Three things to verify before a supplier scopes your project

When a supplier comes in to scope a project, the conversation often stops at cost and timeline. That leaves three critical questions unanswered — the ones that matter most to your audit trail, your security stance, and your budget.

Before the kickoff meeting, settle these three things

One: What is the supplier trying to prove?

A vendor's scope document is built to solve their problem, not necessarily yours. They may be trying to prove they can deliver on budget, or that they're cheaper than a competitor. They might be proving their methodology works at your company's size. None of that is wrong — but you need to know it. Ask outright: "What is this scope meant to show your team and ours?" The answer tells you what assumptions drive their estimate. If they're trying to prove speed, they may have cut corner cases out. If they're proving cost leadership, they may have assumed more of your staff will do integration work than your team actually can. Knowing their frame stops surprises in week four.

Two: What decisions need to be recorded?

Before work starts, agree on what decisions get logged. This matters for two reasons. First, your audit trail: if someone asks six months later why you chose this vendor or this approach, the record needs to hold the context and authority — not just that a decision was made. Second, the handover: whoever inherits this project after launch needs to understand why scope changed and who signed off. Walk through the scope with finance and security now, not after work begins. Get written approval on what's in, what's out, and who signs changes. That's not bureaucracy — it's the record that stops the project from becoming a question mark when it's live.

Three: Where does what stay?

If your supplier is using AI for analysis, estimates or documentation, you need to know where their tools run and what happens to your data. This isn't about trust — it's about compliance and control. Ask: "Which steps use external AI services? Which ones run on your own infrastructure? Where is the data during processing?" If they say "we use OpenAI" or "we use a cloud service," ask which one and whether your data leaves Canada. Under PIPEDA and Quebec's Law 25, you're required to disclose this in writing before work begins. It's not a barrier — but getting it clear now keeps you out of a security review surprise later.

These three checks take an hour. They cost nothing. And they turn a vendor kickoff into a real agreement — one both sides can point to when things move fast and pressure mounts. That's the difference between a scope document and a contract that works.

If you're scoping a project and want to walk through these three checks before you meet with a vendor, book a free session with an advisor. We help owners and managers get the governance right before the work gets complicated.