Managing Subcontractors and Flow Down Obligations
To the client, work performed by a subcontractor is your work. The contract usually agrees, and the subcontract frequently does not.
Firms subcontract for good reasons: a specialist capability, a language, a jurisdiction, a peak in demand. The risk is structural rather than reputational. The firm holds obligations to its client, and unless equivalent obligations are placed on the subcontractor, the firm carries a gap it has not priced and often has not noticed.
The gap appears in the same three places every time: liability, confidentiality and quality. Each is straightforward to close at the point of appointment and difficult to close afterwards.
What must flow down
- Confidentiality on terms at least as strict as the client contract, and covering the client's information specifically rather than the firm's alone.
- Data protection obligations, including the lawful basis for any transfer, the permitted purposes, sub-processing restrictions and deletion at the end. Where personal data crosses borders, the mechanism has to be named rather than assumed.
- Intellectual property, so that what the subcontractor produces can lawfully be delivered to the client on the terms the client contract promises. A firm that has assigned rights it does not own has a problem it will discover late.
- Liability and insurance at a level proportionate to the exposure. A capped subcontract sitting under an uncapped client obligation is the most common gap, and it is worth pricing explicitly if it cannot be closed.
- Conflicts and independence, because a subcontractor's other clients can compromise the firm's position on this engagement.
- Record retention and access, so the firm can produce the working papers behind the subcontractor's work if it is ever challenged.
Quality on work you did not perform
Reviewing a subcontractor's output as though it were an external report is not enough. The firm is putting its name on the conclusion, which means it needs to understand the basis for it: what was examined, what was assumed, and what was not covered.
In practice this means agreeing the working paper standard before the work starts, not receiving a deliverable and asking how it was reached. It also means the firm's own quality review applies to the subcontracted portion. If the firm cannot review the work competently, that is a signal that it should not be selling it, which is an uncomfortable conclusion and usually the correct one.
Telling the client
Most client contracts require consent to subcontract, and many firms treat this as an administrative step to be completed quietly. It is better handled directly. Clients are rarely troubled by a specialist being brought in; they are troubled by discovering it from a signature block on a document.
Say who, for which part, and what the firm remains responsible for. Where the client's own rules require it, obtain written consent and keep it with the engagement record rather than in correspondence.
Access, which is where confidentiality actually fails
A subcontractor with a well-drafted confidentiality clause and standing access to the whole engagement workspace is a confidentiality risk regardless of the clause. Contractual protection is what you rely on after something has gone wrong; access control is what stops it.
Grant access to the part of the engagement the subcontractor is working on, for named individuals, with an end date. Then remove it at the end of their involvement rather than at the end of the engagement, and record that it was removed. The register that tracks client portal access should track this too, because it is the same question: who can currently see this client's material, and should they.