Questions to ask a compliance service before you sign

Buying a compliance service is harder than buying software, because the thing you are buying is a promise about work that has not happened yet. Demos do not help much. These questions do.

On what you actually get

1. 01What exactly do you do every month, and what do I still have to do? Ask for it as a list, not a description.
2. 02How will I know it is being done, without asking you? A service that can only be verified by requesting a report is one you are managing rather than one that is running.
3. 03What happens the week before a certification visit? If the answer involves preparation, ask what has been happening the other fifty-one weeks.
4. 04Who is my named contact, and how often does that person change?

On independence and boundaries

1. 01Do you certify anyone? Do your people hold auditor roles with certification bodies?
2. 02Which decisions will you make, and which will you bring to me? Ask for an example of each.
3. 03Whose name appears in the audit log against an approval?

On leaving

1. 01If we end this in eighteen months, what do we walk away with, and in what format?
2. 02Is the system usable by our own team without you? Ask them to show you what that looks like.
3. 03What is the exit fee? The answer should be nothing.

On proof

1. 01Where does that number come from? Ask for the baseline, the sample and the period behind any percentage.
2. 02Can I speak to a client in a similar position, and will you be on the call? The second half matters.
3. 03What has gone wrong on an engagement, and what did you change afterwards?

On price

1. 01What is the fee based on, and what makes it go up?
2. 02What is not included that I am likely to need in year one?
3. 03What am I currently spending on consultants and internal time for the same work? Vendors rarely ask you this and it is the only comparison that means anything.