How to Choose a Digital Transformation Company in Saudi Arabia
How to Choose a Digital Transformation Company in Saudi Arabia
"Which is the best transformation company?" is difficult to answer objectively: we have not identified an independent rating for this market that you could rely on, and a company's own claim to be best is not evidence either way. What you can do instead is score your shortlist on twelve things that are visible before you sign, and treat anything that cannot be evidenced as a zero.
Use the scorecard below to assess a proposal and discuss the supporting evidence in a meeting. AY also applies it to itself later in the guide, including an area where we score lower than we would like.
A provider evaluation scorecard
AY prepared this scorecard for this guide, and applies it to itself below. Score each row 0, 1 or 2: zero means it was not addressed, one means it was addressed in general terms, two means it was evidenced. The maximum score across the twelve rows is twenty-four.
|
# |
What you are testing |
What a 2 looks like |
|---|---|---|
|
1 |
A measure that moved on previous work |
A named metric with a before and after, and the measurement period |
|
2 |
Who was operating it a year later |
A reachable reference who has run the system for twelve months or more |
|
3 |
Personal data handling in this specific proposal |
A named data owner, access control at the granularity the data requires, retention, and a route for data subject requests |
|
4 |
The security controls the design is built to |
A specific reference to ECC 2-2024 controls, not "industry best practice" |
|
5 |
Cloud and hosting position |
Current on where data localisation is actually governed, and on which cloud controls bind the subscriber as well as the provider |
|
6 |
Explicit exclusions from scope |
A written list of what is not included |
|
7 |
Discovery priced separately from build |
Two line items, with build priced after discovery |
|
8 |
Post-launch operation |
A named arrangement with an annual cost, agreed before signature |
|
9 |
Legacy integration risk |
A stated plan for what happens if a system cannot be integrated |
|
10 |
What is handed over |
Systems, data definitions, documentation and runbooks listed in acceptance criteria |
|
11 |
Arabic as a design requirement |
Evidence from a delivered Arabic-first interface, not a translated one |
|
12 |
Adoption as a deliverable |
A named adoption measure with a target, reviewed after go-live |
How to read the total. The total matters less than which rows scored zero. Rows 1, 2, 8 and 10 can be especially useful for assessing what the relationship may look like in year two, so a zero on any of them deserves attention even when the total score is high. What you do with this: send the twelve rows to each shortlisted company before the meeting, and ask them to bring evidence for rows 1, 2 and 8 specifically. How a company reacts to being scored is itself information.
Where AY scores on this, including where we score lower
Publishing a scorecard without applying it to ourselves would make the evaluation incomplete. So:
|
Row |
Where AY stands |
|---|---|
|
1–2: a measure that moved, and who operated it a year later |
We would score ourselves 1, not 2, today. Our position is that relationship length is the evidence worth weighing rather than logo counts — we have continuing operating relationships with enterprise clients beyond ten years. But published case studies with named baselines and measures are in preparation and not yet available, and until they are, this row is a 1. |
|
3–5: personal data, security controls, hosting position |
Ask us to name the controls. A design should be built to identified requirements and state how each will be evidenced. Where data may be hosted follows from your classification and the requirements applicable to your activity, and needs regulatory review rather than a supplier's assurance — including ours |
|
6–7: exclusions and separately priced discovery |
Ask us to evidence this on your proposal. Our position is that a scope should carry written exclusions and that build should be priced after discovery rather than before it — what a specific proposal does is confirmed in that proposal, not here |
|
8: post-launch operation |
Ask us to evidence this on your proposal. We treat the operating arrangement and its cost as something to settle before signature rather than after go-live; the specific arrangement offered to you appears in your proposal |
|
9–10: legacy risk and handover |
Ask us to evidence this on your proposal. Integration risk belongs in discovery, and what is handed over should be named in the acceptance criteria — score us on what our proposal actually says, not on this row |
|
11: Arabic as a design requirement |
Ask for a delivered example. Our position is that Arabic interfaces should be designed rather than translated; a sample of delivered work is better evidence than a claim on this row |
|
12: adoption as a deliverable |
Ask us to name the measure. We think adoption belongs in the measured set alongside delivery, with a baseline taken before work starts; whether a given engagement does so is set in its own terms |
What you do with this: ask every company on your shortlist to do the same thing — to name the row where they score lowest and say why. A company that cannot name one may not have engaged fully with the scorecard or the question.
Six red flags that are visible before signature
Each of these warning signs can be observed in a proposal or an initial meeting:
- A fixed price quoted before the scope is defined. A fixed price is legitimate where the scope is genuinely fixed, and the proposal should show what it is fixed against — the deliverables, the assumptions and the exclusions. Where those are absent, ask what happens when an assumption proves wrong, and who carries that cost.
- No written exclusions. A scope with no stated boundary is likely to create disagreement, often when you have less leverage.
- Post-launch operation left unpriced. It can become a substantial cost after year one, and omitting it may make the proposal appear less expensive than the full commitment.
- "Best practice" as an answer to a controls question. A design built to a specific control should be able to name it. If it cannot, ask what requirements actually shaped the design.
