Free interactive tool
LMS Requirements Scorecard
4 stepsUp to 3 vendorsEN · FI · SV
Tool not loading? Open the scorecard in a new tab. Switch language with EN, FI or SV at the top of the tool.
LMS Selection for Compliance Training: How to Score Vendors Against Your Requirements
LMS selection for compliance training goes wrong in a predictable way: the shortlist is decided by the best demo, and the gaps only show up the first time an auditor asks who was trained, on which version, in which country.
The fix is to describe your organisation before you look at the market, turn that description into a short list of knockout requirements and a weighted list of everything else, and then score each vendor on evidence rather than on claims. That is the method behind Datafisher’s free LMS Requirements Scorecard, and this guide walks through it step by step.
Why LMS selection goes wrong for compliance
Vendor demos are built to show what looks good in thirty minutes: course authoring, a polished learner home page, a dashboard of completion rates. A compliance LMS is judged on something else. It has to put the right course in front of the right person automatically, keep records you can still produce years later, handle content that changes when the law changes, and turn all of that into evidence on request.
Nordic organisations add their own complications. A typical group has entities in Finland and Sweden, perhaps Norway or the Baltics, content in two or three languages, and a meaningful share of people who are not on the main payroll. None of that shows up in a generic demo, and all of it decides whether the platform works.
An LMS for compliance training is not chosen on features. It is chosen on whether it can prove, per country and per person, that the right training happened.
Step 1: Describe the organisation before the market
Requirements depend on who has to be trained on what. Before you open a single vendor website, write down the shape of your organisation. These are the inputs the scorecard asks for, and they are the ones that change the requirement list most.
Employees in scope. Count the people who must complete compliance training, not total headcount. 250 and 10,000 learners lead to different answers on licensing, administration and reporting.
Legal entities. Separate statutory subsidiaries usually mean separate obligations, separate reporting and sometimes separate data controllers. Five entities is a different project from one.
Curricula or training tracks. Count the distinct role and regulatory curricula: all-staff code of conduct, managers, finance and AML, IT and security, the board. Each track needs its own assignment rules.
Operating countries. Each country can carry its own content, its own deadlines and its own works council or co-operation procedure. Finland and Sweden alone are two legal systems.
Content languages, and which are legally needed. Separate the languages you would like to offer from the languages a specific entity actually needs for staff to understand the material. The second group is not optional, so it becomes a requirement rather than a preference.
Populations outside the HR system. Contractors, agency staff, board members, seasonal workers and suppliers often need the same training as employees but never appear in the HR feed. This is where compliance coverage most often fails.
If you are still deciding what each population must be trained on, the Nordic operating model for one compliance programme across many countries and languages covers that question in more depth.
Step 2: Separate knockouts from weighted requirements
A requirement list where everything is “important” cannot separate vendors. Split it into two kinds.
Knockout (must-have). A vendor that cannot meet it is out, whatever else it does well. Keep this list short, typically five to ten items, and make each one testable.
Weighted (should-have and nice-to-have). Everything else gets a weight that reflects how much it matters to you. A vendor’s score on these decides the ranking among the vendors that passed the knockouts.
Your organisation profile should move requirements between the two lists. The scorecard does this automatically, and the logic is worth copying even if you work in a spreadsheet:
Several operating countries promote “country as an axis in assignment” and “curriculum re-evaluated when someone changes country” to knockouts. Without them, a transfer from Helsinki to Stockholm silently leaves someone on the wrong curriculum.
Several content languages make “independent language versions, separately versioned” and “interface language independent of content language” core requirements. You need to update the Swedish version of a course without republishing the Finnish one, and prove which version each person completed.
People outside the HR feed promote “bulk assignment for populations outside the HR feed” to a high-weight must-have. If contractors and board members have to be added one by one, they will be missed.
The full requirement list, grouped by area, is in our LMS requirements checklist for compliance training. Use it as the menu and your organisation profile as the filter.
LMS evaluation criteria that carry the most weight for compliance
Most LMS comparison sites score usability, content libraries and integrations. For a compliance LMS, these are the evaluation criteria that usually deserve the heaviest weights.
Rule-based assignment. Courses assigned automatically from HR data by country, entity, role and start date, and re-evaluated when any of them change.
Evidence and audit trail. Who completed which version, when, with what result, retained for as long as your policy requires and exportable per entity without a support ticket.
Recurrence and versioning. Refresher cycles per course, and the ability to require retraining only of the people affected when content changes materially.
Language handling. Separate language versions with their own approval and version history, and learners who can switch interface language without losing their record.
External learners. Contractors, board members and suppliers handled in bulk, with access that ends when the engagement does.
