A corporate gifting request for proposal should make an operating decision, not merely collect polished sales answers. The strongest RFP separates requirements that a supplier must pass from preferences that buyers may weight, requires evidence for every material claim, and compares total cost under the same scenario. This guide supplies that decision method and a localized workbook that procurement, people operations, marketing, finance, security, privacy, legal, and global operations can use together.
Download the 2026 corporate gifting RFP workbook
Download the English RFP and weighted scorecard workbook. Version 1.0, dated September 10, 2026, contains eight worksheets: Start Here, Program Requirements, Vendor Evidence, Security and Privacy, Coverage and Fulfillment, Pricing and TCO, Weighted Scorecard, and Decision Log. The file is buyer-editable, its formulas have been recalculated and scanned for errors, and every worksheet has been rendered and visually inspected.
The workbook uses three evidence states. Verified means the buyer has inspected current primary evidence and recorded its location. Supplier stated means the answer exists but still depends on the supplier's representation. Unknown means evidence is absent, expired, out of scope, or too vague to support the decision. Unknown is not neutral: it receives the lowest weighted score until resolved, and a mandatory unknown blocks shortlisting. This rule prevents an incomplete response from outperforming a transparent one.
The default weighted criteria are country coverage and restrictions, fulfillment reliability and recovery, security and privacy evidence, integration and administration, pricing and total-cost transparency, recipient experience and accessibility, branding and customization, and reporting and governance. Buyers should change those weights before responses arrive. Changing them after seeing supplier scores can turn a decision model into a justification device.
| Decision element | Purpose | Treatment of missing evidence | Acceptance evidence |
| Mandatory gate | Protect a non-negotiable legal, security, operational, or commercial condition | Unknown equals not passed | Current document, test, contract term, or accountable sign-off |
| Weighted criterion | Express relative buyer value among suppliers that pass all gates | Score one of five until verified | Reason, source link, reviewer, and score |
| Total-cost model | Normalize the same volume, countries, service level, and exception assumptions | Unpriced item becomes a stated risk allowance | Fee schedule, scenario assumptions, and reconciliation owner |
| Decision log | Preserve alternatives, exceptions, approvals, and follow-up obligations | Open issue remains visible | Dated decision, owner, approver, and closure evidence |
The workbook is a sourcing aid, not legal, tax, privacy, security, or payroll advice. Each accountable function still decides whether evidence is sufficient for its risk. Use the linked corporate gifting vendor security checklist for a deeper control review and the gift and hospitality policy template to define employee-facing approval boundaries.
Start with the operating model, not a vendor questionnaire
Before procurement sends questions, the business owner should write one page describing the program. Record who receives gifts, why they receive them, who funds the program, which countries are in scope, whether recipients choose gifts, how addresses are collected, what delivery promise is acceptable, and which teams approve exceptions. A vague scope produces incomparable bids because each supplier prices and describes a different service.
Use a twelve-month demand scenario, even if the initial contract is shorter. Segment recurring recognition, client appreciation, campaign sends, event merchandise, one-off executive requests, and service recovery. For each segment, estimate recipients, average item value, destination mix, lead time, personalization, inventory ownership, and failure rate. The forecast does not need false precision; it needs enough consistency that every supplier answers the same commercial problem.
Assign a decision right to every functional owner. Procurement owns the process and commercial comparability. People operations or marketing owns the use case and recipient promise. Finance owns budget, fee normalization, reconciliation, and payment terms. Security and privacy own their risk dispositions. Legal owns contract language. Global operations owns country feasibility, customs, restricted items, and recovery paths. The executive sponsor decides documented tradeoffs; the project manager keeps evidence, questions, and deadlines synchronized.
Write acceptance evidence beside every requirement. “Global fulfillment” is not evidence. A dated list of serviceable countries, excluded postal zones, product restrictions, standard delivery ranges, customs model, local-language support, and an escalation owner is evidence a buyer can test. “Integrates with our systems” is also too broad. Specify the event source, required fields, authentication method, error handling, audit log, test environment, and acceptance test.
-
Business owner confirms use cases, recipient populations, countries, volumes, and timing.
-
Finance publishes one pricing scenario and currency convention.
-
Security and privacy identify true gating controls and required evidence.
-
Legal identifies contract terms that must be accepted before award.
-
Operations defines delivery, customs, exception, refund, and resend expectations.
-
Project lead freezes criteria and weights before supplier scores are opened.
Acceptance for this stage is a signed scope, an owner for every requirement, a common volume scenario, and a complete list of gates. If a stakeholder cannot state an acceptance test, convert the item into a research question or remove it. An untestable “requirement” invites subjective scoring.
