Do these 3 things before closing this tab:
1Clear out junk files and repair common Windows errors2Scan for outdated or missing drivers - takes under a minute3Repair Windows errors before they cause bigger problemsCompare prospective contractors and business-services providers against the same written requirements—not just their quotes. Start by defining the outcome and risks, then verify each provider’s capability, capacity, reliability, full cost and contract terms. The checks should be proportionate to the work: an IT provider with access to sensitive systems calls for closer security scrutiny than a low-risk, one-off task.
Define the work before comparing providers
Write a short brief describing the result you need, what the provider will and will not do, when the work must be completed, and how you will decide it is acceptable. Include service requirements, dependencies on your staff or systems, and any reporting you expect.
As an Amazon Associate I earn from qualifying purchases.
Give every candidate the same brief. Ask them to explain their proposed deliverables and obligations, identify assumptions, and flag anything they consider outside scope. A proposal that sounds polished but answers a different question is not a good fit.
Compare evidence against the same criteria
Set criteria before reviewing proposals and weight them according to the consequences of failure and the importance of the work. There is no universal scoring formula: the right balance depends on the service, contract and risks. Use a consistent worksheet for each candidate:
#1 Best Overall
| Comparison item | What to record or verify |
|---|---|
| Required outcome | The deliverables, boundaries, timing and success measures the candidate has accepted. |
| Relevant capability | Evidence of similar work, relevant technical skills, equipment where needed, and operational systems. |
| People and capacity | Named delivery lead and team, availability, schedule, and ability to meet commitments alongside existing work. |
| Track record | Recent customer references and, where proportionate, performance reports or a site visit. Record what you checked. |
| Identity and credentials | Legal identity and ownership, relevant licences, qualifications, compliance evidence and insurance. |
| Continuity and financial concerns | Any proportionate checks of financial history or viability, such as accounts or a credit check, and unresolved concerns. |
| Scope and total cost | Inclusions, exclusions, dependencies, assumptions, subcontractors, add-on charges and total quoted cost on a comparable basis. |
| Delivery and oversight | Service levels, reporting, responsibilities, escalation routes and how performance will be monitored. |
| Risk and contract terms | Acceptance, payment, liability, change control, underperformance remedies and any service-specific safeguards. |
| Open questions | Unverified claims, missing evidence and issues to resolve before signing. |
This is a practical comparison aid, not a list of legal requirements for every SME purchase. New Zealand, Australian, US and UK public procurement guidance converges on proportionate checks, corroborating claims and clear obligations, but the legal rules differ. Confirm requirements that apply to your jurisdiction, sector and service.
Check capability, capacity and reliability
Look for relevant proof, not broad claims
Ask for examples of comparable work and what the provider actually delivered. Check references with recent customers whose projects resemble yours; ask about timeliness, communication, quality and how problems were handled. A provider’s own claims are a starting point, not independent confirmation.
Confirm the people and resources are available
Identify who will lead and perform the work, whether specialist staff or equipment are needed, and how the proposed schedule fits their existing commitments. Ask how delivery would be covered if a key person is unavailable. A capable supplier may still be unable to meet your timing or service needs.
Verify business details and continuity proportionately
Confirm the provider’s legal identity and ownership, relevant licences and qualifications, compliance status and insurance. Depending on the value and risk of the engagement, consider reviewing accounts, credit information, performance reports or other evidence of financial viability and continuity. A missing history alone does not establish poor performance; seek evidence suited to the candidate and the work.
Compare the full value, not only the headline quote
Put proposals on a like-for-like basis. Check whether each price covers the same deliverables, timeline, support and acceptance criteria. Record exclusions, client-side dependencies, subcontracting, recurring fees and charges for changes or work outside the stated scope. Test whether the supplier’s pricing and delivery assumptions are realistic.
The US Federal Acquisition Regulation warns in its federal procurement context: “The award of a contract to a supplier based on lowest evaluated price alone can be false economy if there is subsequent default, late deliveries, or other unsatisfactory performance resulting in additional contractual or administrative costs.” That is a US federal procurement caution, not a general private-sector legal rule; for an SME, the practical point is to weigh the quote against scope, delivery confidence and the cost of failure.
Make the contract match the comparison
Once you choose a provider, put the agreed proposal into clear terms. Specify what is included and excluded, who is responsible for each task, how completion will be accepted, when payment is due, what reporting and service levels apply, and how changes, delays or underperformance will be handled. Set out liability and escalation arrangements appropriate to the work.
Allocate each risk to the party best placed to manage it. Due diligence should not stop at signing: agree how performance will be monitored and how issues will be raised during delivery. Where a regulated service, particular insurance or licence is involved, verify the applicable local requirement rather than assuming a generic checklist settles it.
Best Value
For IT providers, make security a selection criterion
If a managed service provider (MSP) will access business systems, customer information or important data, assess security before appointing it. The UK National Cyber Security Centre recommends considering recognised certifications such as Cyber Essentials Plus, ISO 27001 and SOC 2, alongside SME client references, transparent practices, defined service levels, incident procedures and liability terms. Certification is useful evidence, but does not replace checking how the particular service is configured.
Ask specific, verifiable questions
- How are systems patched, and who is responsible for applying updates?
- How are backups made, protected and tested through restores?
- What monitoring, access controls and incident-response procedures are in place?
- What technical reports and service-level information will you receive?
- Which security tasks or incident-response services cost extra?
- Does the contract specify how and when security incidents are notified?
The NCSC recommends that MSP arrangements address critical- or high-risk vulnerability updates within 14 days of an update being released. This is NCSC service-specific guidance, not a universal procurement deadline; agree the applicable commitment and responsibilities in the contract.
Use a risk-based final check
Before committing, review each candidate’s worksheet and resolve material gaps. For a low-risk, bounded job, a brief reference and identity check may be enough. For work involving sensitive data, business-critical systems, safety, significant spend or long-term dependence, deepen checks on continuity, security, insurance, subcontractors and performance evidence. Proceed only when the scope, evidence, price assumptions and written responsibilities give you a defensible basis for the decision.
Quick Recap
Sources and jurisdiction context
- New Zealand Government Procurement: Conducting due diligence checks
- Australian Department of Finance: Due Diligence in Procurement (November 2023)
- US Federal Acquisition Regulation, Part 9—Contractor Qualifications
- UK Cabinet Office: Module 6—Supplier selection
- National Cyber Security Centre: Choosing a managed service provider
- NCSC MSP contract checklist
- NCSC MSP setup guidance
Product prices and availability are accurate as of the date/time indicated and are subject to change. Any price and availability information displayed on Amazon at the time of purchase will apply.
