A useful consultant brief makes competing proposals comparable and defines what your team must be able to do when the engagement ends. Write it before requesting quotes, then use the same scope and assumptions with each candidate.
If you are still deciding between a project consultant, ongoing support and an internal role, start with when to hire a technology consultant.
Write a one-page scope
- Problem: the affected workflow and observed failure, with evidence.
- Outcome: the business task that must work after delivery.
- Environment: relevant systems, dependencies and data sensitivity.
- Boundaries: included work, exclusions and decisions reserved for the owner.
- Constraints: available staff, downtime window, budget and deadline.
- Deliverables: configuration, documentation, training and test evidence.
For example, a reporting brief could require a repeatable export, reconciled totals and instructions a nominated employee can follow. “Improve analytics” alone does not define acceptance.
Use a quote comparison worksheet
| Field | What to ask |
|---|---|
| Assumptions | Which data, access and staff availability does the quote require? |
| Cost | Which fees are fixed, estimated, recurring or excluded? |
| Changes | Who approves added work before it is charged? |
| Testing | What evidence demonstrates that the agreed task works? |
| Support | What happens if the delivered configuration fails after handover? |
| Exit | How can your team or another supplier operate the result? |
Request clarification on missing fields rather than assuming they are included. A proposal that omits training should not be compared with one that includes it as though both deliver the same service.
Plan access before work starts
Use named accounts and the minimum permissions needed for the agreed task. Keep ownership of domains, provider accounts, billing and recovery details within the organisation. Agree which changes need approval and which records must be kept. Do not send a broad set of production credentials simply because the consultant asks for “full access.”
Document how access will be revoked at the end, including subcontractor access and credentials created during the work. Account control is part of handover, not an administrative detail to postpone.
Define acceptance and handover
- Run the agreed workflow with representative test cases.
- Record failures and exceptions, including any accepted limitations.
- Have the nominated employee demonstrate the documented operating procedure.
- Check that backups, configuration records and escalation contacts are available.
- Confirm support arrangements and remove access that is no longer needed.
For the reporting example, acceptance might include reconciling a known sample and repeating the export without the consultant. These are illustrative checks to adapt to your task, not universal contractual terms.
Keep a decision trail
Record scope changes, approvals and unresolved risks alongside the final deliverables. Obtain appropriate professional advice for legal or regulated requirements. NIST’s guidance on external cybersecurity support is a useful reference for clarifying responsibilities; outsourcing does not remove the business owner’s responsibilities.
If the work concerns an infrastructure upgrade, use the capacity-test worksheet to agree evidence before implementation. More related resources are in the Technology guides.
