Reviews
Part of A framework for social listening reviews in England
Who signs which gate in a social listening supplier selection
For a social listening selection checklist in England: name the reviewer for each gate, where a small buyer finds one, and when the status stays on HOLD.
A supplier decision is only as sound as the people who sign it. Each mandatory gate needs a named reviewer who can judge the evidence and put a name to the result. Until every signature is recorded, the status stays HOLD.
Use this after the buyer has written one England configuration. Every gate records pass, fail or unknown with an owner, evidence date and retest trigger. Do not calculate an average across the gates. How the evidence itself is graded is set out in the framework for reviews.
What to take away
- Name a reviewer for every mandatory gate and record who signs it.
- Open the review record, with conflicts and the source of each observation, before any gate is assessed.
- A small England buyer can source privacy, IP, security, statistics and accessibility reviewers without a large panel.
- Keep the status HOLD until every named reviewer has signed their own gate.
- Score preferences only after every mandatory gate passes.
Open the review record before anyone signs
A reviewer cannot sign a gate that has no record behind it. Name the reviewing body, the assigned people and their qualifications first. State the research and test dates, the buyer, the decision, the geography, the language, the users and the reporting audience.
Review record essentials
- Name reviewing body and qualifications
- State research and test dates
- Publish inclusion and exclusion rules
- Record conflicts and observation source
- Verify legal entity on register
Publish the candidate inclusion and exclusion rules and any conflicts. Say whether each observation came from desk research, demonstration or buyer-controlled testing. Verify the legal entity on the proposal against Companies House or the appropriate register; free company information on GOV.UK includes the registered address and date of incorporation.
A worked gate record, labelled illustrative: Gate 4, security. Owner: information security lead. Evidence: a vendor SOC 2 Type II report and penetration test summary, with the evidence date recorded. Retest trigger: new subprocessor or annual review.
Match each gate to a named reviewer
A small England buyer can source these reviewers without a large panel. Each row pairs a gate with the person who signs it, a route to finding one and the evidence that person should be handed.
| Gate | Reviewer who signs | Where a small buyer can find one | Evidence to hand over |
|---|---|---|---|
| Privacy | Named privacy lawyer | A fractional data protection consultant or solicitor | Who decides purpose and means, subprocessors, transfers, rights handling and deletion propagation |
| Intellectual property | IP adviser | A solicitor or barrister with media and database rights experience, found through the Law Society's Find a Solicitor | Licences and proposed exceptions by source and use |
| Security | Security assessor | A CREST-accredited tester or an NCSC-assured supplier | Product-scoped dates and boundaries for access control, encryption, testing, incidents, recovery and data return |
| Classifier validity | Statistician | A university methods clinic or a freelance statistician with peer-reviewed work | Frozen label, codebook, human-coded test set and model version, with errors by class and language |
| Accessibility | Accessibility auditor | An auditor with public sector testing experience | Defects and remediation dates from keyboard and assistive-technology tests of the configured journey |
Procurement, commercial and legal reviewers sign their own gates too. The contract areas are where the commercial and legal reviewers meet, because exit and renewal terms need both.
Give each reviewer the live evidence
The privacy reviewer checks the live arrangement, not the seller's label. The ICO's controller and processor contract guidance lists required contract areas and is under DUAA review, so the reviewer reopens it on the day. The data protection record shows what the buyer should have ready.
The IP reviewer separates access from copying into dashboards, exports, presentations, model inputs and archives. GOV.UK copyright guidance explains that permission, ownership, licences and specific exceptions matter. Obtain project-specific IP advice rather than accepting a general platform licence as the answer.
The NCSC's supplier assurance questions help structure the security evidence request. A completed response is not a security guarantee, so the security reviewer still decides what the answers show.
The statistician tests the classifier against the buyer's own frozen test set. Recheck after any model, source-mix or threshold change. The AI applications in listening each carry a different test, so name the job the label does.
The accessibility reviewer works with GOV.UK's testing guidance, which is written for government services. Use its mixed testing approach without claiming private-service conformance from a checklist.
Run the sign-off in order
- Record every gate as pass, fail or unknown, with owner, evidence date and retest trigger.
- Fail a candidate when a mandatory source route conflicts with the intended use, and hold it when the route is unknown.
- Test a sample export before signature, so the exit gate rests on a real file.
- Score preferences only after every mandatory gate passes.
- Write the verdict, naming the configuration and the unresolved conditions.
- Ask each named reviewer to sign their own gate, and keep the status HOLD until every signature is recorded.
Write a verdict that names its conditions
A verdict should read as a condition, not a prize. Examples are "eligible for controlled trial" or "rejected because source permission is unverified". Each names the configuration it answers for and what remains open.
When the verdict allows a comparison, put the named tools through the same records before anyone chooses. Release checks come after the gates, and the quality checklist covers what leaves the team.
Before you sign
- Name the reviewing body and assign qualified people.
- Publish candidate inclusion and exclusion rules and any conflicts.
- Verify the legal entity on the proposal.
- Complete the gate record for each gate.
- Test a sample export before signature.
- Obtain project-specific IP advice and record every signature.
Common questions
Who should sign each gate of a social listening selection?
Each named procurement, privacy, security, IP, accessibility, statistical, commercial and legal reviewer signs their own gate. The buyer records who signed, which evidence they saw and the date, so the verdict can be traced back to a named person.
What happens if one reviewer has not signed?
The status stays HOLD. The verdict is not issued until every signature is recorded, and no average across the gates can stand in for a missing one.
Can candidates be scored before every gate passes?
No. Score preferences only after every mandatory gate passes. A gate that fails or is unknown holds the candidate, and the verdict names the unresolved condition instead.