Data protection and hosting. As a processor of personal data the vendor needs a data processing agreement under the GDPR, and you need to know where data is stored and which sub-processors are involved.
Content portability. Support for SCORM, xAPI or cmi5, so courses you build or buy are not locked to one platform.
Cost of ownership. Licences, implementation, administration time and the price of leaving. A low licence fee with heavy manual administration is rarely the cheaper option.
Step 3: Score up to three vendors on evidence
Three vendors is enough to see real differences and few enough to evaluate properly. More than that and the demos blur together; fewer and you have no comparison.
Score every requirement on a short scale, for example 0 (not supported), 1 (workaround or roadmap), 2 (supported with configuration) and 3 (supported out of the box). Then hold the score to a standard of evidence:
Ask to see it, not hear it. A “yes” in an RFP answer is worth a 1 until you have seen it work in a demo or a trial environment.
Script the demo. Give every vendor the same scenarios: an employee who moves from Finland to Sweden, a Swedish course updated without touching the Finnish one, 40 contractors added from a spreadsheet, and an evidence export for one entity for the last three years.
Score straight after each demo. Scores written a week later reflect the last vendor you saw, not the evidence.
A knockout that is “on the roadmap” is a knockout that fails. Score what exists today.
Step 4: Read the results
Read the scorecard in a fixed order, and the decision usually becomes clear.
Knockouts first. A vendor that fails any knockout is out, even with the highest weighted score. If every vendor fails the same knockout, revisit whether it is truly a must-have or whether the market cannot meet it.
Weighted score second. Among vendors that passed, compare weighted totals. A gap of a few points is noise; look at which areas drive the difference.
Sensitivity third. Change the two or three heaviest weights slightly. If the ranking flips, the decision rests on a judgement call that the steering group should make explicitly.
Cost and references last. When two vendors are close, total cost of ownership and a reference call with a Nordic customer of similar shape decide it.
Turning the scorecard into an LMS RFP
If procurement requires a formal LMS RFP, the scorecard is most of the work. Send vendors the knockout list and the weighted list, ask them to self-score each item with a short explanation, and tell them which items will be tested in the demo. Keep the weights to yourself.
A focused RFP built this way is shorter for vendors to answer and easier for you to compare. It also makes the final decision defensible: anyone who asks why a vendor was chosen can see the requirement, the weight, the score and the evidence behind it.
Ready to build your shortlist? Open the LMS Requirements Scorecard, load the Nordic example to see how it works, then enter your own organisation and up to three vendors.
For the wider picture of running a compliance LMS once it is chosen, see our guide to choosing, running and proving a compliance LMS, or look at how the Datafisher LMS handles multi-country compliance training.
Frequently asked questions
How do you choose an LMS for compliance training?
Describe your organisation first (people in scope, entities, countries, languages, external learners), turn that into knockout and weighted requirements, then score a shortlist of vendors on evidence from scripted demos. The vendor that passes every knockout with the best weighted score usually wins.
What are the most important LMS evaluation criteria for compliance?
Rule-based assignment, an audit trail you can export per entity, recurrence and versioning, separate language versions, handling of external learners, GDPR-compliant data processing and content portability. Usability matters, but it rarely decides whether you can prove compliance.
How many vendors should be on an LMS shortlist?
Three is a practical number. It gives a real comparison while leaving time for proper scripted demos and reference calls.
What is a knockout requirement in LMS selection?
A requirement the platform must meet today for you to consider it at all, such as country-based assignment for a multi-country group. A vendor that fails one is excluded regardless of its other scores.
How should we weight LMS requirements?
Weight by consequence: how much compliance risk or administrative effort does it create if the requirement is missing? Requirements tied to evidence and assignment usually outweigh interface and content-library features.
Do we need a formal LMS RFP?
Not always. Many companies run a structured evaluation with a requirement list and scripted demos instead. If procurement rules require an RFP, build it from the same knockout and weighted lists.
Can we use the scorecard for an LMS comparison we have already started?
Yes. Enter your organisation, review the requirements the scorecard proposes, and score the vendors you are already talking to. It often shows which open questions still need evidence.
Sources and further reading
- Regulation (EU) 2016/679 (GDPR) – EUR-Lex: Article 28 on processors and data processing agreements
- LMS requirements checklist for compliance training – Datafisher: the full requirement list by area
- Compliance LMS: how to choose, run and prove one – Datafisher pillar guide
- One compliance programme, many countries and languages – Datafisher: Nordic operating model
- LMS Requirements Scorecard – Datafisher: free interactive tool in English, Finnish and Swedish