This is written for the CIO or COO who signs the decision, the EPMO or transformation office director who champions it, the enterprise architect and information security lead who have to clear it, and the vendor management office that has to paper it. It assumes a change portfolio with mandatory regulatory work, at least one core or digital modernization program, and shared specialist teams that appear in every plan. It does not assume you are replacing anything in particular. Some readers run a legacy suite that only the PMO uses. Some run spreadsheets and SharePoint. Some are being asked by a regulator how change is governed and would like a better answer than “a deck”.
Every platform on the shortlist will tick the feature boxes and demo well. The questions that predict whether it is still in use two years later are about people, adoption and risk review.
Third-party risk review is the step most likely to add a quarter to the timeline, and it is usually started after the decision has been made.
BCG, Tech in Banking 2025. Regulatory compliance alone absorbs roughly 10% or more of overall IT spend.
IBM Institute for Business Value, 2025.
CUBE, Cost of Compliance Report 2025, survey of 2,000+ compliance and risk officers.
Every platform on the market will demo well. For each question below: what to ask, what a good answer looks like, and how PPM Express answers it, so you can hold us to the same standard.
Ask the vendor to load three of your real programs, including one mandatory regulatory item, and show what happens to the architecture, security and data teams when a fourth is added. If the answer is a budget chart, the tool plans money. Banks are rarely short of money for mandatory work. They are short of the twelve people every plan assumes it has.
Capacity is held per person and per role, in hours or percent FTE, against a real work calendar. Allocation across every initiative shows against it, and over-allocation is flagged before a date is approved, not after four programs discover they share one security team. Mandatory work is visibly mandatory, and the strategic work it displaces is visibly displaced.
Each person's capacity comes from their work week and calendar exceptions; allocation shows in hours, percent or FTE with overallocation flagged. Funding scenarios are tested against free capacity, what is left after the commitments people already carry, so the executive committee sees which combination of regulatory, modernization and customer initiatives actually fits the people available.
A consent order, an exam finding, a core-vendor delay or a merger re-orders the plan mid-year. Ask how long it takes to model two alternatives and publish one. If the answer involves exporting to Excel, the tool is a system of record for a plan that no longer exists.
Competing scenarios can be built against one budget ceiling in an afternoon, compared on strategic value, benefits, risk, cost and capacity, and one selected and published back to the projects with the numbers baselined at the moment of decision. When upstream numbers move afterwards, the tool shows what changed rather than absorbing it silently. Internal audit can see the model, the weights, the scenarios compared and the one chosen, months later.
The what-if scenario planner scores initiatives on a weighted strategic and risk model (or MoSCoW, or ICE), builds multiple scenarios per analysis against a budget ceiling, shows the Pareto frontier where nothing can be improved without conceding something, checks each scenario against free capacity, and publishes the selected one with baseline and decision history. A model already scoring live work has to be cloned before it can be changed, so the basis of a past decision cannot be edited after the fact.
Ask for the price at the number of people who should be able to see their own programs: sponsors, risk owners, line-of-business leaders, program managers, finance partners. Not the number of people who will edit schedules. In most banks the first number is ten to twenty times the second.
Per-seat pricing quietly limits adoption to the PMO, and a portfolio only the PMO can see is a report, not a system. A good answer is a flat price with unlimited users, viewers and guests, so adoption is a change-management question rather than a procurement one.
Every plan includes unlimited users, viewers and guests. Ultra, the plan built for large enterprises and public companies, is a flat $25,000 a year. The cost section below shows what that means at 250 and 1,000 users against a per-seat suite.
Bring vendor management into the first conversation, not the last. Ask where the data lives, who controls identity, what the vendor certifies itself versus inherits from its cloud provider, what its AI features can read, who the subprocessors are, and how the contract ends. Ask for the DPA before the demo.
Data in an isolated tenant in your chosen region. Single sign-on through your own Entra ID or Okta with your conditional access and MFA policies applied as-is, so identity never leaves a system your examiners have already reviewed. Encryption in transit and at rest, audit logs, a published subprocessor list, a self-serve DPA, a plain statement of what the vendor does and does not certify, and a written answer on AI data use. Tools that live inside Microsoft 365 shorten this review because the identity and data boundary is one you already own.
One isolated tenant per bank on Microsoft Azure, US or EU residency, Entra ID or Okta SSO, FIPS 140-2 encryption, geo-replicated backups across three availability zones, audit logs on the portfolio of record, a 99.9% uptime commitment for Enterprise customers, and no customer data used to train AI models. PPM Express does not hold its own SOC 2 or ISO 27001 certificate; the Azure data centers do. The Security & Trust page sets out the shared-responsibility split with Azure, the DPA and the regulatory mapping.
Ask how your existing portfolio data gets in, how it gets out, and what you owe if the platform is not adopted in year one. A vendor confident in adoption will make the exit easy.
Migration from the tools you already run without a services engagement. Export of everything at any time. A short, guaranteed implementation, and commercial terms that put the adoption risk on the vendor rather than on the bank.
Work is assembled from Azure DevOps, Jira, Microsoft Project, Planner, Project for the Web, Smartsheet and monday.com, and migration from Planner and Smartsheet is free. The trial is thirty days on the full plan with unlimited users, purchases carry a thirty-day full refund, and banks replacing an incumbent can use the Switch terms: implementation guaranteed in fifteen business days, deferred billing for up to twelve months while the incumbent is retired, and a year-one exit refund.
PPM Express publishes a comparison of nineteen platforms against the same eighteen requirements at a 250-user scenario, scored only from published vendor documentation, with the methodology open. The six platforms banks most often shortlist are below. Scores are weighted points earned out of 43, expressed as a percentage.
List-price arithmetic only: discounts, add-ons, implementation and support are excluded, and actual pricing varies by contract. The point is the shape, not the decimals. Per-seat pricing grows with adoption; a flat price does not.
$30 per user per month is the published Microsoft Planner Premium (Plan 3) price used on the comparison page; Planview, Clarity and ServiceNow SPM do not publish list prices and are typically higher. At 1,000 users the break-even against a $30 seat is about seventy users. Everyone after that is free, which is the point: the business can be in the portfolio without the PMO having to justify each login.
These cover what the interagency third-party risk guidance, the FFIEC handbooks and NYDFS Part 500 expect a bank to be able to evidence for a SaaS platform holding change data. Use them for every vendor on the shortlist. PPM Express's answers are on the Security & Trust page.
If the five questions match the ones your evaluation is already asking, the fastest way to test them is on your own portfolio. A discovery call takes thirty minutes; a trial runs thirty days on the full plan with unlimited users, and a bank switching from an incumbent can be live in fifteen business days. If vendor management wants to go first, the Security & Trust page has everything they will ask for.
Anton Kravsov is the founder and CEO of PPM Express and previously founded FluentPro, a Microsoft Gold Partner that served more than a hundred Fortune 500 portfolio management customers. He has spent fifteen years in the Microsoft project and portfolio management ecosystem.
Sources: BCG, Tech in Banking 2025 · IBM Institute for Business Value, core banking modernization, 2025 · CUBE, Cost of Compliance Report 2025 · ppm.express/alternatives and /comparison-methodology · ppm.express/ppm-express-pricing and /switch · ppm.express/security-and-trust. Last updated 4 September 2026.
.svg){kind=small}
