Subcontracting a Test and Keeping the Report Yours

Every consultancy subcontracts eventually. A hardware job, a language nobody in-house reads, two engagements landing in the same week. The testing is the easy part to arrange. The report is where it goes wrong.

The client is buying your name

Start from that. The client signed with you, the letterhead is yours, and the liability follows the letterhead. Whatever arrangement you make behind it, the document that goes out has to be yours in substance as well as branding: your severity scale, your house language, your quality bar.

That is not a formality. A subcontractor’s critical may be your high. Their evidence standard may be a screenshot where yours is a request and response pair. Shipping their judgement under your name means you will defend it in a meeting you are not prepared for.

What to agree before they start

• Where the data lives. If they work in their own tooling, your client’s vulnerabilities are now on a third system your client has never been told about. Either bring them into yours or tell the client, and the first is easier than the second.
• What happens to it afterwards. A deletion commitment with a date, in the contract, not an assurance in a call.
• Whose findings library. If they write from their own boilerplate the report reads as two documents. Give them yours.
• Attribution. Whether the client is told a subcontractor was used. Say yes. Finding out later is worse than being told, and some frameworks require it.
• Right to test. Your authorisation from the client has to cover them by name or by category, or their traffic is unauthorised regardless of what you agreed with them.

Access, and the mistake everybody makes once

The tempting arrangement is to give them a login to your platform and sort out the details later. The details are: which clients can they see, which engagements, and can they read the knowledge base you spent three years building.

Scoped access, granted per engagement, revoked on the last day. If your tooling cannot do that, the subcontractor works in a shared document and you paste the results in, which is worse in every way except the one that matters, so most firms should fix the tooling.

Review is not optional and it is not a read-through

Somebody of yours reviews every finding: the rating, the evidence, the remediation and whether it is reproducible from what is written. That is the same review you would do on a junior’s work, and for the same reason. Budget for it when you price the job, because a fortnight of subcontracted testing is not a fortnight of your cost.

Where the review disagrees with the subcontractor, your rating wins, and the conversation about why happens with them rather than in the document. A report carrying two voices arguing is a report that loses an argument with a client.

What the client is told, and when

The instinct is to keep it quiet, and it is the wrong instinct in both directions. Clients who find out afterwards conclude you were hiding it, which is a much larger problem than the subcontracting was. Clients told at the point of scoping almost always shrug, because using a specialist for a specialist job is what they would want you to do.

Tell them what the person is being brought in for, that they are covered by the same confidentiality terms, and that the work is reviewed by you before it reaches them. Do not name the individual unless the client asks or the authorisation requires it, because naming invites a conversation about their CV that is not the point.

There is one case where the answer is different. If the client is in a regulated sector, or runs a supplier assurance process, subcontracting may need approval rather than notification, and the approval may take longer than your engagement lead time. That is a scoping question and it belongs in the first call, not in the week you realise you need help. Ask whether they have a process for it, and if they do, start it before you promise a date.

The commercial shape

Day rate, fixed fee or a share is a decision about who carries the overrun. Day rate puts it on you, fixed fee on them, and a share on both. For a specialist you have not worked with, fixed fee with a clearly bounded scope is the least painful first arrangement, and it forces the scoping conversation to be real.

Whatever you agree, price your review into the client quote rather than absorbing it. The margin on subcontracted work is thinner than it looks, and the review is the part firms forget to count.