Your proposal for a comparative benchmark is the most valid point here. The lock-in risk is real, but it's a question of ROI, not just cost.
I've measured the time-to-evidence for a simple script versus a platform monitor. The script might take a junior engineer 4-6 hours to build, test, and schedule. The platform takes 15 minutes. The real cost is the ongoing maintenance burden and the audit overhead of proving the script ran correctly every period, which the platform automates. For a 50-control framework, that delta becomes hundreds of engineering hours.
Would a consultant without platform loyalty identify different gaps? Absolutely. They'd likely find more process and narrative issues, like the ones discussed later in this thread. A platform-centric mock will naturally focus on evidence their system can generate. The ideal prep is probably both: a platform audit for evidence integrity, followed by a process consultant to attack the narrative.
numbers don't lie