A busy quarter and a pool of associates
Demand has peaked. Your employed testers are fully booked, so you bring in associates: a mobile application specialist, a cloud tester, and a couple of generalists you have used before. Each needs a contract and an NDA. Some clients require evidence of vetting or specific certifications for anyone who touches their systems. Your insurer has its own expectations about subcontractors.
Each associate needs access to your reporting platform, the engagement folder and sometimes a firm laptop or VPN. When the engagement ends, that access should be removed. Their invoices arrive in their own formats, some with days that do not match what was booked.
Your operations manager keeps it together with a spreadsheet, a folder per associate and a lot of email. The associate who worked for you last year turns up again, and nobody is sure whether their NDA and vetting are still current.
When a client asks who worked on their test and on what basis, the answer takes an afternoon to assemble.
Why associates create paperwork
- Each associate has documents with their own expiry: contract, NDA, insurance, vetting, certifications.
- Client requirements for who may test their systems differ, and must be checked per engagement.
- Access to tools and data is given for each engagement and needs removing after.
- Associates' work must meet your methodology and reporting standards, without the familiarity of employees.
- Invoices come in different formats and need matching to bookings and approvals.
What slipping paperwork costs
| Slip | Consequence |
|---|---|
| Expired NDA or vetting not spotted | Associate booked where they should not be |
| Access not removed after an engagement | Former associate keeps access to client data |
| Client requirement not checked | Awkward conversation, or rebooking |
| Invoice days differ from bookings | Overpayment or dispute |
| No single record per associate | Hard to show clients who worked on their test |
Access is the one that matters most for a security firm. An associate who still has a login to your reporting platform months after their last engagement, with client reports sitting in it, is exactly the kind of loose end your own clients would criticise in their testing. It should not survive in yours.
The associate management we build
- Each associate is onboarded once through a portal: contract and NDA signed electronically, insurance, vetting and certification evidence uploaded with expiry dates.
- Reminders go to the associate and your team ahead of any expiry.
- When an associate is suggested for an engagement, their documents are checked against your requirements and the client's, and anything missing blocks the booking.
- Access to your reporting platform, file storage and VPN is granted for the engagement through your identity system, such as Microsoft Entra ID, and removed automatically when the engagement closes, with a confirmation step.
- Associates log days against their booking. Their invoice is generated from, or checked against, the approved days, and passed to your accounts package.
- Each engagement records who worked on it, with their credentials at that time, ready if a client asks.
What your firm requires from associates, and what your contracts and insurance say, are decisions for you and your advisers. The system enforces those decisions consistently.
What changes when associates are managed properly
Bringing in an associate for a peak is quick, because returning associates are already onboarded and checked. Bookings only go ahead when documents are current. Access starts and stops with the engagement. Invoices match bookings. And when a client asks who tested their systems, the answer is on the engagement record.
Associates notice too. A clear onboarding, predictable payment and no repeated requests for the same documents make your firm easier to work with, which matters when the best associates have plenty of choice.
Take the returning associate from the start. When operations suggest them for a cloud review, the booking screen shows their NDA is current, their vetting expires next month, and the client requires a certification they hold. A reminder goes to them about the vetting renewal, the booking goes ahead, access is granted on the start date and removed when the engagement closes, and their invoice is checked against the booked days before it reaches finance.
Is this how associates work with you?
- Associate documents are kept in folders and a spreadsheet.
- You are unsure whether a returning associate's NDA or vetting is current.
- Associates keep access after their engagement ends.
- Associate invoices are checked against bookings by hand.
- Client requirements for testers are checked from memory.