Engagement models
Three commercial models. The right one depends on how well-defined the scope is, how much you want to flex, and where the risk should sit. Most engagements use one cleanly — some blend two.
Scoped outcome. Fixed fee. No surprises.
Best when the deliverable is well understood — ISO 27001 readiness, Essential Eight maturity uplift, audit gap analysis, IMS integration. You know the price up front and the outcome you're paying for.
Best for
How you pay
Typically 30% on kick-off, 40% at midpoint milestone, 30% on acceptance.
Pay for the hours and days actually worked.
Best when scope is evolving — fractional CISO / Quality Manager, ongoing specialist support, hands-on remediation, or a programme that needs to flex as the business learns. Capped weekly or monthly so spend never runs away.
Best for
How you pay
Daily or weekly rate, billed monthly with a transparent activity log and an agreed monthly cap.
Pay a share of the savings — only if I deliver them.
Best for vendor recontracting, licensing optimisation and IT spend reviews. A small base fee plus a commission on verified, audited savings against an agreed baseline. Aligned incentives, skin in the game.
Best for
How you pay
Small base fee to cover discovery + 10–25% commission on verified Year-1 savings, paid in arrears.
Not sure which fits?
Tell me the problem. I'll recommend the engagement type, the commercial model and a realistic price band — before either of us commits to anything.
Book a scoping call