Glossary term
Trade-off analysis
Also: Option trade-off, Sensitivity analysis
The explicit documentation of what each option gives up to deliver its strengths. Good trade-off analysis makes the cost of the winning option as visible as its benefits, and shows how robust the choice is to changes in weights.
Every real decision involves trade-offs. A memo that lists only the strengths of the chosen option is a sales document, not a decision record. The audit value of a memo comes from the explicit acknowledgement of what was traded away.
Three analytical moves make trade-off analysis useful: compare each option against the chosen one on the dimension the chosen one loses, show the sensitivity of the ranking to the weight of the contested criteria, and name the residual risk that the trade-off creates.
In practice
Under DORA Art. 6 and NIS2 Art. 21, risk acceptance is a named management act. Trade-off analysis is how a memo makes risk acceptance legible to the management body rather than buried in spreadsheet cells.
Related terms
Decision memo
A short structured document that captures why a decision was made, the options considered, the criteria and trade-offs, the stakeholders involved and the accepted risks. A good decision memo is auditable months later.
Vendor matrix
A structured comparison of vendor options across weighted criteria, showing scores, evidence per cell and an aggregate result. A good vendor matrix separates dealbreakers from weighted criteria and makes every score traceable to a source.
Audit-ready decision
A decision whose record is structured, evidence-backed and stakeholder-signed to a level that a third-party auditor, a supervisor or a board reviewer can reconstruct the reasoning without interviewing the original team.
TCO modelling
A structured estimate of the full lifetime cost of a vendor decision, including licence, implementation, integration, operation, change management and exit cost. List price is usually 20 to 40 percent of real TCO; modelling exposes the rest.
TIA
Assessment of the protection level in the recipient country for data transfers to third countries after Schrems II. Required under SCC, BCR, and Art. 49 derogations. Output: decision whether the transfer may proceed without, with, or not at all.
TISAX
Audit standard and exchange platform of the German automotive association (VDA) for information security. ISA catalogue is the assessment grid, ENX operates the platform.
TPRM
Discipline and tool category for governing risks from external providers (SaaS, cloud, outsourcing, advisory). Mandatory under DORA Art. 28-30 for financial entities and NIS2 Art. 21 (d) for essential/important entities.
AI Act Conformity Assessment
Procedure to demonstrate that a high-risk AI system complies with the EU AI Act before being placed on the market or put into service. Mandatory for all Annex III high-risk systems from 2 December 2027 (postponed from the original 2 August 2026 by the Digital Omnibus, Regulation (EU) 2026/1744).