The answer is not always build custom. Here is the decision framework we use on every audit call to work out which approach makes sense.