Separate mandatory gates from weighted preferences
A mandatory gate should protect a condition that the buyer cannot responsibly trade away. Typical examples include contracted coverage for critical countries, acceptable data-processing terms, required insurance, an incident-notification commitment, sanctions controls, accessible recipient flows, auditable pricing, and a documented refund or resend process. Do not label every desirable feature mandatory. Excessive gates shrink competition without improving the decision.
For each proposed gate, ask three questions. First, would failure make launch unlawful, unsafe, contractually impossible, or operationally unviable? Second, can the buyer test the condition with specific evidence? Third, is the condition required at award, or can it be an agreed implementation milestone? If the answer to the first or second question is no, the item probably belongs in weighted scoring. If it can be completed before launch, use a dated condition rather than pretending it already exists.
Weighted criteria express how the buyer values differences among suppliers that remain eligible. The workbook defaults to 15 percent each for coverage, fulfillment reliability, security and privacy evidence, and pricing transparency; 10 percent each for integration, recipient experience, branding, and governance. These are starting assumptions, not universal truth. A regulated employer might raise security weight, while a campaign team may prioritize rapid creative execution and recipient choice.
Use a one-to-five rubric anchored in observable evidence. A score of one means absent, materially incomplete, or unverified. Two means partial support with important limitations. Three means the defined need is met with credible evidence. Four means the supplier exceeds the need in a way the buyer values. Five means a materially superior, tested capability with low remaining risk. Reviewers should write the reason and source before the score; otherwise the number becomes memory rather than evidence.
The normalized formula is simple:
weighted score = sum(weight × score) ÷ sum(weights)
Keep the result on a one-to-five scale and show the weight total beside it. A total other than 100 percent is an input error unless the buyer deliberately documents a different normalization. Never add a “strategic fit” bonus after scoring. If strategic fit matters, define what it means, give it a weight before responses arrive, and require the same proof from every supplier.
Unknown evidence needs an explicit rule. In weighted scoring, the workbook assigns one until the evidence is verified. In a gate, unknown means not passed. A buyer may reopen a gate if the supplier delivers evidence by a fixed deadline, but the log should show the original gap, the owner who accepted the late response, and the final basis. This protects transparent suppliers from losing to optimistic blanks.
When should a requirement become a launch condition instead of an award gate?
Use a launch condition only when the gap is specific, remediable, owned, and testable before any production data or funds move. Record the deliverable, reviewer, due date, consequence of failure, and fallback supplier or manual process. Do not defer unresolved legal authority, an unacceptable data-processing term, or the absence of critical country coverage.
Acceptance evidence for this stage is a frozen list of gates, written score anchors, weights totaling 100 percent, and a named reviewer for every category. Failure recovery is to pause scoring, correct the model, and rescore all suppliers from the same evidence set; do not repair only the preferred bidder's result.
Ask for evidence that can survive security and privacy review
Security questionnaires often fail because they ask whether a control exists rather than how the buyer can verify it. Start with the NIST Cybersecurity Framework 2.0 as a risk-management reference, not as a certification requirement. Its governance emphasis is useful for asking who owns risk, how supplier dependencies are managed, and how incidents and recovery are handled. Map only the outcomes relevant to the gifting service.
Use the NIST Privacy Framework to structure questions about data processing risk. Ask the supplier to identify categories of recipient and employee data, purposes, collection sources, sharing, locations, retention, deletion, access rights, and change governance. The answer should distinguish address-known and recipient-claim workflows because data flows and buyer obligations may differ.
ISO/IEC 27001:2022 defines requirements for an information security management system. A certificate may increase confidence, but buyers should inspect issuer, validity, scope, covered entities, locations, services, and exclusions. Certification does not prove that every control relevant to the buyer's implementation is effective. Similarly, a SOC report is not a badge: qualified reviewers need the report period, system scope, control exceptions, complementary user-entity controls, subservice organizations, and bridge coverage.
For European personal data, Article 28 of the General Data Protection Regulation is a primary reference for processor obligations and contracting. Legal and privacy reviewers should confirm roles, documented instructions, confidentiality, security assistance, subprocessor terms, rights support, deletion or return, and audit information. They should also examine international-transfer needs and applicable local law rather than treating a generic data-processing addendum as universal approval.
Ask for an architecture narrative proportionate to risk. It should show authentication, privileged access, encryption in transit and at rest, tenant separation, logging, backup, recovery, vulnerability management, and incident escalation. If single sign-on is required, define protocol, identity attributes, role mapping, deprovisioning, break-glass access, test evidence, and audit logging. A checkbox saying “SSO available” cannot support implementation planning.
Incident and continuity questions should connect commitments to business consequences. Define notification timing, contact paths, investigation cooperation, evidence preservation, corrective actions, and customer communications. For operational continuity, ask how orders, inventory, recipient claims, and shipping events are recovered; what data can be exported; and how the buyer exits if the service becomes unavailable.
