When should you buy, extend or build?
Start with the software you already use: can configuration or an acceptable workflow change close the gap? Consider an extension if the core fits and a clearly bounded function is missing. A custom application is justified when important requirements cannot otherwise be met and their value warrants the extra development and operational work. The table helps identify candidates; your requirements determine the choice.
Must-have or wish: what needs to happen in the test?
Describe a real transaction with its input data, participants and required outcome. A must-have is essential: failing it makes an option unsuitable in its tested form. A wish improves the experience but cannot compensate for a missing must-have. Question existing habits: does the old screen layout really need to remain, or just the business outcome?
Have every option demonstrated with the same test data. For each requirement, record passed, failed or unresolved, along with evidence and any additional work needed. A presentation slide or promised future feature does not count as a passed test. The completed portal example shows how specific these requirements can be.
Compare total costs for the same scope
Compare only options that can meet every must-have. Use the same period of use, number of users and data volume for each. Ask for one-off costs, recurring costs and excluded services to be listed separately.
- One-off: setup or development, data migration, customisation, integrations, testing and training.
- Recurring: licences, hosting, support, security updates, integration maintenance and internal working time.
- When switching: data export, migration, documentation and handover to another operator.
- Unknown costs: record assumptions and possible extra charges, such as additional users or changed interfaces. Without a reliable quote, the cost assessment remains open.
Check operations and data export in practice
Before commissioning, name who handles incidents, owns updates and tests recovery after an outage. Record which tasks the supplier performs and which remain yours. NIST describes secure software development as a lifecycle activity; ask about dependencies, tests and vulnerability handling as well.
Request a sample export containing records, attachments and their relationships. Open it outside the application and check whether another supplier could use it. Agree the export scope, format, cost and access at contract end. For custom development, also agree source-code access, usage rights, documentation and access to the operating environment.
Record the decision in a few sentences
Record the chosen option, passed must-haves, wishes deliberately deferred and the cost comparison. Add the person responsible for operations and any outstanding commitments. This makes the basis of the choice clear, along with changes that would call it into question.
If every option fails, reduce or change the workflow and test again. A low quote does not justify a missing must-have. Equally, a custom application is unnecessary if standard software meets the important requirements and is a better fit in the complete comparison.
Buy, extend or build: which option is a candidate?
Scroll the table sideways if needed.
| Option | Reason to consider it | Resolve before deciding |
|---|---|---|
| Standard software | Every must-have is met by existing features or an acceptable workflow change. | Suitable plan and scope, export, recurring costs and remaining manual work. |
| Extension or integration | The core fits; a bounded gap can demonstrably be closed. | Permitted interface access, extra costs and responsibility when either system changes. |
| Custom application | Important must-haves remain unmet elsewhere; their value justifies the work. | Total costs, support, security, source-code access, usage rights and handover. |