Compare contractors and business services providers against the same written scope, then verify their ability to deliver, the full cost, and the terms that will govern the work. The right checks depend on what the supplier will do and the consequences if it fails; licensing, insurance and legal requirements also vary by service and jurisdiction.
Define the work before comparing providers
Start by describing the outcome you need, not by comparing sales proposals written to different assumptions. Set the requirements before reviewing bids so each provider is assessed on the same basis.
- Outputs and boundaries: State what must be delivered, what is outside the scope, and what the SME will provide.
- Timing and service: Specify milestones, deadlines, availability, response times or other service levels that matter.
- Success and acceptance: Explain how completion will be checked and who approves the work.
- Dependencies: Identify access, information, equipment, decisions or third parties the supplier will need.
Ask each provider to explain its understanding of the deliverables and obligations. Check the assumptions behind its proposal; an apparently low price or short schedule may depend on work being excluded or on inputs your business has not agreed to provide.
Compare capability and capacity
A supplier needs both the relevant skills and the practical ability to deliver your work on time. Match evidence to the job’s scale, complexity and risk rather than relying on broad claims of expertise.
#1 Best Overall
- Relevant experience: Look for examples of similar work and ask what the provider actually delivered.
- People and systems: Identify the delivery lead, the team’s relevant skills and the operational systems that support the work. Check equipment where it is material to delivery.
- Capacity: Ask whether the proposed team can meet your schedule alongside its existing commitments, and how the supplier will handle staff absence or competing work.
- Past performance: Request evidence appropriate to the engagement, such as performance reports or references. A short track record is not, by itself, proof of poor performance; assess what evidence exists and what uncertainty remains.
New Zealand Government Procurement recommends checking capability, capacity, systems, history and the assumptions supporting price and delivery, with claims corroborated through multiple sources: Conducting due diligence checks.
Verify the provider and its ability to continue
Check that the business is who it says it is and can remain able to perform for the length of the engagement. Scale the depth of these checks to the value, duration and potential consequences of failure.
- Confirm the supplier’s legal identity and ownership.
- Check relevant licences, qualifications, compliance obligations and insurance for the service and location.
- Review financial history and viability where proportionate. Accounts, credit checks or other available evidence may help identify continuity concerns.
- Speak to recent or current customer references about comparable work, delivery and problems encountered.
- For higher-risk work, consider performance reports or a site visit if they help verify claims.
- Identify subcontractors and check their role, capability and relevant controls.
Australia’s Department of Finance advises tailoring due diligence to the scale, scope, risk and complexity of the procurement; its guidance covers financial, reference, compliance, insurance, licensing and subcontractor checks: Due Diligence in Procurement. Public-sector procurement guidance is a useful model, not a set of rules that automatically governs private SME purchases. Confirm the requirements that apply in your jurisdiction and sector.
Compare total value, not just the headline quote
Ask for a price that can be compared on the same scope and assumptions. Record what is included, excluded or conditional, as well as any ongoing or add-on charges. Compare dependencies and delivery commitments alongside the price; the cheapest proposal may transfer work, risk or cost back to your business.
What’s actually slowing this PC down?
Pick the symptom - the matching free tool is one click away.
US federal procurement rules make a related point in their own context: FAR 9.103(c) says, “The award of a contract to a supplier based on lowest evaluated price alone can be false economy if there is subsequent default, late deliveries, or other unsatisfactory performance resulting in additional contractual or administrative costs.” This is US federal procurement guidance, not a general legal rule for private SME contracts. See FAR Part 9—Contractor Qualifications.
Make the comparison consistent
Use one worksheet for every candidate. Set the criteria before reading proposals and give greater weight to factors that matter more for this work—especially where failure would cause significant disruption, loss or liability. There is no universal weighting that suits every contract.
| Criterion | Evidence or question to record |
|---|---|
| Required outcome | What must be delivered, by when, and how will acceptance be determined? |
| Similar work | What relevant examples, performance evidence or customer references were checked? |
| Delivery team | Who leads the work, who else will do it, and what relevant skills do they have? |
| Capacity and timing | Can the supplier meet the schedule alongside existing commitments? What are the dependencies? |
| Identity and credentials | Was the legal identity confirmed? Were relevant licences, qualifications and compliance checked? |
| Continuity and finances | Are there financial or business-continuity concerns that matter to this engagement? |
| Scope and exclusions | What is included, excluded or conditional? What must your business provide? |
| Total quoted cost | What assumptions underpin the price, and what additional or recurring charges may apply? |
| Subcontractors | Who will perform subcontracted work, and what will they access or control? |
| Insurance and compliance | Does the evidence fit the service, contract and applicable jurisdictional requirements? |
| Security and data, if applicable | What controls protect systems and information, and how are incidents handled? |
| Service and reporting | What response levels, performance measures and reports will the provider supply? |
| Contract responsibilities and liability | Who is responsible for each obligation, and how are liability and risk allocated? |
| Unresolved questions | What remains unverified or unclear, and must it be resolved before signing? |
Keep notes on the evidence behind each assessment, not just a score. A high rating is only useful if the supporting claim has been checked.
Independent reader supportYour contribution helps us test, update, and keep practical guides available for everyone.Put responsibilities, payment and remedies in writing
The contract should turn the selected proposal into clear, workable obligations. Check that it states:
Best Value
- the deliverables, exclusions, dependencies, milestones and acceptance process;
- who is responsible for each task, including any subcontracted work;
- the price, payment timing and how approved changes affect cost or schedule;
- service levels, reporting and escalation routes where ongoing service is involved;
- how either party raises a problem, handles underperformance or ends the arrangement;
- liability, insurance and other relevant risk allocation; and
- how changes are agreed and recorded.
Allocate each risk to the party best placed to manage it, and consider how you will monitor performance during the engagement. The UK Cabinet Office’s supplier-selection material discusses proportionate participation conditions and insurance in a public-procurement context; it should not be read as a statement of private-sector law: Module 6: Supplier selection.
For IT providers, treat security as part of supplier fit
If a managed service provider (MSP) will access business systems, customer information or important data, include security in the selection criteria and contract—not as a check after choosing on price. The UK National Cyber Security Centre’s SME guidance recommends examining recognised certifications, such as Cyber Essentials Plus, ISO 27001 and SOC 2, alongside SME client references, transparent practices, defined service levels, incident procedures and liability terms. A certification is evidence to consider, not a substitute for checking how the particular service is configured.
Ask the provider to explain its arrangements for:
- patching and vulnerability management;
- backups and testing whether data can be restored;
- monitoring, access controls and technical reporting;
- incident response, including when and how your business will be notified; and
- charges for security work or services outside the standard agreement.
Make agreed measures specific in the contract. One useful check from the NCSC’s MSP contract guidance is: “Does the contract specify how and when security incidents are notified?” The NCSC also recommends patching critical- or high-risk vulnerabilities within 14 days of an update being released in MSP arrangements. That is service-specific guidance, not a universal procurement deadline. See Choosing a managed service provider (MSP).
Quick Recap
Product prices and availability are accurate as of the date/time indicated and are subject to change. Any price and availability information displayed on Amazon at the time of purchase will apply.