Security acceptance is not “questionnaire complete.” It is a written disposition: accepted, accepted with conditions, or rejected. Every condition needs an owner, deadline, control, and verification step. If a critical report cannot be shared during the RFP, use a controlled review under confidentiality or record the residual uncertainty. Do not award a high security score for a promise to provide evidence after signature.
Normalize coverage, fulfillment, and recipient experience
Country counts are seductive and often misleading. A supplier may technically ship to a country while excluding the required product category, remote regions, locally preferred payment or redemption methods, or a practical delivery commitment. Ask for country-level evidence tied to the buyer's recipient mix: supported gift types, catalog source, currency, language, address model, customs party, duties, restricted items, expected delivery, returns, and escalation.
Run a representative lane test before award. Select high-volume, high-risk, and difficult destinations. Provide the same gift value, timing, personalization, and address scenario to every supplier. Record whether the catalog was available, the landed-cost estimate was clear, the delivery range was credible, and the recipient communications matched the required language. A lane test is more useful than a global total because it exposes the edges where programs fail.
Inventory models change risk. In a pre-purchased model, the buyer may gain brand control and unit economics but carries obsolescence, storage, and replenishment risk. In an on-demand or marketplace model, the buyer may reduce inventory but face catalog variation and less packaging control. A hybrid can reserve branded essentials while offering local alternatives. The RFP should require each supplier to price the same model or clearly label a different one.
Failure recovery needs a named playbook. Ask who detects an exception, who contacts the recipient, when the buyer is informed, whether the supplier can substitute or resend, how refunds are reconciled, and which party absorbs incremental shipping. Require a data export for open claims and orders. If the supplier relies on local partners, make escalation ownership explicit rather than sending the buyer into a partner chain.
Acceptance evidence includes completed lane tests, documented exclusions, service-event definitions, a support and recovery matrix, and a buyer sign-off for each critical country. If a supplier misses a noncritical lane, buyers may reduce scope and keep the supplier for viable regions. If it misses a critical lane, the defensible recovery is to fail the coverage gate or use a documented multi-supplier model.
Compare pricing with a total-cost scenario
A unit gift price is not a procurement comparison. Corporate gifting cost may include product or reward value, subscription or platform fees, selection and packing, customization, storage, shipping, duties, taxes, payment processing, minimums, returns, resends, breakage, support, and internal administration. Require suppliers to populate the same fee taxonomy, state currency and tax treatment, and mark every component as included, excluded, estimated, or not applicable.
The workbook's Pricing and TCO sheet begins with a common annual scenario. Buyers should enter recipient volume by lane, average gift value, shipment profile, customization share, expected exception rate, and internal labor assumption. Suppliers should not replace those inputs with their preferred scenario. They may offer alternatives, but the normalized response must remain intact.
Treat missing prices as risk, not zero. If a supplier cannot price duties, resends, or peak surcharges, record a buyer-approved allowance and test sensitivity. Show both the base estimate and a stress case. The goal is not to predict every invoice; it is to prevent opacity from looking cheaper than disclosure. Finance should own the assumptions, while procurement preserves the original response and any clarification.
Pricing acceptance requires a completed schedule, a normalized scenario, sensitivity results, payment and expiration terms, and an owner for reconciliation. If bids remain incomparable, issue one written clarification to all suppliers and preserve both versions. Do not negotiate a hidden format with only the preferred supplier before scoring.
Run a disciplined evaluation and approval process
Open scoring only after procurement checks response completeness. Gate reviewers should work independently in their domains, record evidence links, and avoid averaging away a failure. Weighted reviewers should score only criteria they own. Procurement then moderates inconsistent interpretations against the published anchors, not against vendor popularity.
Conduct demonstrations from a buyer-authored script. Include program setup, approval, recipient invitation, address collection, catalog restrictions, order status, exception recovery, reporting, and reconciliation. Give every supplier the same core scenario and reserve equal time for clarifications. Record what was demonstrated in a test environment, what was described, and what remains roadmap material.
The approval memo should show the scope, gates, weighted result, total-cost cases, material information gaps, reference findings, negotiated changes, residual risks, fallback, and requested decision. It should explain why the selected supplier is best for the defined program, not declare a universal winner. Keep the rejected alternatives and reasons in the Decision Log.
If stakeholders challenge a score, return to the evidence and anchor. Correct factual mistakes for every supplier. Do not change weights after results are visible unless the steering group documents why the original model was invalid, freezes a replacement, and reruns all candidates. That costly reset is still better than concealing bias.
Acceptance evidence is a locked final scorecard, signed risk dispositions, approved commercial terms, a decision memo, and an implementation owner. Before contract, export the evidence package and establish renewal reminders. The award is the start of supplier governance, not the end of evaluation.
