The Request Beyond the Boundary
You are a sole practitioner specialising in operating model design and process improvement. A 600-person insurance broker has engaged you for a 10-week operating model review at €45,000, and you are two weeks in. The client's COO now asks you to also deliver a full cyber resilience review: penetration testing of the client portal and broker extranet, a control gap assessment, and a SOC 2 readiness opinion. The fee would rise to €60,000 and the work must finish in six weeks, because a major broker network will not renew a trading agreement without attestation. The COO's reasoning is that most of it is process and governance anyway, and you are already inside the business. You have done process risk and control work, and you have read a good deal about cyber frameworks, but you have never scoped or interpreted a penetration test, and you have never supported an attestation. Your professional indemnity cover is written for management consulting, not security testing.
1. How do you respond to the COO's request?
Read the worked answer
Split the request along the line of your actual competence, and say which side you are on before discussing money or deadlines.
What you can do credibly: governance and accountability structure, policy and process design, third-party and vendor risk, incident escalation and business continuity planning, and the operating model changes that make controls stick. That is genuine value and it sits inside your existing engagement.
What you cannot do: scope, execute, or interpret penetration testing, and form a SOC 2 readiness opinion. The first requires offensive testing skills and the second requires familiarity with the trust services criteria and evidence standards, plus the professional standing to sign. Reading about it is not competence, and the failure mode is not a bad report - it is a trading relationship lost on the strength of an assurance nobody qualified gave.
So say plainly: I can lead the programme and integrate the result, but I cannot be the technical assessor or the attestation opinion. Then bring a route forward in the same conversation, because the COO has a real deadline. Propose naming one or two accredited security firms, agreeing scope and price with them transparently, and having you manage the interface and fold the findings into the operating model work. That answers the need without pretending to a capability you lack.
2. How would you structure the subcontract commercially and contractually?
Read the worked answer
Keep your accountability narrow, explicit, and priced for the coordination you actually add.
Contract structure. The client contracts the security firm directly if possible. That keeps the technical opinion, the liability, and the insurance where the competence is, and it stops you becoming a reseller of a service you cannot quality-assure. If the client insists on a single contract with you, then the security firm must be a named subcontractor with a back-to-back liability cap, its own professional indemnity cover at an agreed level, and a scope the client has seen and approved in writing.
Scope split. Write down which deliverables you own and which the specialist owns. You own the governance review, the remediation roadmap and the integration with the operating model. They own the test report, findings classification, the control gap assessment and any readiness opinion. Make clear that you do not review, endorse or sign their technical conclusions.
Pricing. Price your coordination honestly - managing two workstreams, attendance at readouts and translating findings into operating model changes is real work. Disclose the specialist's fee to the client rather than burying a margin inside it; a visible mark-up on a service you cannot assess invites exactly the question you want to avoid.
Timing. Six weeks is plausible only if testing starts within days. Sequence access and environment provisioning before you sign.
3. The COO refuses a subcontractor and wants you to sign off the attestation yourself. What now?
Read the worked answer
Refuse the signature, and be specific about why, because a bare no invites pressure.
An attestation is a statement that defined controls were designed and operated effectively against a standard, supported by evidence gathered by someone competent to gather and evaluate it. You have not gathered that evidence and are not competent to do so. Signing would misrepresent your qualifications to a third party that will rely on the document - a broker network making a trading decision. That is not a commercial risk you can price; it is a misstatement, and your indemnity cover would very likely decline it, leaving you personally exposed.
Say this once, clearly, and then move to the practical problem: the trading agreement deadline. Options worth putting on the table are a phased approach where the security firm delivers the attestation-critical testing while you deliver governance and remediation planning in parallel, or a request to the broker network for a conditional extension supported by a documented remediation plan and evidence that testing is booked. Networks do grant these when the plan is credible.
If the COO still requires you personally to sign, decline that portion of the work in writing, keep the original engagement if the relationship allows, and document the advice you gave. Do not let the deadline convert a competence limit into a negotiation.