- A team introduced in the meeting that does not appear in the contract. Ask which named people are committed and for how much of their time, in writing.
- Results guaranteed. Outcomes depend on decisions inside your organisation that no supplier controls. Any guarantee should be examined carefully for its conditions, exclusions and enforceability.
What you do with this: treat the first three as questions to resolve in writing before signature rather than as points to negotiate later. None of them means a provider is acting in bad faith; each one means a cost or a boundary has not yet been agreed, and agreeing it afterwards is harder.
Local or international is the wrong question
The useful distinction is not company size or origin. It is two things that vary independently of both:
Who operates the system after go-live, and under what service arrangement. This strongly shapes what year two may look like, and it can be clarified with one question.
Who carries integration risk with your existing systems. Where this is unassigned, the risk may fall to you and may later appear as a change request.
What proximity genuinely helps with is narrow and testable: on-site presence during process mapping, a team in your time zone at go-live, familiarity with locally common accounting and operational practice, and prior work against Saudi regulatory requirements. Proximity alone does not establish engineering quality, documentation discipline or the ability to operate a system — those should be assessed from evidence.
What you do with this: test proximity with one question — "who attends process mapping sessions, how often, and where?" — and test everything else by asking for the documentation from a previous project, with the client name removed.
Certifications and partner badges: what they do and do not tell you
Partner status with a platform vendor tells you a company has met that vendor's commercial and training thresholds. It is real information, and it is not evidence of delivery quality on your project. Management system certifications tell you a process exists and was audited; they do not tell you the team assigned to you follows it.
What you do with this: use certifications as a filter rather than as a ranking. The question that converts a badge into evidence is: "show me where that certified process appears in this proposal's acceptance criteria." If it does not appear, it is not part of what you are buying.
The six questions to ask in the second meeting
- Which measure moved on a comparable project, and over what period?
- Who was operating that system twelve months later, and can we speak to them?
- Which specific controls is this design built to, and how will each be evidenced?
- What is explicitly excluded from this scope?
- What does operating this cost per year, and who does it?
- If one of our existing systems cannot be integrated, what happens then?
How to read the answers: the first two separate delivery records from portfolios. The third separates designs built to a requirement from designs built to a template. The last three are common sources of later disputes, and they are generally easier to clarify before signature.
The adjacent decisions, and where they are made
- What am I buying, and what sets its price? The digital transformation services guide.
- Should we build this capability in-house instead? The guide to choosing a transformation provider.
- Which of my existing systems do I keep, replace or retire? The digital modernization guide.
- Who decides what once the change lands? The digital operating model guide.
- How do I get this approved and funded internally? The transformation business case guide.
How AY works
We expect to be scored on the twelve rows, and we have said above where we would score ourselves lower than a 2. Ask us for the same evidence the scorecard asks of anyone: which specific controls a design is built to and how each would be evidenced, what is excluded, what operation costs and who performs it, and documentation from previous work with the client name removed. What we can provide in a given case is confirmed at proposal stage rather than promised in an article.
What we will not offer is a guaranteed outcome, or a claim to be the best in this field — we have not identified an independent rating that would support such a claim by any party, which is why the scorecard exists in its place. Examples are in our work, and the scope is set out in enterprise digital transformation.
Next step
Send the twelve rows to your shortlist before the next meeting and ask for evidence on rows 1, 2 and 8. Written responses alone will often narrow a shortlist before you spend anyone's meeting time.
If you do not yet have a scope precise enough to be scored against, that is the point at which involving an outside party becomes useful. Talk to us about whether an assessment fits your case and what it would cover — the scope and outputs of any assessment are agreed before it starts rather than assumed in advance.
0 Comments
No comments yet. Be the first to comment!
Related Blogs
What a Digital Modernization Company Does, and Which Type Fits Your Gap
Three kinds of firm sell digital modernization and they cover different layers. Identify the layer your gap sits in, then ask every candidate for the same five pieces of evidence.
The Digital Transformation Business Case: How to Get It Approved, and When to Stop
Proposals are declined when the return is asserted and no condition for abandoning the work exists. A ten-section template, a three-tier benefit split, and a stop condition you write yourself.
Build or Buy: Choosing a Digital Transformation Provider Without Outsourcing the Wrong Thing
Decide which capabilities should sit outside your organisation before comparing providers. Three questions per capability, conditional verdicts, and the costs an in-house comparison usually omits.
The Digital Operating Model: Who Decides What After the Transformation
What separates two companies with the same systems is who decides what and when a decision escalates. A six-row decision rights map, and the latency indicator that shows whether it changed.
Digital Modernization in Saudi Arabia: Which Systems to Keep, Extend, Replace and Retire
Modernization is a verdict per system, not one decision. Four verdicts with the condition for each, what they actually cost, and a sequence that starts with what is not discretionary.
Digital Transformation Services in Saudi Arabia: What You Are Buying, and What Sets the Price
Three different things are sold under one name. Name the level, work through ten readiness questions, and understand the five factors that set the price before you request a proposal.