIOs in regulated industries evaluate external IT partners by scoring every candidate against the same weighted criteria: compliance, security, delivery governance, regional execution, and commercial and exit terms. A scorecard turns IT partner evaluation from a judgement call into a decision you can explain to the board, the risk committee and, if asked, the regulator. Here is how to build one in five steps.
Regulators are widening their view of third party risk. In March 2026 MAS proposed Third Party Risk Management Guidelines that would replace its outsourcing guidelines and cover all third party services. Banks in Singapore already follow MAS Notice 658, Hong Kong banks the HKMA's SA-2 module and Hong Kong insurers the Insurance Authority's GL14, while Bank Negara Malaysia revised its technology risk policy in November 2025. For what each regulator expects, see Understanding APAC IT Partner Governance in Finance.
Step 1: Set the scope and materiality
Not every partner needs the full scorecard. First rate how material the service is. Does it touch customer data, a critical system or a regulated activity? Material services get the full assessment and senior sign off, and lower risk services a shorter version.
Step 2: Choose five categories and weight them
These weights are a sensible starting point for regulated firms:
+ Compliance and regulatory fit: 25%
+ Security and data protection: 25%
+ Delivery governance: 20%
+ Regional execution: 15%
+ Commercial and exit terms: 15%
Adjust them to the work. A cloud migration of customer data may weight security higher, and a four market programme may weight regional execution higher.
Step 3: Write questions you can score
Give each category three to five questions and a 1 to 5 scale: 1 means no evidence, 3 means described but not shown, and 5 means evidenced and tested. Clear guidance means two reviewers reach the same score.
+ Compliance and regulatory fit
Has the partner worked under your regulator before? Will you and the regulator have audit access? Will they tell you before using a material subcontractor? Where will your data be stored and processed?
+ Security and data protection
Ask for certifications and check their scope. In Singapore, the CSA Cyber Trust mark is a three year certification with annual audits, and its 2025 standard covers cloud and AI security. Check how access is granted and removed, how fast incidents are reported, and whether your data could go into external AI tools. If the partner will build or use AI, add the checks in How to Assess Secure Enterprise AI Delivery.
+ Delivery governance
Who is the named accountable lead? How are progress and risks reported, and how quickly can someone who leaves be replaced? The delivery risks worth probing are covered in APAC IT Delivery Risk in 2026.
+ Regional execution
Does the partner have people and a legal entity in each market you need? Can they employ locally and keep quality consistent across borders?
+ Commercial and exit terms
Is pricing clear? What are your termination rights, and is there a tested exit and handover plan? How much of your work already sits with this partner, and would adding more create a concentration risk?
Step 4: Ask for evidence, not just answers
Questionnaires are only a starting point. Before giving a high score, ask for evidence: certificate scope, a sample status report, an incident runbook, CVs of the proposed team and references from similar regulated clients. Interview the delivery lead, not only the account manager. The wider selection process is set out in How to Evaluate APAC Digital Transformation Partners.
Step 5: Decide, record and review
Multiply each score by its weight and set a minimum total for material services. Add a few knock out rules, for example no audit access or no incident notification commitment means no contract, whatever the total. Record the result and the reasons, then review material partners at least once a year and after any major incident or change in scope.
We+ Asia works with enterprise clients across Singapore, Malaysia, Hong Kong and Taiwan, and expects to be assessed this way. If you are building a scorecard for a new programme, Speak to We+ Asia and we will walk you through how we answer each section.
They score every partner against the same weighted criteria, usually compliance, security, delivery governance, regional execution and commercial terms, and ask for evidence before giving high scores.
Five weighted categories, three to five scored questions in each, a 1 to 5 scale with clear guidance, knock out rules and a minimum total for material services.
Outsourcing is one type of third party arrangement. Third party risk management covers all of them, and MAS has proposed guidelines that would extend its expectations to all third party services.
ISO/IEC 27001 is common. The CSA Cyber Trust mark recognises a risk based approach and its 2025 standard covers cloud and AI security. Always check what the certification covers.
Building a partner scorecard for your next programme?
Speak to We+ Asia.