Make the technology decision before it costs you a year

The output is a document you can act on, not a slide deck of principles. A typical engagement ends with an architecture map of the current state, a requirements list ranked by business value, two or three options with cost ranges, and a recommended path with a phased plan. Every number carries its assumption, so your finance lead can challenge it.

We interview the people who use the system as well as the people who own it. The gap between the two is usually where the real requirements sit. We also read the code and the infrastructure configuration where access is allowed, because a diagram drawn from memory rarely matches production.

Most reviews take two to four weeks. A due diligence on a single product is closer to two. A multi-system landscape with several vendors can reach six to eight weeks, and we say so at the start rather than stretching the work.

The honest answer to build versus buy is usually adapt. A packaged ERP or CRM covers the standard ninety percent of a process, and a small custom layer covers the part that makes your company different. We cost all three paths over a three-year horizon, including licences, integration work, training, hosting and the internal time your own staff will spend.

We also price the exit. If a vendor raises fees or a product is discontinued, how hard is it to leave? Data export formats, API access and contract terms matter more than the feature list. You will see these listed beside each option.

Where a decision depends on a fact we cannot verify, such as a vendor's roadmap, we mark it as an assumption and tell you which question to put to the vendor in writing.

Every recommendation is tested against the rules that apply to your sector. For personal data we check the Personal Data Protection Law and its implementing regulations from SDAIA, including where data is stored and who can reach it. For regulated entities and critical systems we check alignment with the NCA Essential Cybersecurity Controls. For cloud services we check the Communications, Space and Technology Commission cloud computing framework and whether in-Kingdom hosting is required.

Invoicing systems are checked against ZATCA e-invoicing requirements, since a tool that cannot issue compliant invoices is not a viable option for most companies. Banks and payment firms add SAMA requirements.

We do not certify compliance. We tell you where a design appears to meet the requirement, where it does not, and what a qualified auditor will probably ask for, so there are fewer surprises later.