A compliance matrix is a table that lists every requirement in an RFP and shows where, and how, your proposal answers it. Most firms build one to avoid being disqualified. That's the right first reason. The second reason gets less attention, and it costs more: every requirement you mark "Complies" is something you will have to deliver, at the price you bid.
What a compliance matrix is
Each row is one requirement from the solicitation. The columns usually say:
- the requirement, quoted word for word
- where it appears in the RFP (section and page)
- whether it is mandatory or rated
- your answer: complies, partly complies, or does not comply
- where your proposal proves it (section, page, attachment)
- who on your team owns the answer
Here is what four rows might look like, with the RFP reference in brackets after each requirement. This is an invented example. The last column is the one most templates skip, and the rest of this post explains why it matters.
Example compliance matrix: IT support RFP (invented)
| Requirement | Type | Our answer | Where we prove it |
Owner (internal) |
Cost or risk note (internal) |
|---|---|---|---|---|---|
| "The Contractor must provide on-site response within four hours, 24/7, at all regional offices." (SOW 4.2) | Mandatory | Complies, at added cost | Section 3.1 | Operations lead | No staff in two regions. Needs a subcontractor, and after-hours rates in the price. |
| "The proposed project manager must hold a valid PMP certification." (Grid M3) | Mandatory | Complies | Appendix B | Owner | None. Already on staff. |
| "Bidders must have completed at least three projects of similar scope and value in the past five years." (Grid M1) | Mandatory | Partly complies | Section 2 | Owner | Only two projects qualify. Ask in the question period whether a partner's project counts, or don't bid. |
| "Describe your quality assurance approach, in no more than three pages." (Grid R2, 20 points) | Rated | Complies | Section 4.3 | Project lead | None to deliver. About a day of writing. |
The cost or risk note and the owner column are internal notes. If the RFP asks you to submit your compliance matrix, delete them first, so the buyer only sees the requirement, your answer and where you prove it.
The stakes on mandatory rows are plain. Whether the buyer is federal, provincial or municipal, RFPs commonly say that a bid missing a mandatory requirement is non-compliant and won't be evaluated further. Miss one, and the quality of the rest of your proposal stops mattering. The wording varies from buyer to buyer, so read the evaluation section of each RFP.
The part most guides skip: "Complies" is a promise
Your proposal doesn't disappear after award. Many RFPs say that the winning bid becomes part of the resulting contract. Look for a section called something like "Contract Documents" or "Priority of Documents": it often lists your proposal right alongside the terms and the statement of work.
So when a team ticks "Complies" on a requirement it can only half meet, it hasn't saved the bid. It has moved the problem to delivery. That is where a lot of scope creep starts: not with a demanding client, but with a yes the firm gave during a deadline rush. A common pattern with small firms is to treat the matrix as paperwork to finish the night before, when it is the one place where every commitment sits on one page.
A quick example
This is an illustration, not a real bid. An RFP for IT support says: "The Contractor must provide on-site response within four hours, 24/7, at all regional offices." A firm with technicians in one city marks it "Complies" because it can probably make it work.
Then it prices the bid on its normal staffing. If it wins, every after-hours call in a far-off office means overtime, travel or a subcontractor nobody budgeted for. The bid was compliant. The contract loses money.
The same thing happens in other industries: a construction schedule nobody checked against crew availability, a staffing bid that promises replacement personnel within 48 hours, a cleaning contract with frequencies that don't fit the hours priced.
How to build one that protects you
- Pull every "must", "shall" and "will" into its own row. Requirements hide in the statement of work, the evaluation grid, the contract terms and the appendices. Read them all, including addenda.
- Quote, don't paraphrase. A summary like "24/7 support" loses the "four hours" and the "all regional offices" that carry the cost.
- Add a cost or risk note to every row. Ask: can we do this with the people and tools we already have? If not, what does it cost, and is that cost in the price?
- Answer honestly in three ways. We comply as we are. We comply, and it costs this much. We can't comply as written.
- Decide what the third answer means. If it's on a mandatory, that's a no-bid unless you can fix it with a partner or the buyer clarifies it. Ask in the question period, before the deadline, and keep the question about the requirement, not your firm.
- Price from the matrix, not around it. The second answer above is a line in your cost build. If the price stops working once those costs are in, you have your bid/no-bid answer. Our bid/no-bid guide covers how to make that call.
- Check the finished proposal against the matrix. Every row should point to a real page that proves it. Reviewers score what they can find.
To start from a ready-made sheet with these columns, the internal ones shaded so you know what to delete, get our free compliance matrix template.
Where this fits
A compliance matrix is one of the first things built when Kenley Pursuit runs a bid, before any writing starts. It feeds the go/no-go decision (and the price check, when you want one), then becomes the checklist for the final review. You can see how that works on our government proposal writing and management page, or in the Bid Economics Assessment if you only need the decision and the price.
If you have a live RFP and aren't sure what you'd be signing up for, a free 20-minute Bid Health Check is a conversation about that one bid: what stands out, what to look at closely, and whether it looks worth your time.
Quick answers
Is a compliance matrix the same as a requirements checklist? Close. A checklist confirms you answered everything. A compliance matrix also shows where in your proposal each answer sits, so evaluators can find it and your team can check it.
Do I need one for a small RFP? If it has mandatory requirements, yes. A 20-row matrix takes an hour or two and is the fastest way to spot a requirement you can't meet before you've spent days writing.
What if we partly comply? Say so plainly where the RFP allows it, and explain how you'd meet the need. On a mandatory requirement, "partly" usually means non-responsive, so get it clarified in the question period or treat it as a reason not to bid.