Subcontractor Engagement

Purpose

Subcontractors are used where specialist capability, capacity, or delivery support is required.

Subcontractor engagement must be controlled to protect customer delivery, company IP, security obligations, and commercial position.

Subcontractor Principles

• Use subcontractors only where there is a clear business need.

• Flow down relevant customer obligations.

• Do not expose customer or company information unnecessarily.

• Ensure subcontractor deliverables are clearly defined.

• Ensure IP ownership and licensing are clear.

• Ensure security and confidentiality obligations are enforceable.

• Maintain audit and oversight rights.

• Track supplier performance throughout delivery.

Required Controls

Before a subcontractor starts work, the following should be in place:

• signed subcontractor agreement

• agreed scope or work order

• NDA or confidentiality terms

• security onboarding

• access approval

• conflict of interest check

• insurance evidence where required

• right-to-work or compliance checks where applicable

• IP assignment or licence terms

• delivery and reporting expectations

Supplier Delivery Risk

Supplier risks must be recorded in the project RAID log.

Examples include:

• dependency on specialist resource

• late delivery

• unclear acceptance criteria

• security clearance delays

• customer access constraints

• IP contamination

• quality issues

• insolvency or capacity concerns