A focused control review, a broad operational audit and a formal assurance engagement can involve different work and outputs. Establish the purpose and scope before using one quote as a benchmark for another.
What to specify when requesting a quote
| Factor | What to describe |
|---|---|
| Systems and complexity | Platforms, dependencies and areas to be examined. |
| Depth of examination | Documents, configurations, testing and sampling expected. |
| Users, devices and sites | Population and locations relevant to the scope. |
| Evidence and access | Available records, required permissions and coordination needs. |
| Intended reader and output | Report purpose, deliverables, restrictions and any external requirements. |
| Follow-up | Whether remediation verification is included; distinguish it from implementing changes. |
The time required depends on the actual engagement. Do not treat a generic hours-versus-days comparison or a company's headcount as a reliable quote.
What the proposal should explain
- The question, scope, exclusions and evidence needed.
- The fee basis, assumptions and process for agreeing changes.
- Who performs the work and what experience is relevant.
- Deliverables, limitations and permitted use or sharing.
- Relevant interests and independence arrangements.
- Responsibilities for implementing and checking any follow-up.
If a report is intended for an insurer or another outside reader, confirm that reader's requirements before commissioning work. Payment and independence do not guarantee acceptance.
Compare quotes on a consistent basis
Give each firm the same brief and record differences in scope. Ask for a permitted example or illustration of the deliverable, clearly distinguished from your own future findings.
Ask whether the fee is fixed or estimated, what assumptions it relies on and how changes require agreement. An estimate does not automatically increase; a fixed fee does not eliminate the need to understand exclusions.
The principles of comparing IT proposals also help here. For no-cost offers, examine the assessment's purpose, evidence and incentives.
Decide what the review would help you resolve
Identify the decision or risk question and the uncertainty a review could address. Discuss whether the proposed work is proportionate and whether its timing fits the decision.
For an initial discussion, use the ten-question checklist or the provider-evaluation guide. These are starting points, not substitutes for every type of audit.
Our fee is quoted against the agreed scope rather than published here as a single figure. Discuss the question and intended use of the Actually Review before requesting a proposal.