Two hypothetical worked decisions
Hypothetical case 1: global employee recognition. A technology employer expects 8,000 recipients across 22 countries. Security, privacy, critical-country coverage, auditable pricing, and a documented resend process are mandatory. Supplier A has the broadest catalog and the lowest stated platform fee but does not provide current subprocessor evidence. Supplier B has narrower customization, clear country lanes, complete assurance evidence, and transparent landed-cost assumptions. Supplier C supports most countries but requires the employer to send home addresses in bulk.
The team records Supplier A's subprocessor gate as unknown, not pass, and gives privacy evidence one point until the register arrives. It tests Supplier B's critical lanes and models the cost of less customization. It asks Supplier C to demonstrate a recipient-claim address flow; the supplier cannot. Because the employer's privacy design requires recipient-controlled address collection, Supplier C fails that program gate even though it is technically capable of shipping.
Supplier A later supplies a current register before the common clarification deadline. Privacy approves it, so the gate changes to pass with a dated evidence link. Weighted scoring places Supplier B slightly ahead because its recovery process and total-cost clarity offset the customization gap. The decision memo selects Supplier B and records Supplier A as fallback, subject to a lane test. This is not a customer result; it illustrates how late evidence, design constraints, and commercial tradeoffs should be handled.
Hypothetical case 2: client gifting in four markets. A professional-services firm wants high-touch gifts for 600 clients in the United States, United Kingdom, Japan, and Singapore. Brand control and executive support matter more than broad country count. Supplier D proposes pre-purchased branded inventory; Supplier E offers an on-demand local catalog; Supplier F combines reserved branded items in two markets with local alternatives elsewhere.
The TCO model shows Supplier D cheapest per item at forecast volume but expensive in the low-volume case because of storage and obsolete inventory. Supplier E costs more per fulfilled gift but has low fixed cost and weak packaging control. Supplier F is not the lowest in any single line, yet its hybrid model reduces inventory exposure while preserving branded options for the two highest-value lanes.
The team raises no new weights after seeing results. Instead, it uses the preapproved brand, total-cost, and recovery criteria. It runs sample orders in all four markets and discovers that Supplier F's Japanese packaging needs a two-week longer approval lead time. Operations accepts that condition because the campaign calendar can accommodate it, and the contract includes a dated sample-approval milestone. The team selects Supplier F, retains Supplier E as an emergency local fallback, and records the tradeoff.
Both cases show why a score is not a decision by itself. Gates protect the buyer's boundaries, weights express value, scenarios expose cost risk, and the log preserves judgment. A defensible result may change when the program scope changes, which is precisely why the workbook begins with requirements rather than vendor rankings.
Failure modes, recovery paths, and acceptance evidence
The most common failure is an RFP with too many questions and no decision model. Recovery begins by deleting questions that do not affect a gate, score, price, contract, or implementation test. Map every remaining question to an owner and a decision field in the workbook. If no one will review an answer, do not ask for it.
A second failure is allowing unknowns to behave like average performance. This rewards incomplete bids. Recode unknown weighted evidence as one and unresolved gates as not passed. Send a common clarification schedule. When evidence arrives, record the original gap, review date, reviewer, and new disposition.
A fifth failure is changing criteria after demonstrations. Pause the decision. The steering group must state why the old model cannot represent the business need, approve a new model, and rescore every viable supplier. Preserve both versions and the reason. Quiet edits destroy auditability.
A sixth failure is awarding without a recovery plan. Before signature, name the implementation owner, fallback for critical lanes, data export, transition obligations, open-order treatment, unused-fund treatment, and support escalation. Convert sales promises into contract schedules or acceptance tests. If the supplier misses a launch condition, the contract should state whether the buyer delays, narrows scope, uses the fallback, or terminates.
Final acceptance requires: a signed scope; frozen gates and weights; evidence-linked reviews; completed representative lane tests; a normalized TCO scenario and sensitivity; signed security, privacy, legal, tax, and finance dispositions; a decision memo; a fallback; and an implementation plan with measurable acceptance tests. The workbook's Decision Log should contain every approved exception and follow-up owner.
Turn the RFP decision into a governed gifting program
A useful corporate gifting RFP protects non-negotiable boundaries, makes preferences explicit, prevents missing information from receiving a free pass, and links the award to implementation evidence. Accountable reviewers still own legal, privacy, security, tax, payroll, finance, and policy decisions.
Start small enough to test the model. Freeze scope, run gates, validate a handful of critical lanes, normalize one annual cost scenario, and document two viable alternatives. When the evidence supports an award, carry the scorecard, conditions, and decision log directly into implementation governance. That continuity is what turns an RFP from a procurement event into a reliable operating control.
Giftpack can serve as the execution layer for an approved gifting program by helping teams coordinate recipient choice, global delivery, and operational workflows. It does not replace the buyer's legal, tax, privacy, payroll, security, or policy decisions; evaluate it under the same gates, evidence rules, and weights as any other candidate.