# Section 5 – Vendor Selection & Evaluation Gaps

## 5.1 Vendor Qualification
- Vendor profiles do not track tenure, certifications, or compliance results required to enforce 5+ years SaaS experience or ISO27001 status—only generic business identifiers are stored (`models/vendors.php:6-12`).
- Supporting document rows record file links but have no fields for regulatory review outcomes or questionnaire responses (`models/vendor_supporting_docs.php:6-10`).

## 5.2 Technical Criteria
- Capability entries capture free-form text yet provide no structured attributes for ERP compatibility, API security, or AI features (`models/vendor_capabilities.php:6-11`).
- There is no validation or scoring routine that checks vendors against Epicor compatibility or secure integration requirements (`FrontEnd/js/router.js:5-27`).

## 5.3 Evaluation Process
- No scoring matrix or evaluation workflow exists; RFQ and quote tables lack columns for compliance, security, or functionality weighting (`models/vendor_quotes.php:6-10`).
- The dashboard exposes no evaluation interface, so committee reviews cannot be recorded in-app (`FrontEnd/js/router.js:5-27`).

## 5.4 Legal & Compliance
- Procurement data does not capture IP ownership terms or third-party dependency declarations; there are no contract metadata tables tied to vendors (`models/procurements.php:6-12`).
- The system stores vendor records without retention policies or legal review steps to satisfy data protection obligations (`models/vendors.php:6-22`). // TODO: Define legal review workflow and extend schema accordingly.